Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
29/04/2024, 16:53
240429-vd64msff34 8Analysis
-
max time kernel
479s -
max time network
474s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
skibidi_copy_off_game.rbxl
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
skibidi_copy_off_game.rbxl
Resource
win10v2004-20240426-en
General
-
Target
skibidi_copy_off_game.rbxl
-
Size
3.4MB
-
MD5
6b3b0755a3061008bfe8894901f97956
-
SHA1
1d6f9f911d5198195945734f0926b374d9bbc416
-
SHA256
07025b2e0e775cdb2540ac7f4ba53d4697eae2bc3167274c10dd5258cd99371d
-
SHA512
705e2aaa6d3677a104c0e0d3a9f5f2db355f252c74270da9e3692a1c7a1e555c3b9abcb27dc65c48911448318df3e53a15d557764c41149ae54ed97c39a2a162
-
SSDEEP
49152:m6IOzVAz4eJYVxpTlTeUnKHavU+jQ+4HDeGChDAjSb0lc5LEb3:m6I4+9QlKGUOQ+4jGAjSb7I3
Malware Config
Signatures
-
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Executes dropped EXE 27 IoCs
pid Process 3192 RobloxStudioInstaller.exe 5100 MicrosoftEdgeWebview2Setup.exe 868 MicrosoftEdgeUpdate.exe 4468 MicrosoftEdgeUpdate.exe 3080 MicrosoftEdgeUpdate.exe 4512 MicrosoftEdgeUpdateComRegisterShell64.exe 2864 MicrosoftEdgeUpdateComRegisterShell64.exe 956 MicrosoftEdgeUpdateComRegisterShell64.exe 3240 MicrosoftEdgeUpdate.exe 524 MicrosoftEdgeUpdate.exe 996 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe 1944 MicrosoftEdge_X64_124.0.2478.67.exe 3572 setup.exe 3864 setup.exe 4740 MicrosoftEdgeUpdate.exe 2760 RobloxStudioBeta.exe 4092 msedgewebview2.exe 664 msedgewebview2.exe 640 msedgewebview2.exe 1772 msedgewebview2.exe 4496 msedgewebview2.exe 4212 msedgewebview2.exe 1092 msedgewebview2.exe 2300 msedgewebview2.exe 7088 MicrosoftEdgeUpdate.exe 7128 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 64 IoCs
pid Process 868 MicrosoftEdgeUpdate.exe 4468 MicrosoftEdgeUpdate.exe 3080 MicrosoftEdgeUpdate.exe 4512 MicrosoftEdgeUpdateComRegisterShell64.exe 3080 MicrosoftEdgeUpdate.exe 2864 MicrosoftEdgeUpdateComRegisterShell64.exe 3080 MicrosoftEdgeUpdate.exe 956 MicrosoftEdgeUpdateComRegisterShell64.exe 3080 MicrosoftEdgeUpdate.exe 3240 MicrosoftEdgeUpdate.exe 524 MicrosoftEdgeUpdate.exe 996 MicrosoftEdgeUpdate.exe 996 MicrosoftEdgeUpdate.exe 524 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe 4740 MicrosoftEdgeUpdate.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 4092 msedgewebview2.exe 664 msedgewebview2.exe 4092 msedgewebview2.exe 4092 msedgewebview2.exe 4092 msedgewebview2.exe 640 msedgewebview2.exe 1772 msedgewebview2.exe 4496 msedgewebview2.exe 1772 msedgewebview2.exe 4496 msedgewebview2.exe 640 msedgewebview2.exe 4212 msedgewebview2.exe 640 msedgewebview2.exe 640 msedgewebview2.exe 640 msedgewebview2.exe 4212 msedgewebview2.exe 640 msedgewebview2.exe 4212 msedgewebview2.exe 1092 msedgewebview2.exe 1092 msedgewebview2.exe 1092 msedgewebview2.exe 2300 msedgewebview2.exe 2300 msedgewebview2.exe 2300 msedgewebview2.exe -
Registers COM server for autorun 1 TTPs 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks system information in the registry 2 TTPs 14 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\CFrameValue.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation-067f4e4b-660967ca\React.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\Qml\QtQuick\Controls.2\Imagine\RadioButton.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\Smoke.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\PrismaticConstraint.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\StudioSharedUI\import.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\TerrainTools\icon_shape_sphere.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SystemInfoProtocol\t.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\strict.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation-067f4e4b-660967ca\RoactNavigation\views\RobloxSwitchView.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\TestEZJestAdapter\JestReporters.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GamePlayButton\RoactUtils.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Lua\Notifications\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\InGameMenuJest3TestSuite\InGameMenuJest3TestSuite\default.rbxp RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\StreamNotifications\SharedFlags.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\language\__tests__\predicates.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-f5bcbc0c-f336d473\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\TestingAnalytics\validateDiagList.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\avatar\unification\R15.rbxm RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\GameSettingsPage\AutoPropertyToggleEntry.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\Collections\Collections\Array\reverse.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\memoize3.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\RoactRodux\RoactRodux\shallowEqual.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Utility\memoize.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiSharedComponents\Dev\Rhodium.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Lua\Notifications\Light\SI-Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\Debugger\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Utils\addRawValueMethodToEnum.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Components\AssetCard.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\RoduxFriends.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Screenshots\ExternalContentSharingProtocol.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VerifiedBadges\Dev\Rhodium.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\StudioSharedUI\default_user.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\ui\VR\hamburger.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Responsive\Dev\JestConfigs.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\ui\Settings\Players\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\JestConfig\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Object\assign.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\TestUtils-edcba0e9-2.4.1\LuauPolyfill.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\Debugger\Dark\Standard\ConditionalBreakpointDisabled.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\RecordPlayback\RecordPlayback\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Loading\LoadingSpinner.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\Flags\GetFFlagEnableRobloxCreditPurchase.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Navigation\PrimaryNavBar\Constants.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\StudioSharedUI\list.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Localization\Locales\tr-tr.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\react\data\OperationData.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\RefreshScrollingFrame\RefreshScrollingFrame.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\utilities\valueFromASTUntyped.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\Shared\Shared\shallowEqual.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\content\textures\ui\Controls\DefaultController\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Bar\ThreeSectionBar.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAA21.tmp\msedgeupdateres_el.dll MicrosoftEdgeWebview2Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe -
Modifies data under HKEY_USERS 48 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588832865872370" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-e2728ac197f84660\\RobloxStudioBeta.exe\" %1" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F} MicrosoftEdgeUpdateComRegisterShell64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4740 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2760 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 3192 RobloxStudioInstaller.exe 3192 RobloxStudioInstaller.exe 868 MicrosoftEdgeUpdate.exe 868 MicrosoftEdgeUpdate.exe 448 chrome.exe 448 chrome.exe 868 MicrosoftEdgeUpdate.exe 868 MicrosoftEdgeUpdate.exe 868 MicrosoftEdgeUpdate.exe 868 MicrosoftEdgeUpdate.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 5580 msedge.exe 5580 msedge.exe 5216 msedge.exe 5216 msedge.exe 4356 identity_helper.exe 4356 identity_helper.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 6648 msedge.exe 6648 msedge.exe 6648 msedge.exe 6648 msedge.exe 7088 MicrosoftEdgeUpdate.exe 7088 MicrosoftEdgeUpdate.exe 7088 MicrosoftEdgeUpdate.exe 7088 MicrosoftEdgeUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 2440 OpenWith.exe 2760 RobloxStudioBeta.exe 4428 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
pid Process 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 4092 msedgewebview2.exe 4092 msedgewebview2.exe 4092 msedgewebview2.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe Token: SeShutdownPrivilege 408 chrome.exe Token: SeCreatePagefilePrivilege 408 chrome.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 408 chrome.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe 5216 msedge.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2440 OpenWith.exe 2760 RobloxStudioBeta.exe 4428 OpenWith.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe 2760 RobloxStudioBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 4740 2440 OpenWith.exe 89 PID 2440 wrote to memory of 4740 2440 OpenWith.exe 89 PID 408 wrote to memory of 4500 408 chrome.exe 92 PID 408 wrote to memory of 4500 408 chrome.exe 92 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 344 408 chrome.exe 93 PID 408 wrote to memory of 3208 408 chrome.exe 94 PID 408 wrote to memory of 3208 408 chrome.exe 94 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 PID 408 wrote to memory of 1328 408 chrome.exe 95 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\skibidi_copy_off_game.rbxl1⤵PID:880
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\skibidi_copy_off_game.rbxl2⤵
- Opens file in notepad (likely ransom note)
PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb9d3fab58,0x7ffb9d3fab68,0x7ffb9d3fab782⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:22⤵PID:344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4696 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4660 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5096 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:3752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5444 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5704 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5928 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5840 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4712 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5112 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5384 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5064 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:82⤵PID:2388
-
-
C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3192 -
C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5100 -
C:\Program Files (x86)\Microsoft\Temp\EUAA21.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUAA21.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:868 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4468
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3080 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4512
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2864
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:956
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzBCMTA5MjctODk5Ny00RDVFLThFNjQtQzM2NDJDMzEyNjFGfSIgdXNlcmlkPSJ7ODI1Qjk5QzQtQzM3Ni00RkUxLUE3OEUtMDRFMjkzNzcyNjMyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1QkUwMkYzQi01MzY2LTRBQjYtQUY3Qy00N0UzOTE3MEQ5M0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMzE3NTY0MjEiIGluc3RhbGxfdGltZV9tcz0iNDQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3240
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{70B10927-8997-4D5E-8E64-C3642C31261F}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2760.1560.133756145005897001904⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:4092 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=124.0.2478.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffb889dceb8,0x7ffb889dcec4,0x7ffb889dced05⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1948,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=2080,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4496
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3512,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4212
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4132,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1092
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 622, 0, 6220470" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3536,i,10492475360151448874,10542547739398440009,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2300
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://create.roblox.com/docs/tutorials4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb882046f8,0x7ffb88204708,0x7ffb882047185⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:25⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:85⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:15⤵PID:5892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:15⤵PID:5924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:15⤵PID:524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:85⤵PID:5888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:15⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:15⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:15⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:15⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1106015374611403026,18042463601629176006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5172 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:6648
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 --field-trial-handle=1988,i,5198210966489102842,13650032610920336482,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:448
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3528
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:996 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzBCMTA5MjctODk5Ny00RDVFLThFNjQtQzM2NDJDMzEyNjFGfSIgdXNlcmlkPSJ7ODI1Qjk5QzQtQzM3Ni00RkUxLUE3OEUtMDRFMjkzNzcyNjMyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyNEVFQTA3Qi1CMEE1LTRBODktQkQ5Ni1DMkRGOTM3MkVGOUZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMzYyNzY0NzYiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3368
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\MicrosoftEdge_X64_124.0.2478.67.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:1944 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\EDGEMITMP_7389C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\EDGEMITMP_7389C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
PID:3572 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\EDGEMITMP_7389C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\EDGEMITMP_7389C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6FA06D38-2DF8-4FCB-B407-B2550DDB0474}\EDGEMITMP_7389C.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff64f6f88c0,0x7ff64f6f88cc,0x7ff64f6f88d84⤵
- Executes dropped EXE
PID:3864
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzBCMTA5MjctODk5Ny00RDVFLThFNjQtQzM2NDJDMzEyNjFGfSIgdXNlcmlkPSJ7ODI1Qjk5QzQtQzM3Ni00RkUxLUE3OEUtMDRFMjkzNzcyNjMyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMDg4ODhFMi0wQjI5LTQ3OEQtOTJCQS05QjI5MUZEM0Y4OTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE1MTYyNjM1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNTE3MjYzMzkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2Mzc3MjU2NDY4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xMzFiZDVkNy05YzY1LTQ3NmEtOTA3NS1lMjQ5NGY4ZGE5ZTQ_UDE9MTcxNTAxNDYwMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GVVdiZHVNY2tJU1Ixd3lpTmEwU0E1MSUyYkpQSkF6JTJmbGwlMmZOYkY5WUo5REdWWnQlMmJxSFBjdFhHc3Z6aURieXpuUDh5ZHNhWUZMJTJmSFNmWG5vRGxMJTJmMWduUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjcyMzc2OCIgdG90YWw9IjE3MjcyMzc2OCIgZG93bmxvYWRfdGltZV9tcz0iMTYyODYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2Mzc3MzY2NzU1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM5MTU2NjYzOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjgzNzQ5NjUyNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjkxNiIgZG93bmxvYWRfdGltZV9tcz0iMjI1NTUiIGRvd25sb2FkZWQ9IjE3MjcyMzc2OCIgdG90YWw9IjE3MjcyMzc2OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQ1OTEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4740
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:5104
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:996
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3dc 0x4901⤵PID:5312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3156
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5804
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
PID:3988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
PID:6348
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:7088
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:7128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5c31297188ec9fbaa60449f769339963e
SHA18502d9e0cef18137529f0a46ad6e69a1577e6cae
SHA2562e2eff110475dd3dfd732ab514e4692032e67b2d228d0081634a87f45cde5ff9
SHA5129525e3e08b953fe36270c7b4868959e9bded055c5577e5ca94d79606b671e6660d180f763b54a276bf356e82d7073901c373e0b40cfca924cc4b38384c20e22a
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.67\MicrosoftEdge_X64_124.0.2478.67.exe
Filesize164.7MB
MD5dabc3160a804b9fadd89ceb0fcecf388
SHA1b52f15e866a18637683bdf0ea4eaa326b787396f
SHA25653eb39a92ee0d2eb94f6d33c015097bddd9cfe5c4129d3ac9a9facbfb5087bfe
SHA51274fc0f21d7cf99e07c079224e2af8a4a51bff98a97bc471cfedfbd3a28d3ee681fbd63fa7239948c3c0bf4f9af56dc582dd128f8c08b54cb73389e85f949f431
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
Filesize
27KB
MD5d749e093f263244d276b6ffcf4ef4b42
SHA169f024c769632cdbb019943552bac5281d4cbe05
SHA256fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
SHA51248d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
29KB
MD528fefc59008ef0325682a0611f8dba70
SHA1f528803c731c11d8d92c5660cb4125c26bb75265
SHA25655a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
SHA5122ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
-
Filesize
28KB
MD59db7f66f9dc417ebba021bc45af5d34b
SHA16815318b05019f521d65f6046cf340ad88e40971
SHA256e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
SHA512943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
-
Filesize
28KB
MD5b78cba3088ecdc571412955742ea560b
SHA1bc04cf9014cec5b9f240235b5ff0f29dbdb22926
SHA256f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
SHA51204c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
-
Filesize
28KB
MD5a7e1f4f482522a647311735699bec186
SHA13b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
SHA256e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
SHA51222131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
-
Filesize
27KB
MD5cbe3454843ce2f36201460e316af1404
SHA10883394c28cb60be8276cb690496318fcabea424
SHA256c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
SHA512f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
-
Filesize
28KB
MD5d45f2d476ed78fa3e30f16e11c1c61ea
SHA18c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
SHA256acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
SHA5122a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
-
Filesize
29KB
MD57c66526dc65de144f3444556c3dba7b8
SHA16721a1f45ac779e82eecc9a584bcf4bcee365940
SHA256e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
SHA512dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
-
Filesize
30KB
MD564c47a66830992f0bdfd05036a290498
SHA188b1b8faa511ee9f4a0e944a0289db48a8680640
SHA256a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
SHA512426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
-
C:\Program Files (x86)\Roblox\Versions\version-e2728ac197f84660\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
280B
MD5c287dcd6f098ad04ccb48f58a7ac19ac
SHA1fd439ee04be1d58629f6583f4a699f7f23270205
SHA2561b48379ca4d61a0d8b2ec1e1d2a9a28a4eb59bcebaa499f3a982341967ba8a91
SHA512a454413f5c355e22486fe83fe03f2ea2de185cb21541cde7e3cb74868be619532640006f6fa93b9fed22011cd04e5e086d3e92f7f70c7c5513f72a9867334131
-
Filesize
101KB
MD57cd689296e30163ce9c74623754a0952
SHA1837712d0542e2fca9a53152bbaecb4150d19e47b
SHA256955bd6a71bf42cebd7ea701e6cd5bb0bc486840df371ee6da467ea1fe0eaadf9
SHA51282398cea3886210f4f33c26661ad5e63a2874c2e58a412064c90b409a5e44b6143283bce466b4b46400a67f8a43fd8dbe094bd674c50744dfc53193030fd14fe
-
Filesize
1KB
MD5e64507bc8947b9aa6b6a68fbb3b4a3be
SHA13c5f013443fbcf8019a47025e8dd4b91b4c44c91
SHA2564b6aa9699c37d6c41a7ff70d54c2d15ac412e5878d640694172f75f2ffed956f
SHA512d9941a14d446b26f2c12c6bdb3c7b1e2a7fa62109acdeaf0b3f9d50557247c055eab3a07ce5b70e774410e5c0f5cb9b6793e70f5d60a67e2219ec9ac5f4e0505
-
Filesize
6KB
MD5512bd5d8e2fc4f716c60038532024874
SHA12036209e40bdf19041300bcbb3e2e06047e6c8b5
SHA2560b9b034d7f8d699c1da6ac020a52ea9e7463860089a6d1583710bb9d5352584d
SHA512c65794a9c25394731ac32fe7441d567ce19be9edd5bc363cee8c3aeb8f00ebcdc58718798c15fe0b0fd9006603495d6d73ab9c95f739085ec50b05ccfb73e716
-
Filesize
7KB
MD5c4d83c2355f696fc70944f5198a07046
SHA1a6ba5a90eb2da1ee4852113db57e81e6c4fc30ac
SHA256f41767b9b77b0c6065e13ba2ce1c8e3591b0a4f770fcc0b06595e537a2a8d16c
SHA512c607665d18a227108f4465be24bea691b4ec4558c29198b193a225d70fdc46be4ec8d562a2613ffba3976dc2ac51f6353239e9c34eba66f4fee067369cb2b9c1
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD5d851dd1a1dec2ddbe4c13d6c9db44a48
SHA1445d929506894be4f8e050dc41cce07e0b344e5f
SHA2560f4cfd49904e79108a4af38058d16b66db0b5856ffc2b44cbd90b6df95ea2915
SHA5122aa9ff9d44036db6fd4761d6445c6cd8d5a0ac32f746af8a37038f16a82c2ce85c67e12296c7ffe4020902ef805cdd2a5a42da7158ff14499936878e2626b44d
-
Filesize
524B
MD5c8475d7e64b54f3d92e00ca764ae912e
SHA11250e0dc218a2cee1028d708f0f3ec234d5a3570
SHA2565d47cf9d615b7180fd3b57c37ed46981fdf31ff53c5622bbfe75751a063169a4
SHA512c9bfcb66bea91f87dc6913c06ca8ef5a5ed2edd82bb7fb4f132ad162acbae7d91fac6e0e59b72262fef0ba0618f06a6216ed5d47c2548b5ded92d304e2717983
-
Filesize
692B
MD57a515b53603c6dd7dea305f4804fc3fb
SHA1f56467f780d674603c463847291c6bf2f3a41362
SHA2568a7e2733fe3cd9a4612088336d8fba12e0c7613cdf35a2877441154895283557
SHA5121d214e279bc942e568978b7d724649d5363ed983a737506f972aeac75bd188c60155e2f37749b35232395e5eee8643ccdc7aedbd6dc8b5d8152a7db3b8f7f828
-
Filesize
2KB
MD54f78aa66c3d4bde8b24f5e43243be2be
SHA13f7bf76fe67527b2d6e651ff9c711089f6a0784d
SHA2564aeec8b7e51a6c8ee1de32873ab584ced00f1448d9a84708d2a8a8f8e51e89c1
SHA512f9bd53c45f5e37225554a81cb21e70b321e92bddf9fbf1bc080ee4a17213ad54f2f705c2dd316734046f659efa0268d03d43c25aabfe215dbc1c3576dadc52b3
-
Filesize
524B
MD5a82a8fd5f1f5baca0a182b0ec14e81d3
SHA15eb3f7aacaa8d4879708d876c69df1af7f25dbe3
SHA256cf5619f84f4c0ae7715702e7bfdedda17588483307339d3a607f92b450746703
SHA5120fd681b5359f4574e562b946734934001815f8e50e725dec3e9946683e379f1001d9938feb0e77eb4678949aa28cdf0def5f93c6e0e522a107dc16d38e29e681
-
Filesize
7KB
MD5254b9e906dff1ce6319705b432d17ca5
SHA1d56262daaaaf90ec1a59594183db326962ba1cc4
SHA25613b35d807bfd33e4e3c647d2d45f37befe5eac6ba5483b3d0001f6b3eae6aebd
SHA51292b62504f9a91598d08db376c90a21ec8da5cfb6ca4b7374f57c1b5ac7f17310820f5c03c1ab2e80d385a70cad8d667064cb3ea44d0d937556e7eb8c1e1ea111
-
Filesize
7KB
MD5fab10b37ee3fe76b500a465001097d6f
SHA199da6262c6d3fcc6c67a28c2ba1ed15e965bce96
SHA25666d44c5038bab3b21043380eaedfb6f83689da719da7dc5dd872b1dabc51c503
SHA5123ba51066318c0e9a9c0cad8a9d20eafffbe4ef337f53a8b4e5c45797c4d6122c05132fecfdeb8519447a1d438f827e5e42a5694c9a05bf3318de7a57956ba04f
-
Filesize
6KB
MD5c9de718257e7b0da85d15ca94dcce28f
SHA1b3ac1502156dddbaaab4a292189c9bbe23db2131
SHA2568d07431a0d161bca85118760260133f4fd6a0c1586be858e4ce7bbea108db07a
SHA5128a1ba627b0eaec6da3fbece26231c625e7b25d5efae0dab01e492eacf01f325b56dd78891fae0e31b8aa1a9300d3abdb5992cd6686161131566af1fd6196e688
-
Filesize
7KB
MD5e61c2720582af793d016b6642326fdb5
SHA1141018a296410fa656e0b82d302f2d3dcc19a30f
SHA25687cc6b9f1fe15f3a43a3d12ae3fd8ca8b6f9f1c76a8e93c74f21a786fd28f43e
SHA5126fc6efe50c7be725e88392987839f01d80aaa83ebe446115333c3660c572e488bdaa661ceca20bf457c402a2a1def3efb87cb969861165e0de7b7b5b22914f19
-
Filesize
7KB
MD550a0cd4942d3d599f3929968d3eb0856
SHA1efdd6b38e81266e469aa510cf3eac70c444c9f19
SHA2560ecc4099586898843d9bcae3d2b31249bbd0663e02a66bc7d756d67fc439b8e1
SHA5121d0adc89a74502c2fd5ca2fcb6139b3e80eebf250b245da8dc4465a5f8fbb52299aa1ded8d50afec7a48045a68ecc1427ad15cecd56129d4a718809cd5bb62c4
-
Filesize
16KB
MD5fc113d121100320ebcbaa89d6edab904
SHA147882b6628cae464b6cf95192ed5c60117937c42
SHA2560e3373c8d8af6b69903eb1212ae94b3f9f07907ca57a02d9f15684a8bd459050
SHA512de686a04b5cc00f21604ab4c8ef56143ae4e34c11e30f1f89b6d20ff5f13328def6b365e936dd8e2a5994eb4b3aed5c490d2b38afa29918a01fa64dac6d49fd9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize56B
MD594275bde03760c160b707ba8806ef545
SHA1aad8d87b0796de7baca00ab000b2b12a26427859
SHA256c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
SHA5122aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58af08.TMP
Filesize120B
MD593e3b47278bb5eddbdb7dcde7cebc4f7
SHA132eba57efbcc28a18831f17ff71f69c086e46ed6
SHA25601ddb24f8e089a1593bbd7c6bebe433cbf66898a2340201c6bc0841502b2dd1b
SHA5122f5061c8a1996da06b8d4c173dd1785fdf60e41c077ad6c6e5605824840c219f70f7447b7e0b9edbd5a2bb559e8dd98ecf3e31498dc946119cc02bb045a0daa8
-
Filesize
258KB
MD51c7d0926137955e805d6ae260425b3bc
SHA158df734a8a45594402e5b49aa6e0cd5780efe69b
SHA256e5638a4030ad4a973efd31d8d1fc53e3672ca02d44afb46b800eb991c894bac1
SHA5125da07b03dea801d9ab952ae50517a56c7421549bfd1b70371cc74a0cd9dad79450b9621ca128125feaaa1e99387414b32aadc9996da53a7ee9c27802ed57221b
-
Filesize
258KB
MD522969a287aa728cf1b62873e564b0aa0
SHA15d2212b39fa8176c96fe82024c42f3f983f25e42
SHA2563fed038d4be042fde43ef3e8e6f66e89c36e339ee6479350cfc69fa22cedbfd1
SHA512000b2fb1d13717cf14f0a3e23092914b3fa65530bb4925d63ef0cd4671993e3c5e3c27fa5599bd49c66e8d2158eb7bd4e7f3aedb65793dbe749d13081d98a193
-
Filesize
131KB
MD51890a84a71f2844082c7e2d3d6696312
SHA113fcf56c8d7fd470cad713e8a37884da2dc10895
SHA256d66a2e4ae066cfe163e0107d63d5af180d1afd6f693bdeac4d592c23d0e5132b
SHA512d8401093de41a28428bd963806a5934175eb36edd4cea74a158b36a1c71b80a13eae4e96a698ca7f5053d3f95327911f459f90b5786537064c4a39fc8471a690
-
Filesize
278KB
MD52ec66111c2cd21387bc719d6f8c3edc1
SHA1d8af024befd23e8cbb56e145fd5afede56c3167e
SHA256c9bde1bc6e1e97a77aeabd00730104bc02b71809dd5db75d75709b2fb046ff45
SHA5124590a711a49274eb9001eff97a842c6358852de885f2fe1a951a6c85923c45de1f66f74641c1abe1feb8f4a99df58b57f61a9c1b8083e711628f1899c4157b87
-
Filesize
91KB
MD5911bdffbadb4241579841be7b8ff7210
SHA1d16cdadc10e3c9fe0e02ddb96cd9f6786db6c42a
SHA2561f35aee93b06c3b233f8d16d7a042f37ec4f4eb292db844babb76ef282514685
SHA512d011d6ecef34aa9a7b23e8299c6c3c66f6cc380c5c9c756e6602b68da99ccb6160f699cfc34d5f0c9f7d746f91ce737f65ac62a8f72906f4d5ad4c56406cf3e6
-
Filesize
104KB
MD533ef16f68db82ec6f4552db2cf5d00c3
SHA15958bacb55edf9f375fd13b93f8777435e239607
SHA256952b7d3447dd9cc8c6ff94115f433572d04eeaa505be785983f5da2f14bbe320
SHA5128bdfc957d6f9663b6e362f611bb33f107432b67c580d6833b9992e9c6b79b5cf6c31e558b05bdf09e24b6c1820dfe8ad6cf40b292e71dde9c170efc6164bc2b1
-
Filesize
97KB
MD54511dde3b6c0b421fac8f8a07429162d
SHA105c0890f8ced5b2b463aa563297920637fa84a0f
SHA256d65539b5e6ac612462250b9e0ecf1efab5b96d2009556507f6ce914a2194511b
SHA512dd6a8f42459383c04ce4980fff67b54a81833cdb7161444dad2b1b42c6f564fd8a08c7fdb752e8eaf09374e0febc44ec048078ba713cc56e0d20302f3319fd31
-
Filesize
88KB
MD50376ed7602cf44d4c1c78a056926ff0a
SHA134f91732ac6bb9e5d54812c45b155909cd8c2839
SHA2566fc01c63e07327fd701dd0cdad06765a94f32d4e08e770ed82ea251762aeee07
SHA5124864214df1359ea51d5bb42ee5e62c08ed2fcb271a5deed526d2ec1fba0e9c6af1ad7f918f4b91a8e0286c6dd0d28a02c41fdad3e8ee25b85a3ce8fa77ad9b1b
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
46KB
MD593034958709b77ca22991f2ae190b378
SHA1011ad697943b12f67252ccafa82bdfb322f368e5
SHA2569d51239781b4e67851557fb3b7b5fca99c3205e9d53c7beaa0eecd60389fec29
SHA5126a3772a08202fb3b34620ff2f007044e4086d2ab031baa0832e5372351d07fd6fbc161d97405f358456db86fb8928081f5bd5792def80a661c932b1a79dcff37
-
Filesize
42KB
MD5e375447ed0a7aa1ca7d5dc5ca4632b2b
SHA134cefcc7ffd7b329b63af54d2b35d890d14fa870
SHA25601bc6b654fbb35db915a7963ab9ce2473ce952985796aa9c07175deb4df28e35
SHA5122202c9152a15458694c83f25962b8adcdd90cd06a8f4ffd2b062ae88e0803e560cb111c241a81e04f6f07d97348aadbaca0522a5a67613708a747717e7b4356b
-
Filesize
41KB
MD5e0a5b5b5b60870c900d4e965d0582b5b
SHA1324bb751461fb997107f4c2f869042b093ac3ca4
SHA256a4658e257cd9b7c17301efa73ef9d9d66c9561ceffdbc92fb5e5b64454b87f96
SHA512e7c17425d5a6954710393ec309e473db216db095072f64caa968b9a3e1943efa75160873c8d965ee1a36a7493816c11a59bc24c245014fb9f8e6b5d043c7455a
-
Filesize
40KB
MD50c4880fb1de7d2ef097042adee0d2d31
SHA1ea7b12eae99f8f044352f1dd1bc4f7ea3786eecb
SHA256506fd688cabceb56eed3a3ffaed6afe80f124c61b223b3c8cc231c74ceb5c73d
SHA51274d5d2148505142bcfee0f99d3879a4c5baca87575026df3eac7d504b56c849f827645b83fa7fe2d64bc6bc3b53ee35ad458ba56b846b2d4a5e03996e2ddd80c
-
Filesize
32KB
MD51c0dbbbe78b3c4da3b17615ba2ad894e
SHA10744affda27ca159bece4c423c115ac7e4c83a8c
SHA2568ea6f2138912706e4b02c78db64ca72d64cb632ae6918c181d8f7f90358e2551
SHA5125f972037b0daf2f70d98f79540ee15138ac0cb2e21610f96d1c25903b0acd42b5031ecf0a9655a13e72b3430d126c9be64008c4b9219039d961c9c1be4475305
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize552B
MD543ea55ef87d7a8fe799d07ee2de12986
SHA19a40c435612996a4978ac610b58a57f1f945f28d
SHA256f68585aafa60c9362c4b69b2b8df70c88d787b59312beeb866f629e1650266f3
SHA512c34124e460a45299df8ebacbc6cf125112e1b1f2e32996e8abed3dc2d19ac5c8e3d332343c7c403724ffb42d9751d97384a09e564b8e8e4bd6941139f0d114c8
-
Filesize
3KB
MD5791bc3672767bf911fde717f61523364
SHA154a06ab9554bad03a7584ae5ac666114bcce90e6
SHA256567b02bb12de4b023243449d31f3171bbfce2f0837712be0ecfa40e6608acadd
SHA5127535950acebb58c97c7919c6e92dc5ae716d97df04754b458e6697e4df09a0e83639c4995904fe892d9d11d1879dc73b84719f47223df9354b00e87dd9db2e30
-
Filesize
3KB
MD547f7e9b6995cbd27663a0a5378eea402
SHA1bc49732375d6c1b5d1a7dbd1ea1bff168a57823a
SHA25642c93d3a4abff7ff4aaefa5ad6bf27f8e384798e97c4ddb114ed1beca43b7eba
SHA5129d9d5c903fa799a229de322328c79bf010015aabc896b3e8de35173e249fd63446d1a9c33dfa638fc9488002381952fac11d5ec075d4c24f361a669eb6751eb8
-
Filesize
6KB
MD5a312c0f2ef4c53b574f8a071c3ca90d1
SHA1d67261cb2446e3c9c740ae165c3da1c5c3b47121
SHA256922f4fe46f69d6526ae5a045ae20daac5a5de5796d6312bc1ddbd6f2a2af3464
SHA51278015085b223f94446a77a57d1154b0922d0e6284e346cc03218d28b4b6265a5a9592f6aa1d85c374c2cab01e37032a2b342fe9ea5d467d3f2ee12e628968e0f
-
Filesize
7KB
MD58dd0dd8dd91b3a67772b1218b3aa4e7d
SHA1a2b77a2548de450e57b3ee13e0281b6ab54690e1
SHA2560f40887530666d3bbf85869f64e96ea03b775d33554b2fa20302ffffed4006c3
SHA51223813b62f2cd13c4f1fb8aef6ad9f7d0f52a1b900c08467144390e75e53f965c747a187a8b847aa5ebd5a90907855359ee5c1099f4e00a1fccd5f2d4e35dda3d
-
Filesize
7KB
MD5e208bbb158be166e615f147b5bfb0dcd
SHA142519ef5172d571ae4868b2f7dc36087a2779195
SHA256618245ce894dafd2dd5e881a4f346f48435b03b7625028f9dce3ef9232be9533
SHA5121e000fecb27617dfd51035ebc10bd43b4e8854d736988ade4ecfabd116bb034d5e49127e6ad7535311bb031f2fd3370c3f1eb843ce83b5042aed4f33a1e16970
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\aadb3b92-a048-4688-827f-2932a59eb874\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize99B
MD59400f4491f38bf7fc553287a6e705cd6
SHA19471620c97b5679eb39fc713b68d38bf10a68b7f
SHA25609252efdfb3d989b7a1627193b9dbe82674082f34daf0e9fa8c70a3a4e7b8b35
SHA512d7101f10250d4187951a0b711ae3ffe2665060b11e18af7a629ee16e4a2d0248deff878af2bce17e6afb17d86811a27ecd634c72a3f5145312ded5b34357cfa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize35B
MD5343859b4ad03856a60d076c8cd8f22c3
SHA17954a27de3329b4c5eefd4bdcb8450823881aad6
SHA2568c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
SHA51258014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize99B
MD54d344c72a0edcfa8085f6d042d4a5aba
SHA1f22f45dce4601d8d62d10ca197251b6ccd91a99f
SHA2564fcff1c570a1604bd3b30e493d094bffb1b29f6652f7a235826b4ef4a729071e
SHA512ea7ca6d595df3255b6d2f6bc972f97cccd46416a072580635e1dd67c3898be9e9bd8f99d9c5880cb133b09ad4fd0d8914f3fb1b7ee92874bf10b0043814e93d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize99B
MD503bffd3cbd3fb5e3b15e69c58fa323a1
SHA14716d8752e84df3d46d9cf246ecef949b3f4e39d
SHA2566af942a50ea3b9e4d944a7fc3908b467e7928250fd14d6a04b0bcaca882e984b
SHA512f359c6fd7f01161b859a530a703a87fad60702e79c93f8d98b413fd015109ad78ebf0d60de8d8c94ab3ccaf4ced7b5ae9eb71a3d555257a9a1c1a36ac59b624a
-
Filesize
1KB
MD5d8057a0513820318268a5f54aca99aea
SHA17e6f4f10a692fd21352553dd8e02588f7219e287
SHA2561b89470abfa6f0c30e4965ff294fec8a440522930ba41d83a94260fb647c5892
SHA512afebc17bffbd86e6a257299d0af07e98f36bbc015474eb1ed8ffcae3a93826b7004f89a81d2e6da55f16b9b5df9574265207f169c5d03cd4cc35627fa8e7bf53
-
Filesize
1KB
MD53f736617fc034a0a4a0ca30b337fa0e5
SHA16e70fde24484043066eadcf09e95a7a3d228b2a6
SHA256dc5631e102f513c0dc5176369918f82301be22a883743fa883ded52c358aa8db
SHA512d3d50c3bfb91779c75f35c715b955f283ac140ec0af62ec348df648da100cebd6555db1a6c1ed822bd82253952ee454a6f4ce4fe28a93c4823ccd2df5febc1ba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbb900e7-3ec2-4f96-90fe-562c8561e9c5.tmp
Filesize1KB
MD590e47efc8415a0fffd1f2e5bce19b8ef
SHA109d6f2d9262fae42ce5adabf9185d9e3dfd999ef
SHA2565153a8b7ade79d04205adea058e20015dfb080456f5d23a50d0e5e274aed6f4e
SHA5121ec36274ed30791b21a1ab0336bcd39c7313327733874083831e1e6590c74cb6cca107189c85e38621179784328d6ddbb2521dbd954c48205cf1f1d1e56aced8
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
12KB
MD555dc55b3294422636531b5535b3aeb72
SHA137ecb1c99475db4d4fbb33c665d35cdc90ead13b
SHA25681eeefc4746c96e61ecc7b2d9667ee0564710bf9c8bbf04f74509f9a9993b865
SHA512b5e7870790a76bc3509ac207f94154aa7e70c5de49a39fb044876c18c5d93ad54ab50fde094faab40fc5b41847507918d5c6ae353b3e22490f6360080b2ad1a9
-
Filesize
11KB
MD5a961f439a2bd277ef9c082be43a03c1b
SHA192a1e66cd670981fec5cacafb3d69905e860c7dc
SHA25602bf290223f76e165a28afbeac7a14024b9c804d49ded340ac79aec27aada04a
SHA512a81fc01277d43671def4c87f8866709e4be04ecd9c972f19b7fbc933e342f51f9a062f31ace1996fec3a5f10090db6d545c49c6b215c560ee9533b98175c6e02
-
Filesize
12KB
MD5d2456e005d140265c914800ed03296d8
SHA1ac48e6ae643e9d21723e3011a5f0c60572a26fc6
SHA256c0c8c8fa7541d90b48439a76a313b3ffab0a604fd1bafcaa528222d723975358
SHA512cf0757f57fa1ecc7daf0aa2e6f1ca1d0c06394e9d176d105aa8747e650d0e48b0ac6dc85d03f4f82075a7c891a802e6628a6981537bdeaa3201a43b0d891dfba
-
Filesize
166B
MD5a124ac9f9f82ce9bfa4465e75bfad473
SHA1465ee8d621bdb73b9987dbe479b976e1cef6917b
SHA25697c10ff6f86f63a5fe2097b8592321a600ee8415cd1822e441c0ff138139261e
SHA5122e5205b90c7de76a8ff73163520fc36db7ced0f891209e6f2223ec5419b0a08b0aaf866d9f57ccc7f99a1209d9b94567f840374387282090f54b33f35fe367fa
-
Filesize
280B
MD5204a4e546267adfd2529a9d30b98fa32
SHA1a140e066aca36da0c9b7aceeeb7e5e0c91541c25
SHA256eb5e5aa79c9c0169d80833f249b03fa611438b3319a76ce3a8022dfd467815d2
SHA51241b408d745e29533a572290f5c3ee5740c6362bef1b1c68b1105b62001d876d2dc7ef6392a12d8848e65d6b4cba3d6370f3c3d1c47b8e3c378a135bceba378ff
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5d353a7410aa616b3ae006e83f0a6e71f
SHA16b25651fcbcc697e07b3e55a0c7debc69cbfef3a
SHA2569732e4392f18be58c4ca55c8709aea5a64fac9142dfac8aa295bcb620572a478
SHA512ef6ad0e35d5d9c67eb647c7564826c844a8ccf920b99854eeb071d70f8dfc0feb824c14957f36cf46d0224d01c94a8cae05f632dccd7689ea97758afca10f6b6
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5172283477ecb84414223cdc83b244815
SHA1aaffa49da65fefa7a82abecad35f0e22f2672b7b
SHA256bdc4569916c83e158541ef7c218498dbfce7e5987313cd545d67a7780e26679e
SHA512c1b203c9b8ad52a4b81d28475576422da1fc11c24de877aeb4af49b3f9da2ded3a98d5fee3b5ae7a26548dad222d0a9d6f3d20dc6d22fabd09398e5e2575f870
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD57fdbc2a7f9a9a362432dda588adbe324
SHA133a6640d4e4767f51db1dcd4d566e43d2233db71
SHA256308c1b33512862945a0b4f9031df3ef04930907f68f626a074f53bc51f3b1f63
SHA51285d27f4c570e913e2d8c41cffe53634602f775fbcfef6c9f2a89f0146440e0554a4ee501c4dceedbb3112b122c734ce96d06939cb42fdfe7970d6b74979bff63
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b4c09.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD59595149bbe9efe4c23dd2b5c4cf02e0f
SHA1f2204a17492b86e9fa1c7dd5c413862ac7873280
SHA25650f0cc565927ee7aad6de5b8dd99bae45597b88a39bb70f6eefca0ba526e3a11
SHA512aa0494c12db4b5c303ccbb1097ca8383442a401e16fd0578638e7262abec9eddafef94481c1ec912457038a8a0fa3daca3194348f36500856addc9639cb35a38
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD53a6b42c4c842b0a3e9b55c810bf511bb
SHA142541f342f72778e573b39149b94f4d3fb3bc3a2
SHA256733bf388226c913a7d1d10e52541055a8902c9c4874a3cadf8c0ff2cf6d40612
SHA51292c6a7668fcb6280cbb552464030c9ad64f8adf9515e0fb4197d501b7d6837e78c704243656898b9d89b999b2a8a1a3f39b98afc2ecb0084015f7936125989a7
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5b30a2.TMP
Filesize1KB
MD5b6a0fa993d17b755e95eff17bdaf8ca2
SHA1f22b9dba57a08e0a5395771a55dc1946969ed208
SHA2567fed19b58f464d56e1b3e5af59c586ce718b41acbe4557a6432812bd48485d23
SHA512a2ee9d7942393ce5bdf8af48fd8682c14159e3a812093c8db81858314c919336f790a5c4a9d4210ea8f06fba1dabfa54823bb9d30eb6073004456e71e35ff733
-
Filesize
6KB
MD5b682cc1e8c09868dd451c419d611b9d3
SHA164e58d0c534ee3e1803e5bc03b0b8ad590745567
SHA2562024a26c5cc833ca9df154086dd183c87f19853b6e9ce8330239d8b044e008df
SHA5122432160eb3cca95d53de64a739749eca011bcdd4acb82f32fe2948b306deafc671f64dce50e235fe237daad54156ee3a5f7bc66b238e30f109c663eb06ff4bc7
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe5b4bfa.TMP
Filesize6KB
MD592ad77c03f6314310cd23dc4187f0aa3
SHA1e317d277efe26c2dd4f1cfb95f2379f16081d2e7
SHA256ca37b717a089a76f165420b4636cfd5e8d48989bce681af83eea7828af77c191
SHA51294147433b7e64a3e97e1cbc870fd979bbcc0b299aba3ff3f694a7446e9c4cb4e01388c9d33288cabe13fa409852115df84e118c95de93748aae5023bc2cd564b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
2KB
MD5dcc6942223b30cc077edd2b874888cb9
SHA13bfa935caa16f9280310412265e1cec745eb45b5
SHA256cd35e80645d077177e20c1cd910d15d2eba77bab220f056afeb476423341accd
SHA51249f8e14e8764d5e5e3158a97effb2f6480ec00c85153d1ad3f38365e2049ce5e3c0edeb9f805e24d926ee761b95e46b58954a500269017effa11dda71034d992
-
Filesize
3KB
MD5370a352ca4d5d0d9c65be9c38e1328c7
SHA1e485069af11e547ec6d4d6038f4d92f972e8baa7
SHA256678385ba3fd1f027abf12bb1e4797733618c81910a69774b061db63581d7793f
SHA512ca28b11873e2d9751f25d9aaccddab681a043f9fd7b46799f09f3ef986677d10fc8ecdfd8a259c9c105263b7ee6fb04552ad4b95a4cffc0563b542d534e2f83d
-
Filesize
16KB
MD586d243408171a30f2d76c610011eac9a
SHA15c7299f210e1d2482aa91668249c65082e3f8aa7
SHA25619cb58b3f29648b771a7f1e75e1f422e3e14dfc99c5bf08ba7bd5b1ddb2046bd
SHA512670f84576863a046f62ea089720a796a57a94e4848adfddb046b91fe72a85e819222fea536edb9e02a4c7c666f9497ce23ea6262d778cea1b1d376dc04729fac
-
Filesize
17KB
MD59dd3aa1ec88f6366c8068c3bc949b11a
SHA1996d7d5b80d13c66b767afba31680d49bd1555ba
SHA256ff081b80007d0782136baeb9616f8e61435e4ac3fd9a6e91d17a8a993ce678cd
SHA512ddd44b665052821fd1db326ea18cc4a5706ce9d8f902f9e4e45e355d161be8d47d04421de920b4e7d264f0e5f244a3541f5cacecac5c63f9fa4e5e75aec9997a
-
Filesize
1KB
MD5cf64c4aa417373eedccdd1eca67352d9
SHA1d136665816c4167402a24bda3cf298749347fe91
SHA256acce2c6a48dbde5dfb663ab4be127b82860d1cd86672681850013a0360753c27
SHA512f19c906e9f1b16fdaf171eed9dd32efe0c66658ef5ef6363a943317618dfc55647147889df7eeb881b5e07d9881d733ff8326588fdb735d07aac2ea61a595cb6
-
Filesize
91B
MD5e3690a37568ee9fe7f191a17a47e2146
SHA1476c939e0ca065001820946509e36ac2842fb1fa
SHA256b8da756d34febd98745815e7ee643c49dfdf1adeece7fbdeda22487c06472f28
SHA512c7b777cb3616fbe210b58c1e2395ffb378ffb36c2fed3af8c634e7d39667b9b433386d1a284f936a1d4e10e76c7a678e97216fe801cf95a0fc3fb313fc4514a3
-
Filesize
91B
MD538b25c1089062288a7a9a8876138e465
SHA1d7dc1955cdabe9a50ef4f6b345c9012e3efeb56c
SHA256e39aceee4952e730f1a101894520b046ff21156ebc79c0f8e070e87af20fdd29
SHA512198469bc9aa03de2c29b322cee7714a67b1b421a8fb0b6ade7148f54fb5ea0a37f6afe5e80f052f41815174363ca2b2dc8395534c624f0f87d2f7a0e9d773dd5
-
Filesize
91B
MD5808cb55c51b6fc55fa6cdb17892dc876
SHA14487b86a3a42ff05e109800b1827c100390245c0
SHA256eed0725bdeac66a2e53e7daaa033f06c360314d751df70176a0af3f23eb08c7d
SHA5120d2e6534792e7d417a6fa8403f22397f406352a38bfe1019d87e0308d041b3e69d7defae77e2bf6b87adb3b7d59718efea7d5fad340847c681eeb293beb0f24e
-
Filesize
91B
MD5c76ac26f80988d0fcf03874d625b86af
SHA1b04a5e95018f8eca571daa4077e66626b9ba0de6
SHA2563dca66141315cdee30f7604013deab2fcc1dd74af93f9630fb700b7606f531ab
SHA51223ba1357212eb135ad87fcbb81bf73fcf2e189da34f08ca1cccd40d763a856e9ca8ce5514af395caeefca2b0dd3a6fe3b8d43e060c5baf5139fb357fedb90a59
-
Filesize
91B
MD52c65a49f36fbe81aed88d7626a0112e3
SHA1832fc429cd021f288f5ef9531e7dad6c9c6507fc
SHA256eb8f138e67962a5c7db64722b78454da2e3c3d656ec8d72c9bec566f10a942de
SHA5124fe7c7a7e439f6b43bc13af9291994ff913fa65ab1d77f162c97b18ae505b1c46ffb2c9236b7c9010580b095526a58204bf182aa5d476e3d0a006b2ca450d181
-
Filesize
91B
MD5b7c03229a5a8d6586e4532281bf1bcf6
SHA1e2cf4dcb1a5ed9ec90882b05fd92a1cb2d9b7031
SHA2562f68626defe72fe2f0f653e4f329dc40a4da28ec0b6805b7e372df74503490e4
SHA5124b33587bd1e348c0c3c90ab22556c1a1634c9c16a7986d5ca92cf409a6bc9a2d4ef6ff29f1c56fbaeea7ea42b9e6bcac980f3a13869c7321dfa94b3d4c68498b
-
Filesize
91B
MD5e6bf3b994b7bd85aa47c17406d367d2b
SHA1b18be2803acd9576aaa72bb19116b09680f0cbd0
SHA25692638ea5cef2b20242923fd21757df86c8c434ff12243d480250364b8480f2fa
SHA5123e207bfe1b30c981fb533971769a4051c0c87ffbfcabc012606ec939c5b66f2bf59cefeb85c2b903856d6396584b2c96472965c11d90d6a1ac9f59b29cf3d664
-
Filesize
91B
MD53adb865c801399c412bc73840d3d8241
SHA1267f8332eb7486bccd7a6730cfb4f5c2152b11c0
SHA25610fb505b7ce30ce4bf5582248b17dd47f6a39635007bb77dc5d16b963baf9905
SHA512609793331ce25c6667067b3616791f3ece470500f797343178948e4b7af18f275fdde226f542610d957b397651e12191aed58dbb88bc1c59eff4625e550160a5
-
Filesize
5.1MB
MD5911c020a364b10fe1de664c01de4534c
SHA18731aee51722d2e1604864eb8f03abe3e6d35441
SHA256cb84418aa6ff71e927125f05cd74b10cef07b40fe19a17f9ba5c3bd57f2d9591
SHA5127e2c2259dde1fcb1a10a3864b1e24f892fb28d1c0a9a8b1b32d6b512d9f49b031cf6119f55dad008f0b2a5dc87ae606ee0c2918fdc44fc307d56bc933537db7b
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c