Overview

overview

7

Static

static

1

RobloxPlay...er.exe

windows7-x64

7

RobloxPlay...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    1800s
  • max time network
    1185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 09:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerLauncher.exe
  • Size 5.7MB
  • Sample240511-lsfqkaec78
  • SHA256 834bd41f708d1393a528da769b015538b45b279b4af4969e1df54c0c426add3a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 30 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 40 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks whether UAC is enabled
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5cc74c2676f27bbbb59a4a5f7ccba2824380d7cd --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x68c,0x688,0x74c,0x668,0x69c,0x1615b7c,0x1615b8c,0x1615b9c
      2⤵
        PID:1712
      • C:\Users\Admin\AppData\Local\Temp\RBX-9A17EEC7\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-9A17EEC7\RobloxPlayerLauncher.exe"
        2⤵
        • Checks whether UAC is enabled
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\Temp\RBX-9A17EEC7\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-9A17EEC7\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=ce85e2d3116edeac8759c2321c39314dee13b8a2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5d0,0x5d4,0x5d8,0x5a4,0x5b4,0x1866bfc,0x1866c0c,0x1866c1c
          3⤵
          • Executes dropped EXE
          PID:4436
        • C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            4⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4744
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:3788
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2092
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:2596
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:32
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:4328
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDA5MTVDMTktMUYzQi00MUI5LUE3QTgtRUM1RUVBNzk4MDNDfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1QjI5NDg3OC0yQUFDLTRBMzEtQUE0MS01RTYwQUMxNTA4N0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDAyNTc1MzMiIGluc3RhbGxfdGltZV9tcz0iNTE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              5⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3808
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{40915C19-1F3B-41B9-A7A8-EC5EEA79803C}" /silent
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4696
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDA5MTVDMTktMUYzQi00MUI5LUE3QTgtRUM1RUVBNzk4MDNDfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFMERGQjM4Qy0wRjFFLTRCNzctOUZDQy1BRDMyMEJEMDE5NkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDM4Njc1MDEiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2264
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\MicrosoftEdge_X64_124.0.2478.97.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\EDGEMITMP_D5293.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\EDGEMITMP_D5293.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\EDGEMITMP_D5293.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\EDGEMITMP_D5293.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.201 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7283F64E-0D31-4F58-99BE-35D5CB75EB7E}\EDGEMITMP_D5293.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.97 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6a41388c0,0x7ff6a41388cc,0x7ff6a41388d8
            4⤵
            • Executes dropped EXE
            PID:4740
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDA5MTVDMTktMUYzQi00MUI5LUE3QTgtRUM1RUVBNzk4MDNDfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0Qjc1MzcyMS03OERFLTQ4OTgtODlFMy1FMzI0RTI0Q0QwQTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC45NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk1NTc3NzQyOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NTU4Mjc0ODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjUwNDE3NDE5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zMjc5OThlMy00MTM0LTRlYjEtYThlZi0xYTY3N2ZlMGIyNTk_UDE9MTcxNjAyNjYxMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1oJTJieEFVMkdwZ0FPUW0lMmZFY1NmYnQwM2VYVXBRTldOQU14YTRRbHhBcE9zRTcySGN3cGRSN2EzZW1vcGtCVVlrU3VPWWltVno2JTJiRng1JTJiMkFzZEp0VmNRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyODIxMDY0IiB0b3RhbD0iMTcyODIxMDY0IiBkb3dubG9hZF90aW1lX21zPSI2MzA2NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NTA1Njc0MjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjY1MDQ3NDQzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTM4Mjg3NDAzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODQ3IiBkb3dubG9hZF90aW1lX21zPSI2OTQ2OSIgZG93bmxvYWRlZD0iMTcyODIxMDY0IiB0b3RhbD0iMTcyODIxMDY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIyNzMyMCIvPjwvYXBwPjwvcmVxdWVzdD4
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3200
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4592
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F5AF2CD1-A1BF-4A61-8F78-58EAC79335B0}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F5AF2CD1-A1BF-4A61-8F78-58EAC79335B0}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe" /update /sessionid "{B5B45FC4-6F3C-41AD-B952-861DF1565888}"
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Program Files (x86)\Microsoft\Temp\EU1784.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU1784.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{B5B45FC4-6F3C-41AD-B952-861DF1565888}"
          3⤵
          • Sets file execution options in registry
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3488
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3620
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:912
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:3644
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:1188
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2584
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVCNDVGQzQtNkYzQy00MUFELUI5NTItODYxREYxNTY1ODg4fSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RTg0MDZGRDktMjNGNi00QzM0LTgxMzgtNTc4NjY3QjAzREJFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM3IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTQiIGluc3RhbGxkYXRldGltZT0iMTcxNDE2MDA3NiI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNDkyOTc3NzkiLz48L2FwcD48L3JlcXVlc3Q-
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3300
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVCNDVGQzQtNkYzQy00MUFELUI5NTItODYxREYxNTY1ODg4fSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDMTdGODU4MS05REUyLTQwNjktOUUxMC0wOTQ0Q0U2NDQ0RDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7c0c5REo2TTNmWmtQN0NFTFdHbkR4Qyt3YVJhUUV1RUx2TElmWGsvTUF0Yz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2IiBpbnN0YWxsYWdlPSIxNCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE1NjU2NzU3OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTU2NjM3NDQ4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDMzMzE2NzU3NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzFkZjQyMDgzLTE3YTEtNDRiOS05NDVhLTQxNjg3MTE0NjhjMj9QMT0xNzE2MDI2OTMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUd3Q2FRUWxGc2lGeExEaXNPOHpFeGE5R2lmdHFwUFdBSU9QWkNvMFFYV3V1d2Z3aVVsRVB6TGRPT3hvQnZKMndFdXNoYVdLendwaDgzWUIyM25qUTFBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzMzMxODc1MzYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzFkZjQyMDgzLTE3YTEtNDRiOS05NDVhLTQxNjg3MTE0NjhjMj9QMT0xNzE2MDI2OTMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUd3Q2FRUWxGc2lGeExEaXNPOHpFeGE5R2lmdHFwUFdBSU9QWkNvMFFYV3V1d2Z3aVVsRVB6TGRPT3hvQnZKMndFdXNoYVdLendwaDgzWUIyM25qUTFBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYyMjA3MiIgdG90YWw9IjE2MjIwNzIiIGRvd25sb2FkX3RpbWVfbXM9IjIxMzMzOCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDMzMzIwNzQ4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDMzODQyNzU4MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjE1IiByZD0iNjMyNSIgcGluZ19mcmVzaG5lc3M9IntCQUNCNEE1My04NzY0LTQ0MzUtOTg3MC0zMjBCMjU5MDZCMzl9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjE0IiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1ODYxMjg1MjAyNDgxMTAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iMTUiIGFkPSItMSIgcmQ9IjYzMjUiIHBpbmdfZnJlc2huZXNzPSJ7OTlDMzU4RUMtNEQzMC00NTdELTk4NzEtOTEzM0FGOUU4NkI0fSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzMzUiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9InszREE2ODQ1MC01RDMxLTQ2MUUtODg2Ni1FMEExMzdFRkQ0MzZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4136
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:2496
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkIyOTQxODctOUQyQS00QTVDLTk4QUYtNTlGRTU0RkM3NUIwfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RERGMEE5QTktMDFENS00ODY0LTkzMjktRTM1NkZFMkY4N0JEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE0MTM1OTM0IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTg2MzM2NzYwMDAwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMzNDQzMzc1MjkiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3940
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{090AB7BE-0F9C-42DC-A758-B3C7A843E525}\BGAUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{090AB7BE-0F9C-42DC-A758-B3C7A843E525}\BGAUpdate.exe" --edgeupdate-client --system-level
        2⤵
        • Adds Run key to start application
        • Executes dropped EXE
        PID:1412
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkIyOTQxODctOUQyQS00QTVDLTk4QUYtNTlGRTU0RkM3NUIwfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsyQkYyOUEyMS1EOEIyLTQ5MDEtOEVBMy05MjNFMUM3MDRENjF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzM1MzA2NzU4MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMzUzMTE3Njc2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDk0NjM3NDcyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTYwMjc0NTImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SUttTWNnSHFuJTJmNWklMmJoY29nbXJxVnhFMEpiVm5HUlU1RFhBVlBXZkZyYnpmVGc4RVk4UnRmVDFUYWl3MkpWQlBObXJRbXIlMmJkMGJBVzZ1NnhZVkc0NmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDk0NjQ3NDUwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxNjAyNzQ1MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1JS21NY2dIcW4lMmY1aSUyYmhjb2dtcnFWeEUwSmJWbkdSVTVEWEFWUFdmRnJiemZUZzhFWThSdGZUMVRhaXcySlZCUE5tclFtciUyYmQwYkFXNnU2eFlWRzQ2ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIGRvd25sb2FkX3RpbWVfbXM9IjY5Njg2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQwOTQ3Nzc1OTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDEwMDg1NzU5NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MTAzMjk3NTk5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzYxIiBkb3dubG9hZF90aW1lX21zPSI3NDE0NSIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjQxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2904
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\MicrosoftEdge_X64_124.0.2478.80.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\MicrosoftEdge_X64_124.0.2478.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Executes dropped EXE
        PID:4868
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\MicrosoftEdge_X64_124.0.2478.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          3⤵
          • Adds Run key to start application
          • Installs/modifies Browser Helper Object
          • Modifies Installed Components in the registry
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Registers COM server for autorun
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:180
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6f57888c0,0x7ff6f57888cc,0x7ff6f57888d8
            4⤵
            • Executes dropped EXE
            PID:4928
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:1464
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF1AF85F-DF15-45EE-BEAD-0A598228FD74}\EDGEMITMP_3B86F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x204,0x240,0x7ff6f57888c0,0x7ff6f57888cc,0x7ff6f57888d8
              5⤵
              • Executes dropped EXE
              PID:1452
          • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
            4⤵
            • Executes dropped EXE
            PID:2524
            • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6b2d388c0,0x7ff6b2d388cc,0x7ff6b2d388d8
              5⤵
              • Executes dropped EXE
              PID:2416
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzUzQjA2MjItOTZEMC00NkQxLTkzQzktREJCMzY1MDQ4ODYwfSIgdXNlcmlkPSJ7QjZBNkNBMkYtQTdEQy00RDlBLThDN0QtNkM0QjIzMkMxQjE3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4QUUxNzMwQi1ENjk4LTQyMkYtQjFGNi03MTE0M0U2REM2QTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMTQiIGNvaG9ydD0icnJmQDAuMjkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjYzNDAiIHBpbmdfZnJlc2huZXNzPSJ7MTE1ODBDMDctRkI2RC00NDJGLUJCOTctRDZFNENGQkVEQUY1fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEyNC4wLjI0NzguODAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMTQiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1ODYxMjg1MjAyNDgxMTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MTE3ODg3NjY1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MTE3OTQ3NTk4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDMxOTcwNzk0NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzQ0NGFmMzBlLWYyZTctNDBiZC1iNDViLTU4ZDU5ZDAwMDQ0OT9QMT0xNzE2MDI3NTI5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWpuN2RBamZjS3hRaEVxTm1BUVFqbjR1REJzeUpEaCUyZmhLVzNhbVpsYmZJNXZnJTJmRUJCSkJIU1gwc0xWYVBtemZYT1I4SDZXNFZBcHVPZGd4cVpmVnFKUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MzE5NzM3NTMyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy80NDRhZjMwZS1mMmU3LTQwYmQtYjQ1Yi01OGQ1OWQwMDA0NDk_UDE9MTcxNjAyNzUyOSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1qbjdkQWpmY0t4UWhFcU5tQVFRam40dURCc3lKRGglMmZoS1czYW1abGJmSTV2ZyUyZkVCQkpCSFNYMHNMVmFQbXpmWE9SOEg2VzRWQXB1T2RneHFaZlZxSlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI3OTY0NzIiIHRvdGFsPSIxNzI3OTY0NzIiIGRvd25sb2FkX3RpbWVfbXM9IjE4MjE0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MzE5OTI3NTMyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MzM0MjA3NDUwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDc4NzMxNzUxMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM2NSIgZG93bmxvYWRfdGltZV9tcz0iMjAxNzYiIGRvd25sb2FkZWQ9IjE3Mjc5NjQ3MiIgdG90YWw9IjE3Mjc5NjQ3MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDUzMDgiLz48cGluZyBhY3RpdmU9IjAiIHJkPSI2MzQwIiBwaW5nX2ZyZXNobmVzcz0ie0FFRkM4QTQ3LTNFRDYtNDc2RS04QTM2LURGOTg0OEIyM0RFN30iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI0LjAuMjQ3OC45NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MzM1IiBjb2hvcnQ9InJyZkAwLjY4Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MzQwIiBwaW5nX2ZyZXNobmVzcz0ie0QwQ0M0NDUwLTM5NUUtNDU1Ni05RTNBLURFMjcxRTVENkREMH0iLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2800
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:4576
      • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
        "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
        1⤵
          PID:2832
        • C:\Windows\system32\wwahost.exe
          "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:684

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              setup.exe
              • Path C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\Installer\setup.exe
              • Size 6.8MB
              • SHA256 74ab283991de81543bff5786ad8bebd41c243bc00beda305da00c55a60ac2093
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Installer\setup.exe
              • Size 6.8MB
              • SHA256 32c87af491ca80fc5c5594aa995669161b466957d7b444f3c388ece97b730aee
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BGAUpdate.exe
              • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
              • Size 17.2MB
              • SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe
              • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe
              • Size 1.5MB
              • SHA256 503088d22461fee5d7b6b011609d73ffd5869d3ace1dbb0f00f8f3b9d122c514
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              EdgeUpdate.dat
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\EdgeUpdate.dat
              • Size 12KB
              • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeComRegisterShellARM64.exe
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeComRegisterShellARM64.exe
              • Size 179KB
              • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeUpdate.exe
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeUpdate.exe
              • Size 201KB
              • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeUpdateComRegisterShell64.exe
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
              • Size 212KB
              • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeUpdateCore.exe
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\MicrosoftEdgeUpdateCore.exe
              • Size 257KB
              • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              NOTICE.TXT
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\NOTICE.TXT
              • Size 4KB
              • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdate.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdate.dll
              • Size 2.0MB
              • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_af.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_af.dll
              • Size 28KB
              • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_am.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_am.dll
              • Size 24KB
              • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_ar.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_ar.dll
              • Size 26KB
              • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_as.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_as.dll
              • Size 28KB
              • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_az.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_az.dll
              • Size 29KB
              • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_bg.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_bg.dll
              • Size 29KB
              • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_bn-IN.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_bn-IN.dll
              • Size 29KB
              • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_bn.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_bn.dll
              • Size 29KB
              • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_bs.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_bs.dll
              • Size 28KB
              • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_ca-Es-VALENCIA.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
              • Size 29KB
              • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_ca.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_ca.dll
              • Size 30KB
              • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_cs.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_cs.dll
              • Size 28KB
              • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_cy.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_cy.dll
              • Size 28KB
              • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_da.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_da.dll
              • Size 28KB
              • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_de.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_de.dll
              • Size 30KB
              • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_el.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_el.dll
              • Size 30KB
              • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_en-GB.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_en-GB.dll
              • Size 27KB
              • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_en.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_en.dll
              • Size 27KB
              • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_es-419.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_es-419.dll
              • Size 29KB
              • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_es.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_es.dll
              • Size 28KB
              • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_et.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_et.dll
              • Size 28KB
              • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_eu.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_eu.dll
              • Size 28KB
              • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_fa.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_fa.dll
              • Size 27KB
              • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_fi.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_fi.dll
              • Size 28KB
              • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_fil.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_fil.dll
              • Size 29KB
              • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_fr-CA.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_fr-CA.dll
              • Size 30KB
              • SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_fr.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_fr.dll
              • Size 30KB
              • SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msedgeupdateres_ga.dll
              • Path C:\Program Files (x86)\Microsoft\Temp\EUD5DE.tmp\msedgeupdateres_ga.dll
              • Size 28KB
              • SHA256 abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RobloxStudioLauncherBeta.exe
              • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
              • Size 5.7MB
              • SHA256 2bbcf80c909a561a790584f25219afa8e3f4b7f2ed57b4de453185f1f267dfb9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RobloxPlayerInstaller.exe
              • Path C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerInstaller.exe
              • Size 5.3MB
              • SHA256 70be452d5ca4dfaeec5fd02652dc8c4d3c76ac329148c2bbf358ae8c829d4d73
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MicrosoftEdgeWebview2Setup.exe
              • Path C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
              • Size 1.5MB
              • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              settings.dat
              • Path C:\Program Files\MsEdgeCrashpad\settings.dat
              • Size 280B
              • SHA256 8a46afb2f4c9e259be24c92ef0efd61fc91fa4b9a033862ee0a76b2c9e890089
              • MD5 SHA1 SHA512
              Submit Download

              MicrosoftEdgeUpdate.log
              • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
              • Size 108KB
              • SHA256 3da32b522f96e7556f7b7c8f6438e8cb823a08442f2bd40f9a1e69b696802c70
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Size 2KB
              • SHA256 3c8d8eab39e241e6970c971c571a0b5662bdf27d85631dae38c6080d5dad5f24
              • MD5 SHA1 SHA512
              Submit Download

              75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
              • Size 1KB
              • SHA256 14d8119ef4eb2426aa764e01d8a263affe5326d2563deb902cd8388a881d9d0c
              • MD5 SHA1 SHA512
              Submit Download

              B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Size 1KB
              • SHA256 69872c2a3c0bdca24598431943ea06f46d2a28bee615698ae09ba335b1cfa925
              • MD5 SHA1 SHA512
              Submit Download

              B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              • Size 471B
              • SHA256 628f6c4cfa4068326baac2762c497921510ce06269d8b1debb522a019280bd23
              • MD5 SHA1 SHA512
              Submit Download

              B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
              • Size 2KB
              • SHA256 8ad6096ca4a05d921243b50c4eb065302635af5daca79bbbb50c80b3b4ba0cdb
              • MD5 SHA1 SHA512
              Submit Download

              BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
              • Size 1KB
              • SHA256 a435f2602ff66ae54247b64f6d8f85c13be234b1a70b5d4cbf3f4ea9dc1ac293
              • MD5 SHA1 SHA512
              Submit Download

              07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Size 488B
              • SHA256 ff327850a4702d69a384ef1a9f216236a11044f3828362133d7b194e0d0dc30a
              • MD5 SHA1 SHA512
              Submit Download

              07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
              • Size 488B
              • SHA256 30bed53e216ce9e62565fe289ea3ff453be912c7b8e6ab5c28b31f318802c39a
              • MD5 SHA1 SHA512
              Submit Download

              75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
              • Size 434B
              • SHA256 20decd781c72c5219a08959517f851b88a66ec241c74416e7a88d406c83fc980
              • MD5 SHA1 SHA512
              Submit Download

              B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Size 482B
              • SHA256 985c79ca0b78d83c68f08488c6d60dd947dc8f30c568be8f8e317ce516d3d96d
              • MD5 SHA1 SHA512
              Submit Download

              B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
              • Size 482B
              • SHA256 899d27d3713124cdfc80f8921419ba4b5741e6fb6f17f99866fa91b3fcf26908
              • MD5 SHA1 SHA512
              Submit Download

              B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              • Size 400B
              • SHA256 9732880debf6cd605897d5ccf54ef40a2232ed82c2a1e40f7600b7a9cb2d2a96
              • MD5 SHA1 SHA512
              Submit Download

              B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
              • Size 458B
              • SHA256 ada4bd64a9164f52cd711b59a53a1cc47bfbe245c78d5ce4d8a8ee4e0fa81af9
              • MD5 SHA1 SHA512
              Submit Download

              BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
              • Size 432B
              • SHA256 3fa726d7870f16b7eed0dea2a245c2417be7709b1e216b6b47cb9e105b8ac2cb
              • MD5 SHA1 SHA512
              Submit Download

              version-5e534e6db34e447e-rbxBootstrapperPkgManifest[1].txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LT2C7GL0\version-5e534e6db34e447e-rbxBootstrapperPkgManifest[1].txt
              • Size 82B
              • SHA256 30a6410adac9d05d3ab50418433331dfea63c88b842ea2d926c56c8d268b6040
              • MD5 SHA1 SHA512
              Submit Download

              WindowsPlayer[1].json
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TF1TYUIH\WindowsPlayer[1].json
              • Size 119B
              • SHA256 54702e7c60dbd8f81ab48d22509c9029df209ace9ea65eb8b8074e65d02b3e7a
              • MD5 SHA1 SHA512
              Submit Download

              PCClientBootstrapper[1].json
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y19NSK22\PCClientBootstrapper[1].json
              • Size 6KB
              • SHA256 90c4b0b14a47f68e24b87c9b102f0142b2eee737ccd7b8c5a64733d6475647ba
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              version-5e534e6db34e447e-rbxInstallerPkgManifest[1].txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y19NSK22\version-5e534e6db34e447e-rbxInstallerPkgManifest[1].txt
              • Size 83B
              • SHA256 063f061f57a3a2cec6a2f9c73c5ad017ee835dad79015bb969b2a220b31e26d2
              • MD5 SHA1 SHA512
              Submit Download

              BatchIncrement[1].json
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\BatchIncrement[1].json
              • Size 163B
              • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
              • MD5 SHA1 SHA512
              Submit Download

              version-5e534e6db34e447e-rbxPkgManifest[1].txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\version-5e534e6db34e447e-rbxPkgManifest[1].txt
              • Size 1KB
              • SHA256 b15308fc266caf21c4136358ee249e69a529365787133c625ff6bb7cf1d3cc57
              • MD5 SHA1 SHA512
              Submit Download

              ThirdPartyNotice.html.~tmp
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
              • Size 104KB
              • SHA256 003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RobloxPlayerLauncher.exe
              • Path C:\Users\Admin\AppData\Local\Temp\RBX-9A17EEC7\RobloxPlayerLauncher.exe
              • Size 5.7MB
              • SHA256 c626055a1bde4c4a28ded2d8830f8060633cae35b224903ade01c7227d74ff11
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
              • Size 40B
              • SHA256 1c8a65c9bec20b19b718f9d9b19d1ee154d175e255696b47d5766d7936670d35
              • MD5 SHA1 SHA512
              Submit Download

              memory/2832-663-0x000001E3D2870000-0x000001E3D287E000-memory.dmp
              Download

              memory/2832-664-0x000001E3ECD90000-0x000001E3ECD9A000-memory.dmp
              Download

              memory/2832-665-0x000001E3ECDC0000-0x000001E3ECDC8000-memory.dmp
              Download

              memory/2832-666-0x000001E3EE030000-0x000001E3EE279000-memory.dmp
              Download

              memory/3488-601-0x0000000000750000-0x0000000000785000-memory.dmp
              Download

              memory/4744-454-0x0000000000470000-0x00000000004A5000-memory.dmp
              Download

              memory/4744-400-0x0000000072380000-0x0000000072590000-memory.dmp
              Download

              memory/4744-395-0x0000000072380000-0x0000000072590000-memory.dmp
              Download

              memory/4744-394-0x0000000000470000-0x00000000004A5000-memory.dmp
              Download