Resubmissions
13-05-2024 23:20
240513-3bv8csad52 813-05-2024 23:10
240513-25xslshd4t 413-05-2024 23:05
240513-22sdqahc3t 613-05-2024 23:04
240513-22m41ahc2z 413-05-2024 23:04
240513-22f1pahh37 4Analysis
-
max time kernel
1199s -
max time network
1202s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-05-2024 23:20
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Executes dropped EXE 44 IoCs
Processes:
ArcInstaller.exeRobloxPlayerInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.97.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdateSetup_X86_1.3.187.37.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeBGAUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.97.exesetup.exesetup.exesetup.exesetup.exeMicrosoftEdgeUpdate.exepid process 3648 ArcInstaller.exe 4840 RobloxPlayerInstaller.exe 4728 MicrosoftEdgeWebview2Setup.exe 2524 MicrosoftEdgeUpdate.exe 4700 MicrosoftEdgeUpdate.exe 780 MicrosoftEdgeUpdate.exe 4748 MicrosoftEdgeUpdateComRegisterShell64.exe 3868 MicrosoftEdgeUpdateComRegisterShell64.exe 1740 MicrosoftEdgeUpdateComRegisterShell64.exe 5040 MicrosoftEdgeUpdate.exe 1076 MicrosoftEdgeUpdate.exe 5020 MicrosoftEdgeUpdate.exe 3308 MicrosoftEdgeUpdate.exe 5560 MicrosoftEdge_X64_124.0.2478.97.exe 5616 setup.exe 5636 setup.exe 2784 MicrosoftEdgeUpdate.exe 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 6140 MicrosoftEdgeUpdate.exe 2284 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 5100 MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe 4480 MicrosoftEdgeUpdate.exe 1212 MicrosoftEdgeUpdate.exe 3952 MicrosoftEdgeUpdate.exe 4352 MicrosoftEdgeUpdate.exe 5168 MicrosoftEdgeUpdateComRegisterShell64.exe 5764 MicrosoftEdgeUpdateComRegisterShell64.exe 5580 MicrosoftEdgeUpdateComRegisterShell64.exe 6076 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 5256 MicrosoftEdgeUpdate.exe 2380 MicrosoftEdgeUpdate.exe 5508 BGAUpdate.exe 1476 MicrosoftEdgeUpdate.exe 5904 MicrosoftEdgeUpdate.exe 5128 MicrosoftEdge_X64_124.0.2478.97.exe 4416 setup.exe 1740 setup.exe 2132 setup.exe 5952 setup.exe 1708 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 44 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 2524 MicrosoftEdgeUpdate.exe 4700 MicrosoftEdgeUpdate.exe 780 MicrosoftEdgeUpdate.exe 4748 MicrosoftEdgeUpdateComRegisterShell64.exe 780 MicrosoftEdgeUpdate.exe 3868 MicrosoftEdgeUpdateComRegisterShell64.exe 780 MicrosoftEdgeUpdate.exe 1740 MicrosoftEdgeUpdateComRegisterShell64.exe 780 MicrosoftEdgeUpdate.exe 5040 MicrosoftEdgeUpdate.exe 1076 MicrosoftEdgeUpdate.exe 5020 MicrosoftEdgeUpdate.exe 5020 MicrosoftEdgeUpdate.exe 1076 MicrosoftEdgeUpdate.exe 3308 MicrosoftEdgeUpdate.exe 2784 MicrosoftEdgeUpdate.exe 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 6140 MicrosoftEdgeUpdate.exe 2284 MicrosoftEdgeUpdate.exe 2284 MicrosoftEdgeUpdate.exe 6140 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 4480 MicrosoftEdgeUpdate.exe 1212 MicrosoftEdgeUpdate.exe 3952 MicrosoftEdgeUpdate.exe 4352 MicrosoftEdgeUpdate.exe 5168 MicrosoftEdgeUpdateComRegisterShell64.exe 4352 MicrosoftEdgeUpdate.exe 5764 MicrosoftEdgeUpdateComRegisterShell64.exe 4352 MicrosoftEdgeUpdate.exe 5580 MicrosoftEdgeUpdateComRegisterShell64.exe 4352 MicrosoftEdgeUpdate.exe 6076 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 5256 MicrosoftEdgeUpdate.exe 5256 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 2380 MicrosoftEdgeUpdate.exe 1476 MicrosoftEdgeUpdate.exe 5904 MicrosoftEdgeUpdate.exe 5904 MicrosoftEdgeUpdate.exe 1708 MicrosoftEdgeUpdate.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\notification_helper.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\BHO\\ie_to_edge_bho_64.dll" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\notification_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\notification_click_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\EBWebView\\x64\\EmbeddedBrowserWebView.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\notification_click_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BGAUpdate.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "\"C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.EXE\" bgaupmi=4FE1B2EBC2394A62BCD401AACDEA6471" BGAUpdate.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
RobloxPlayerInstaller.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
setup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe -
Checks system information in the registry 2 TTPs 28 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 1 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
Processes:
RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerInstaller.exesetup.exesetup.exeMicrosoftEdgeUpdateSetup_X86_1.3.187.37.exeMicrosoftEdgeUpdate.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\MaterialGenerator\Materials\CorrodedMetal.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioToolbox\AssetConfig\restore.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\SpeakerDark\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\mr.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\fonts\families\RomanAntique.json RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Vehicle\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\msedge_pwa_launcher.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\elevation_service.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.97\Locales\en-GB.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\MenuBar\icon_minimize.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\XboxController\DPadRight.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_3.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\configs\PerformanceConfigs\rofiler.js RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\models\MaterialManager\smooth_sphere.mesh RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AnimationEditor\addEvent_border.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\InGameMenu\GenericController.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\Help\XboxController.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\id.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ManageCollaborators\arrowRight_dark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaApp\icons\ic-more-events.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\9-slice\system-message.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\CompositorDebugger\dot.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\DeveloperFramework\AssetPreview\close_button.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\ga.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AnimationEditor\button_hierarchy_opened.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AvatarToolsShared\RoundedBorderLeft.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\move.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\NetworkPause\no [email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\MenuBarIcons\ReportAbuseTab.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\Radial\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\SpeakerLight\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\9-slice\gr-mask-game-icon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3FD1.tmp\msedgeupdateres_en-GB.dll MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\ka.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\models\MaterialManager\material_model.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AvatarEditorImages\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\CompositorDebugger\play.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\LayeredClothingEditor\WorkspaceIcons\Center Camera to Mannequin.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioSharedUI\default_user.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioSharedUI\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\identity_proxy\win10\identity_helper.Sparse.Dev.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.97\identity_proxy\win11\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\124.0.2478.97\MicrosoftEdge_X64_124.0.2478.97.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\SingleButtonDown.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\DropDown\DropDown.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\Players\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\Settings\Help\GenericController.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.97\Locales\ja.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\TopBar\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ViewSelector\top_hover_zh_cn.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\PlayerList\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\fonts\families\LegacyArimo.json RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\ms.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\vcruntime140.dll setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3FD1.tmp\msedgeupdateres_bn.dll MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\en-GB.pak setup.exe -
Drops file in Windows directory 20 IoCs
Processes:
setup.exesetup.exesetup.exesetup.exesetup.exesetup.exedescription ioc process File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
msedge.exeRobloxPlayerInstaller.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe -
Modifies Control Panel 1 IoCs
Processes:
ArcInstaller.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Colors ArcInstaller.exe -
Processes:
RobloxPlayerInstaller.exesetup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge\WarnOnOpen = "0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge\WarnOnOpen = "0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" setup.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CurVer\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\ = "Microsoft Edge HTML Document" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\EBWebView\\x64\\EmbeddedBrowserWebView.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D3747B6-FED9-4795-BB56-E077C582FB69}\InprocHandler32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe,0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5e534e6db34e447e" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\DefaultIcon setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1D3747B6-FED9-4795-BB56-E077C582FB69}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.97\\notification_click_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\AppUserModelId = "MSEdge" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xml\OpenWithProgIds\MSEdgeHTM setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe -
NTFS ADS 4 IoCs
Processes:
msedge.exemsedge.exemsedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 804957.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\ArcInstaller.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 962669.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdate.exepid process 3752 msedge.exe 3752 msedge.exe 1912 msedge.exe 1912 msedge.exe 4276 identity_helper.exe 4276 identity_helper.exe 1468 msedge.exe 1468 msedge.exe 4696 msedge.exe 2308 msedge.exe 2308 msedge.exe 4780 msedge.exe 4780 msedge.exe 4528 msedge.exe 4528 msedge.exe 4528 msedge.exe 4528 msedge.exe 1104 msedge.exe 1104 msedge.exe 4840 RobloxPlayerInstaller.exe 4840 RobloxPlayerInstaller.exe 2524 MicrosoftEdgeUpdate.exe 2524 MicrosoftEdgeUpdate.exe 2524 MicrosoftEdgeUpdate.exe 2524 MicrosoftEdgeUpdate.exe 2524 MicrosoftEdgeUpdate.exe 2524 MicrosoftEdgeUpdate.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 6140 MicrosoftEdgeUpdate.exe 6140 MicrosoftEdgeUpdate.exe 6140 MicrosoftEdgeUpdate.exe 6140 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2284 MicrosoftEdgeUpdate.exe 2284 MicrosoftEdgeUpdate.exe 1212 MicrosoftEdgeUpdate.exe 1212 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 1828 MicrosoftEdgeUpdate.exe 4416 setup.exe 4416 setup.exe 5904 MicrosoftEdgeUpdate.exe 5904 MicrosoftEdgeUpdate.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
Processes:
msedge.exepid process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
ArcInstaller.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdate.exedescription pid process Token: SeDebugPrivilege 3648 ArcInstaller.exe Token: SeDebugPrivilege 2524 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 2524 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 6140 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 2284 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1212 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1828 MicrosoftEdgeUpdate.exe Token: 33 4416 setup.exe Token: SeIncBasePriorityPrivilege 4416 setup.exe Token: SeDebugPrivilege 4416 setup.exe Token: SeDebugPrivilege 5904 MicrosoftEdgeUpdate.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
msedge.exepid process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ArcInstaller.exeMiniSearchHost.exepid process 3648 ArcInstaller.exe 1816 MiniSearchHost.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 5280 RobloxPlayerBeta.exe 6132 RobloxPlayerBeta.exe 4716 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1912 wrote to memory of 4632 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 4632 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 5056 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 3752 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 3752 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe PID 1912 wrote to memory of 2116 1912 msedge.exe msedge.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf6bc3cb8,0x7ffaf6bc3cc8,0x7ffaf6bc3cd82⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:22⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6560 /prefetch:82⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:12⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6780 /prefetch:82⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Users\Admin\Downloads\ArcInstaller.exe"C:\Users\Admin\Downloads\ArcInstaller.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:12⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6032 /prefetch:82⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7552 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7524 /prefetch:12⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:12⤵PID:4944
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:4728 -
C:\Program Files (x86)\Microsoft\Temp\EUCD49.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUCD49.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4700
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:780 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4748
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3868
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1740
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MURBMEMzMUYtMUI1RS00NkRCLTg2NTctRjAwNzM2RTdEREQ1fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswNzBENzlEOS0xMzkwLTQ2NkQtQTI2Qy02QTE0Mzg5RDFGMzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwOTAzNTEyNjAiIGluc3RhbGxfdGltZV9tcz0iNzk0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5040
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{1DA0C31F-1B5E-46DB-8657-F00736E7DDD5}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:5280
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:2768
-
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:mrRNcY4SKWImej0yxMw7JASU5hwI5noUCBt4_6Z5VJ0DPE_Kysb314Ozs7mr5ETgRP6eEYiS0Q0TtWqyLHfICDWWqbjj9JhEF1vvJXP2-DyxC0Hf2y0-IbShGNXkcQHFkLMB5F1SMLvReg1gzPUVDzSEZFNwbALS0LOBMV-W7BZGE71RiPRMvaOLRvjmNdQH7X5dtcl0zHtGcD8zu68psQCiHXYgw0wJsSRvObfTmBE+launchtime:1715642732729+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1715642470377009%26placeId%3D155615604%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D78dd3eaf-3ca0-47c5-a254-0e708ecbeaa8%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1715642470377009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:12⤵PID:240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,493596743380584977,4603798361375222800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1096
-
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:V1wkcT9REHfXZkhCM1XAxGsHqQXB13-i8okrYolSY5lxHGH28_M0eqxhSEcbVeXjCaLQi2OgDpax6uG4DKDsxPWRngmQXkMSvYWzCP5FnSUv2_48-RvIvO2N0ILD2K6cpVf-wKsowijOpSPCEZ8n7nOok4ozNFcrk0z3m9yq0J8oZ0W6XKl0A__bL6ofgp8yZUrZA0kkI07mvJane2HUVyQVdKSpIC867vwEaM7SgXw+launchtime:1715642769056+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1715642470377009%26placeId%3D14828781439%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dd68368ac-7db7-4412-b748-526615691ccc%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1715642470377009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4716
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1176
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2196
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4628
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5020 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MURBMEMzMUYtMUI1RS00NkRCLTg2NTctRjAwNzM2RTdEREQ1fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1NTc2NUI5OC05OEQ1LTRCMTgtOEMyRS01MzBCNzUwQzkwNkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbmV4dHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjA5NDE4MTExMCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3308
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\MicrosoftEdge_X64_124.0.2478.97.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:5560 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\EDGEMITMP_9647A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\EDGEMITMP_9647A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5616 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\EDGEMITMP_9647A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\EDGEMITMP_9647A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.201 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{14FA66BD-05E6-4EE9-8833-FFF6F1164C16}\EDGEMITMP_9647A.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.97 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e79a88c0,0x7ff6e79a88cc,0x7ff6e79a88d84⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5636
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MURBMEMzMUYtMUI1RS00NkRCLTg2NTctRjAwNzM2RTdEREQ1fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGQzQ5RTM2Qy1GRUNBLTQxMzQtQUJCQS00ODhBQjI4MUZBNDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTA2MjQxMDM3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjEwNjI3MTA2OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NjExNTA5MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMyNzk5OGUzLTQxMzQtNGViMS1hOGVmLTFhNjc3ZmUwYjI1OT9QMT0xNzE2MjQ3NDIyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU4lMmZLQ3hlU3dRRGEzUGNLRzNrcGxZbm5JV09jajRKVHZSNXpjb1RTJTJmUnZlWXZoZ0xFZVJmb3BXcVZhb1lXSUtBU1M3bjRVUTloUkdOYm9pb2lQeUI0dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjgyMTA2NCIgdG90YWw9IjE3MjgyMTA2NCIgZG93bmxvYWRfdGltZV9tcz0iMjgzMjEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDYxNDIxOTQ0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ3ODUzMTM2OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjk0NTMwMDgyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc1NiIgZG93bmxvYWRfdGltZV9tcz0iMzU1MDkiIGRvd25sb2FkZWQ9IjE3MjgyMTA2NCIgdG90YWw9IjE3MjgyMTA2NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDY2NjkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2784
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1816
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6140
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F341C7A1-4CBF-46C1-BCB9-7674CD072EB9}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F341C7A1-4CBF-46C1-BCB9-7674CD072EB9}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe" /update /sessionid "{402B69D1-AF12-41A0-BF97-15CE1EAB77BF}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5100 -
C:\Program Files (x86)\Microsoft\Temp\EU3FD1.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU3FD1.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{402B69D1-AF12-41A0-BF97-15CE1EAB77BF}"3⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3952
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4352 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5168
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5764
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5580
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDAyQjY5RDEtQUYxMi00MUEwLUJGOTctMTVDRTFFQUI3N0JGfSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MjMzQjlERTUtQkQ2Ny00QjE4LUJGNzgtQTU1RTlCNkIwMUU5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTU2NDI2MTkiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NTgyMjYwMzkiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:6076
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDAyQjY5RDEtQUYxMi00MUEwLUJGOTctMTVDRTFFQUI3N0JGfSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFNkE0NkFERC02MDY3LTQwMzEtOTY5OC02RDM3NUZCQzhGRkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny4zNyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkyMDE4MzkzNTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTIwMTk2OTQyNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY0Mjc1NzUzNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzFkZjQyMDgzLTE3YTEtNDRiOS05NDVhLTQxNjg3MTE0NjhjMj9QMT0xNzE2MjQ3NzMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVFKeFRDdnYlMmY4bWJBJTJiT0xjSlh3VHhTRkZvZUVuZ3FUY3F1TjFJOG51Q1UzM2x2WWY0Nm9aSk5seWolMmJuczdhUVpNQTRWZTlpTWNhU0ZUJTJiT2Fuc3hHMkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NjQyNzU3NTM2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xZGY0MjA4My0xN2ExLTQ0YjktOTQ1YS00MTY4NzExNDY4YzI_UDE9MTcxNjI0NzczMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1RSnhUQ3Z2JTJmOG1iQSUyYk9MY0pYd1R4U0ZGb2VFbmdxVGNxdU4xSThudUNVMzNsdllmNDZvWkpObHlqJTJibnM3YVFaTUE0VmU5aU1jYVNGVCUyYk9hbnN4RzJBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYyMjA3MiIgdG90YWw9IjE2MjIwNzIiIGRvd25sb2FkX3RpbWVfbXM9IjM5NjM0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NDI3NTc1MzYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY0NzkxMzg1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTAuMC44MTguNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjAxMTYwNjg3MTIyMzMwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgdXBkYXRlX2NvdW50PSIxIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MEMwMDNFNjAtRkQ4NS00RjI0LTlGNjMtMjIxODI2NEUxMDQwfSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4480
-
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2864
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5256 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjU5MUYwNjgtN0Y2Qi00MjRFLUEzMUQtOEQ4MjcyODEwNEE2fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTJENEZBOTItQjI4MC00NDUzLUFCOTMtMTc0OTY2RTFDMTY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUiIGluc3RhbGxkYXRldGltZT0iMTcxNTE4MDE2NyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzU5Njc4MDQxMTc3OTYwNSIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMzNjAxMTYxMzM0MDMzNjAyIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjMxMDY3NiIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI2NTgzODIzODYiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2380
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB469A72-757E-4B40-AF15-923E9B111452}\BGAUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB469A72-757E-4B40-AF15-923E9B111452}\BGAUpdate.exe" --edgeupdate-client --system-level2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5508
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjU5MUYwNjgtN0Y2Qi00MjRFLUEzMUQtOEQ4MjcyODEwNEE2fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBMEU2RjVFMC04MzIxLTQyNzktQjg2Ri05QUZENUE5QUFEMzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9InsxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDB9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIyLjAuMC4zNCIgbGFuZz0iIiBicmFuZD0iRVVGSSIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNjY2ODE5NjE0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI2NjY5NzU5NzkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMxNTA3MjYzMjMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxNjI0ODA3OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1LSTFkTW5RZTY3U08lMmJSZjRic0M0UEh2NGFEYWdOZzdib056RzJQeVRRV3RDY1glMmJpY1hySFViak1XSExKbzdQYlV1dHdhQmtwNjY3YldOeDNTOHdacFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMTUwODgyMzcxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxNjI0ODA3OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1LSTFkTW5RZTY3U08lMmJSZjRic0M0UEh2NGFEYWdOZzdib056RzJQeVRRV3RDY1glMmJpY1hySFViak1XSExKbzdQYlV1dHdhQmtwNjY3YldOeDNTOHdacFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBkb3dubG9hZF90aW1lX21zPSI0MzkwNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMTUwODgyMzcxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMxNTc2MDA5MjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzE2MDg4MjEzOCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjI5NyIgZG93bmxvYWRfdGltZV9tcz0iNDgzNDQiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjMyOCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1476
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5904 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\MicrosoftEdge_X64_124.0.2478.97.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
PID:5128 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4416 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.201 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.97 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff687de88c0,0x7ff687de88cc,0x7ff687de88d84⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1740
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2132 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.201 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.97 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff687de88c0,0x7ff687de88cc,0x7ff687de88d85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5952
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEExODY4NEUtNERCNS00ODg3LTlBMjAtMTQ2MTc5REU4ODQ3fSIgdXNlcmlkPSJ7NzNCMEFENDctNTA0Ri00NjFCLUI2M0ItMzhENkNDRjhDNjAyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDQjk2RDA4MS01Njc3LTRFRDUtOTNENy05RDY3QjVCODZEM0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtENmp4UGVVbUtmaDh5dHk2RjA3WXhNMWVaREgvVFY2RlFUMmZmRGlaeXd3PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTg3LjM3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0tdGFyZ2V0X2RldjtQcm9kdWN0c1RvUmVnaXN0ZXI9JTdCMUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwJTdEIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjU3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MzQyIiBwaW5nX2ZyZXNobmVzcz0iezdFRDEzNDM4LTlCRDQtNEUxMi04RUQxLTRBRDkxQkNBOTU0OH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTAuMC44MTguNjYiIG5leHR2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM2MDExNjA2ODcxMjIzMzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjMzMjI1OTE4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjMzMzgyMjkxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjYyMTMyMjg3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjc2OTc2MTQwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDAzMDI1NzM2NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM1OSIgZG93bmxvYWRlZD0iMTcyODIxMDY0IiB0b3RhbD0iMTcyODIxMDY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSIzNTMyOCIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjYzNDIiIHBpbmdfZnJlc2huZXNzPSJ7N0Q0QkNCQTgtMTBCNi00RDQ1LTkxRDktNUZENUFGQzg4NjgyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgY29ob3J0PSJycmZAMC45NSIgdXBkYXRlX2NvdW50PSIxIj48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MzQyIiBwaW5nX2ZyZXNobmVzcz0iezcyOTI3ODBCLTQxMEMtNDczMy05NDY2LTk2OUU0NUZGNDA0N30iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD57171f56da52529073c2bda6dad0fdcfa
SHA1f29fb1d1182e46895bb3ccc38e05220087e92e93
SHA25632c87af491ca80fc5c5594aa995669161b466957d7b444f3c388ece97b730aee
SHA5128c81a87f1f77cbed95eff3986d14d7c05b919cdaeabfba0a1335331adadc1e97495332cb6d3969242a9d19f48aa9eb890f22b81f504af615ea5ff64b27c13c73
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
Filesize17.2MB
MD53f208f4e0dacb8661d7659d2a030f36e
SHA107fe69fd12637b63f6ae44e60fdf80e5e3e933ff
SHA256d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
SHA5126c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe
Filesize1.5MB
MD5160e6276e0672426a912797869c7ae17
SHA178ff24e7ba4271f2e00fab0cf6839afcc427f582
SHA256503088d22461fee5d7b6b011609d73ffd5869d3ace1dbb0f00f8f3b9d122c514
SHA51217907c756df5083341f71ec9393a7153f355536306fd991de84f51b3a9cdf510912f150df1cbe981dbf3670bfa99c4cb66d46bc3016755d25da729d01b2e63b4
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E1F9A9F-8094-4497-8CC4-8EF2E8C76B29}\EDGEMITMP_1B4F4.tmp\SETUP.EX_
Filesize2.7MB
MD525c62300f49d234664bdbe594a140716
SHA1ad91227b7e909a2b9aab0831fc5a8b4a51c74976
SHA25652aa5c4f9eebc5dd0e4231a14bb316b081b8bc511cba581785267f77774058d0
SHA512f06501d5cf83d4021f096bdd1529e9cf531cb7c51ef9cc94d5f6d4015945d91c8870dc80dcf21bdd8146dd498a286adbc6430e92007f708ad4c604b55fe5cbf1
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
5.3MB
MD5dc7e9583f280caba7a8cb75d8ec7b369
SHA1431ca19b9248a1cf6c84ed44c2e37f8aca58a83f
SHA2563afc1fa45b6fc41850c9a0450e5ccb8319af17e71e857731d21d61cba8f8e965
SHA51206913f5a573d1b7c6b805b3994dab3df26a9a7b75b98a8485e73d3a5ae6dc892029f186c725644f08e8c66d4ef05c22f1cac30e4418f8b59a019c5df968223d3
-
Filesize
16KB
MD5dd571e741bdc145aaa4d9b412629e507
SHA18a91f25375e69db60ebb2f57de95401ea0a943e8
SHA256b9fbf95fd888c2202b7a8ba1068f2a6e16e722b61bfc969f37126d54c098a8fc
SHA512009445445186def5fd34fe4bc5816ec2f1b785e1f1da5c92566775cb9ebec3ec79008fa794d1c644c3505dce3165a3326a9bef631d9ee15542f8f9aab00a7e1f
-
Filesize
152B
MD50d84d1490aa9f725b68407eab8f0030e
SHA183964574467b7422e160af34ef024d1821d6d1c3
SHA25640c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
SHA512f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
-
Filesize
152B
MD50c705388d79c00418e5c1751159353e3
SHA1aaeafebce5483626ef82813d286511c1f353f861
SHA256697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
SHA512c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
-
Filesize
40KB
MD553453b47b3036df8980f277a05bdde47
SHA13417251d3a31d31a8eb2cad755d8479eed91857d
SHA256729ea5f9827318ce697f626ec67f9da73e4433b665ce685e7eff12076eec1bd9
SHA51211833b9f39047b8d26954a148c2343226feae67940af534086117c3ef00b7a27842fadb3675b359a9c946996480ef0d3e9d9ec0e7265ddbcb8e250239c7e9b2d
-
Filesize
86KB
MD51d7a4fdb1df479197cdc5b0987342dbd
SHA1fdde73b5cdeca0abea3cc29f569ac95a197e373e
SHA256418b9ca3aa99e9ad13c67a122ff0b67a2ca9c476aebdc03f02a4339c86224ecf
SHA512a6ce598fa034a2d0913330bd155135fc179eb6839326c01ee6b035e1b5445e089a3d732e474e684de44aeda0f84d2177b1c74deebf1af54a69858fd2480085b2
-
Filesize
29KB
MD5df4a669f8615d8417bafc7304e8f80c0
SHA1b8be2d7d54b2e68db3c4e8b2d23123d23eae61ae
SHA256c73c9a45a8a58af082f0a6ecbad0a5adeca0b15547f061e1787105bf58de804b
SHA512b678b0db90f3b3a451a675c26ff45feb805fcdb3da555813a9759ff32d5354ec874d64ef9acbe92c8be72ee343c4909c0ee9899ce322b01dbd45f38400a85305
-
Filesize
85KB
MD544ffe3861405207e1cc3bf2b067f36d0
SHA1f1446050852c1acb3c32f98259f1c61825a6122e
SHA256eebe04c4f1bf1ec10f33ca23404dc61661cabd8c538281ea40c24fb3438e2b76
SHA512927c2a9030d3fb01a5a3986bf608a28ac720333eee7a3f86874229c6a8796982305536c22db4e84d605f4a9a417b0460af9aeacab263daadc9175bf89de7d9a4
-
Filesize
22KB
MD5d96bc8cfcc751bb4d7c1c4fc79fa7ae8
SHA1ab1728612b94c8c8910a863fd7017b42e9ec2501
SHA256bc13472aed9cdf363e21fa5110934b068abf640f9dbb38287a75bc73fec6f561
SHA512e3f1720eaa3d53d28edf1baa34099c22a6cd8c20cb1b039cfa6e2c32926b0bc06265784f88fe5433aeb3422be1c3a57ed91cbec7ce22661b0af3ae14ed371c18
-
Filesize
38KB
MD5c27e74d2b8c6cc9e5ac8192fc7f63fc9
SHA1283a24c413473daa05c9c57431bbe77badaea9dd
SHA25617cfe56be75e928286fd256c3b267b8b444073204b8f375e9ef976050bf7c24a
SHA512c638295585b14881efdb65487f6f8c92e44f74ef43023c803bf171be7990413100ec1c95157f173ed5df29ec6c69e06824e645147b854907e1497df32dd39cec
-
Filesize
20KB
MD56213909d66ef03d2b3da0fed315d107b
SHA12a765b94822a614d7aeb55c59dd5da5eed88d3bc
SHA2561ede76eefb26a5329ee01e1b65bd5fea3988adbdc4d3592ffb0c4f16dca78856
SHA512b1586913052fda794028ff9bd68670c81dc34ec49f178f615f7c50fa101fc8566e635e91a182c82a07a099266dbd25aa55ab0800c2a9e58b3524a17698589f9b
-
Filesize
16KB
MD52ef50f9358d65b7fe8d78c6bd6fba2d0
SHA13b9bc9e9a9f43d84409081aa01229975461546ad
SHA2567d42b8fb16b33c0a0b032cff8a9e2a9670b18b7854e942409b4cb31748699b28
SHA512f16c9b8a35a58b031443e62acd39a8da87729c355512314b23565a1557d7d8d5180c660142f099bde9301d7e2e3e0f42dce89ef2b35b7c5bd3e8783f33106799
-
Filesize
33KB
MD536829389329d312e93efeb44202cffeb
SHA1e9397d88cfcb37ff98f70411d4fea014ed5752c6
SHA25641ba474dd5ca431aa289f8f46af8c071225f0cbac21779a125da0e6dd2052e51
SHA512133bad21c3092c26d4fcee15b9725520fd2d85cd6d18a0493e9e6534630a4cd748d8e08aaf9a1f1810217a7cc9d568429ebed9876c836548ad1b78d794e920dc
-
Filesize
45KB
MD5a96bcb51b7cc92cc9830e41c9d08a0cc
SHA19ee1395eb9c1ec070fcad18964b0d03258fe8a18
SHA25616f37a56e68a4d2a721bbb5fb10d4c76897b413b6addda576dcf2e0f5afec4c1
SHA5122f8b8d797221d669bce1b993da3378e923c388c24473725949d99ceb1a690dcadf0b5dbd3a26aab23b173b5a33d85663fc65b0a082fe834c0012f3d22de82d07
-
Filesize
21KB
MD5280dca08efdee68f40a89256d6f9f25d
SHA1f5291c5fea73d429f08656f543cd6c563df48053
SHA256cdea009110a6c67df98dd8244f7e238e47508e77642f4369a246a9d0724109a8
SHA512c0f2b45e1aff0295b6e73d3c39957aaf1e3d6dfc076b5457612f027f538d6f7be85aad1facca20716704ef94f33cc7c60caaecb42fea1a20b956a26c88af1584
-
Filesize
23KB
MD545c53679bb27a14ba029ba06afc67bb2
SHA1d40021823bfda741bcfbd12fe0a7e39fceefe2a4
SHA256c1a5721987ded448bf8c324b2cf1f32a4722b033f74555c9c8c6c0842879d270
SHA51213af5753122e38c0155526d173bcb8a07fc626c968ac7885930cc17a60c9428692bf7814b710f44096a7dd3393bdfca4617a7a18377a5e7b347901f892742903
-
Filesize
147KB
MD596d4c2a091f928b6c89dda2c20b23b06
SHA1dd9bb59bda71880c23617c7558e5a573e1a00ca1
SHA256e8dca96a79ced400aec88c7e242212d183bc3a97218099e348d1076fc6683e46
SHA5122a20efdb60bed2adf7ddaf39fbb7393265d5d97743ff6e527bffd47aee776ce1f932e73c198dbcce824d2ea2ea637125ee49ac695158fe4c5a52a99ba97dfd2f
-
Filesize
51KB
MD5588ee33c26fe83cb97ca65e3c66b2e87
SHA1842429b803132c3e7827af42fe4dc7a66e736b37
SHA256bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
SHA5126f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD52f94ecca315e61807cd710818031d97e
SHA18da86e3369316de5ed38513dd3c53d049f8de1c7
SHA256afd03de86944541eda1a7156f9cdcc8388ef059e2812d977db8af11eddd835a3
SHA512867c25dfc0711e3c962f02877b81def44b99ae64b672273eeaa8e5196e2260cfbe66f3699d40b56bee0a3d2db0a8aa3b1020ab13a638e8b5dd4c7df02d7409de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD56b7455d73d7f2336f434b6256856aac5
SHA1ef60e0d6963e1d76a258598ee96a1684a6a2fd2d
SHA256156212863b576f06d4ea6a70add2f1f9d79f62989ac460116e4909025ab5df32
SHA512552cee92310a1cf64cea8dd1c0debaf1691b071f4934880cd395124dfcbadc428ad751ee596879c9a673a672561b8a88ec46fef22eb3686232fca0e8347f1691
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD58e74ec751a095f97363ddb69b3ecc763
SHA1ab859491466dbcf0e4f45eb6b9a6ebab4296cd60
SHA256634a074d67872b101e1d9379e0118993a091d10b630874d2a374fd7c876d1b3b
SHA512b1949617eca122b713d8af91a1bb4ce090467e04f39acc8b674aeaadf36af89619acb3eb2c3976934373d019de6a81800a310b956381cae17a4a6104e3dc404c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5069d8bde01fc424a15bb068c73842cad
SHA113a1007d549a771d352d5e621483cdc2fba1c72c
SHA256ee05ade8a258de33217f0a5bae37665be840097e352497b7a102a8fed1d78220
SHA512d0cc6b048c30b0f5627f0c53acf24ecd14544bfb914ec6a5306e9a74033b8b764ec90aabad67cf903fa956e5ddf29cf14b8dfe4d0d799fb49b60e3438ea58a1a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Filesize1KB
MD5788dc0737a059d41dd886a69ce3137fc
SHA10e24066ae4d83a5efd2b6be985f9bc2cecad145c
SHA2563ce9edaf11233f8747ff1653d13ebe90c35cf862b1692ed7af95155ac176733c
SHA512c018b395d60d9af4da7ec513c3814e87e5440b58f2f3ccc0e8845052283a869bf65024bd54acee0de750fa00d83d29fcc66171c6f22e7e2b07152d32916588d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize751B
MD573da320539ee4ea7fdbd90f7b3acdf1e
SHA172208357e4b1d3c1af16377d8243477737eb65b4
SHA256125600837ccd29c18fd38e76e96ff6115c7afe2d89142e2286dfce2902cc8bfc
SHA5128ad50ec2965598675dac2ac120ef57de2cfba9363b58a7197e5a2470981c63e66980f1119c63524c8e33addeec1c76d055115b2927e5ff2b8d8f7193f8b2e7d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize748B
MD5b27919ad132fabe4dfb304c45ef9f8c3
SHA1169cc0ba616963e67890a12b04a2507fa6058538
SHA256b4863199aca5668ee25dfb23f670dd161beef4f69e14dbacb0d75db2cbc18bb0
SHA5120736ed76ffe8e41fd9ebd42888c9bcb0e9deec72d774f6b19287dc815e3521622ba6767e33cc27e409d9bb12c6020e76031f6843cb3f2a45f7856fa781ba4e79
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize755B
MD55d6ad052c3415a8fc268d1cbd98e67df
SHA1d622d46dcb39e02aa4405203e70709f03694bc5b
SHA256e7ecc0d0bfdad41d2b1fec05fa2ac116aaf27dea5b083cbce1429f02898b79b6
SHA512063424523a0117a81993d618f9e39086798b1f37fe6461a0246160e2cfcc0c52320d66a2b85f55b325eb83ff6e3115693508361e170a1059a5c482df428633fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5bcb3c.TMP
Filesize611B
MD5e5268d60cbd4692e1d74d17c5800b568
SHA15b86c9bf4e8016c33bcff0e616323cf9d5a85aa8
SHA25676abdc3750e930f7fb1cc071bddaf314e23308e42e1aa02f389e4e12744b60bd
SHA5125577389d18bb5ec8a5e3994732e6082bb134fa6f3ea1ae04444155953ebfb5a7db128d0b2ad23a6544d2a62f254895c341618c1bd35f2a6f9ba0d88bf71be4aa
-
Filesize
2KB
MD545ed51375ba6ac13b95fb7891bcce106
SHA1ff53ebb026b1c3b7ee1883fce1066969adc7151a
SHA25626c5935767598362768f28170a9f1470dc88a5c4fdaea0a714a05f7f715b5987
SHA512c6b4bb0eb964954a6e3a366f3ac92d3d25fd2a40442a85efdefb61454f75fdcf60adee32c175c69e942e6fee64b408365732484229ec0939877e6d8adce60d19
-
Filesize
9KB
MD5e0d500e11574b484be1a90c437c60ff2
SHA1c52b5d21c4107d79424560bf7f4dac229e35477a
SHA256cd5ed4b5572def1fea7ca21c3f49e4347984d5f6c5328c498b5ccd14949a8dd4
SHA512294fe9ec37f841ddd38590e953a00fa748d000d702113103de78ae426924617146af0e113294a94d9485ffa3db0961422a6ce67ccad8f73315653eb07d7b8682
-
Filesize
10KB
MD5bdac6140aa9cedfdf6242c84d9cf6d61
SHA1eca8a04c57ba6e1abab8b125cbb044da23f02cba
SHA2561a10b9aa881fbfb1c0d32d89ca43bf971b08b1d60cb3f32c028d24416ac9b45a
SHA5124c59b7189e2f1a7261c03d742d43551abade3c1b3e05b7aa2ff67b2b0ffa4ffc54de5c88d415fb00fff38ade74a3f4ab319633f387afc1d51ca16f6101959711
-
Filesize
7KB
MD504327bccb97aae72da0918afac3fdd89
SHA1cdb307e18cf7792e8979d4599c3b7dbc8e4ca0b8
SHA2565500e027a484341cabd8f36a1e593634757063af735e2f812358ca79f4e5bf96
SHA512b678b5be039a0efcf04557b803116e46d56db2002b7e8808bca9a7e912afa9e418e859d92bfc985eadcba8a70627b5bafa2e9b84467f4c60c6dca3a7f12191e3
-
Filesize
7KB
MD552bc2aab730f8424e99536cc68838968
SHA1233ae9ed4301dc1517f758197af05091dddf74dc
SHA256aeec5838424b8831b09cc21babac15977e13fbe9633df248b175b45ef5f2fa83
SHA51239d0d49986311712ec832437961f571433793c03f91bb7ba74eb86830f8e210b2414bb67fcba8c626114d2dd57a6fc5ffd92586e0933d82fad5653bccc9024bf
-
Filesize
7KB
MD5935a088cb89ce12f4656071d4aad7c1b
SHA1c07d1933f58184912826b2f3e09feae82f163515
SHA256635b6a4b819ff01376bd9d021f2e45182ed7229a49618145e0d9182e4e364239
SHA5129f3d93e7e58499f8e2d1bfe994bbe81be3ecabf9864bd0de6918d6bcd452be0f16b31f1ae1ea29820b146fee0f40b0e1bc8fb78773be9cc75f17986ad67f4fc7
-
Filesize
7KB
MD5c5899d4af4a8f3cdc99d8eee1a436b5d
SHA171ef5101efe4ffdebeb1a80342e3bc045534f14e
SHA25633da549d8a60098544b3ee4f35ea6c23bc8428ed697b0350cab61ed752779b22
SHA5128901df97193567d16584e207e1a5588da6ef6eea2457b15aca31430675f2a07f076d07dfdcb7ff231c88a31214c7b829fa76b2c9b623ab5c16cb454f9c5cb56b
-
Filesize
5KB
MD5e137719e07a92c4b017a4253f4811fce
SHA1e40f47cf32674051ab62d72c283dfec2c06269a1
SHA256badb59dff9255a8d6196e36a8057c9a626a1806f1595000cffea48e1e54e6151
SHA5124121b5dc1930f242b9e5be9430bd5bbbe5da6b02d38eb2bf440e9fcf2f83ba47e30b56938375bc802c9de9c701ab5c3177b9c9004195f2453b0be66627127cf7
-
Filesize
6KB
MD5debdd0f865455133e8fdc1fce75ab3fc
SHA1c27111f3d8bd255240be473b093a7f5dd2eadc91
SHA256603016ac511335462279ead9763ac9e241dc3e6576a12a527a52b64206118f81
SHA5126124ea56296e703819e9c8a687c2c60371f8bbecf37203456390818376aff1ef1f89728ffb96a97aaacf1a31e53077491b46a4d142d5f07d589ba9c3f1487f9b
-
Filesize
6KB
MD5bf3862a1e4cff3afc03045c5c6f667c4
SHA11330903245f9e06169ef4357bb7deaa600ca8234
SHA2569c218bf59b5e92aaac7322f3a323b45247c3e138d012df17057984974ddfa955
SHA512b70e51ddc2c35e32824b1624ebf22db449b66aa9e16bca93ff9edfe8659504adb7c9007adedd5982f26781a36cb15bc64183c279a3db2c02120eefced445dafc
-
Filesize
6KB
MD539a6db1200db9f94eacb13e36e3046d1
SHA1ed0e9d13edd683e67dff34f0f2f9e33a2575b147
SHA256b0c9c2701c5926734bd97565b291842bca8faaa9da55b08ffe120c1e4c88a48d
SHA5122c15d33be9900468862a89b33b30f959c44926d154fa574f5ab29e42520c5370202847e3cdf0ba1bee0c101cc8162b5db5057afb1c631a62cf2d38ec420f0f31
-
Filesize
6KB
MD561523426b55378970328561d924a8033
SHA13005a528b959dd7a1b3836b9089d1fcfaf946e2b
SHA256d2f68cbd899245ffb62c29b113250f1bf940ad7e0fdf65996757d4cff97b2b1d
SHA512ef97dd1b37536c02977d024462925f568aa60f77905a095a8df31aae9b39038ca705315e5439a5f2a4caf8b0a579c2b95a3b7150b47a951db3b75f2b99afe679
-
Filesize
6KB
MD5fc69e5261de6b0cd450be06fba0d4e54
SHA1ffe3bd5378b195a7046ddf109b6a0eca326414ca
SHA2564a3acd4e872163a4671ef621e0a87e18dbcecf8cd143860249d1f768e722294a
SHA5129e45c9320088cca556b4d515d607919c5a416562deb8ffdb88a9fe697fd5df45e7006623f0aae570ab04637b4b5bc094af7b58bb90b82bdbe7e2b49129a97e1f
-
Filesize
6KB
MD5bdd8d0db3f00dc8917be571e68b55665
SHA1adb2ca057b6302af4e6807580bc34df37369e61d
SHA256061fc331e9e844d9b2850d150d2c0c7f6daca6fd97fd2f1845ac82518c59dd28
SHA512ea55d97b8c0a830195bff931a0d58dd4a8d48afeaee8209f171dc546813ee87cf9175ce1483fa1b74ac3c3e64e49e240b103bd2fd28ccba7336dc45996d38632
-
Filesize
6KB
MD54ab286e882f468131693f42cc0179374
SHA1398321a69b4333551e03c99169e9f5af213a4816
SHA256b8588d65a61b627c80d50f9c9489e52ac17f6ccbbc08ba84563de2ce5679d4fb
SHA51249e028f57d1b62b9e02af6c45d7e1815bb5c1eec766fa5069e920815628aaaa9d1a9b02371f42d11d36a4df640619d17e161835a9c52f6fc217957af5bde8900
-
Filesize
6KB
MD52e5d59285a242581dfacdc5dea138ba2
SHA11a36e57441b3a13b176010dcc68af65f5f7299c0
SHA256b3c495444037c15b86e34780f07015027f39ce17103035e2351bd225e1effc0a
SHA512cb691e0b1ff94e9ff75ab564842d71549441c05acd7396330a98297dc7045aa1b56f92ee62fd73db8c5148839335f3d4a5b7b886558ad023cc5f334ed565029e
-
Filesize
1KB
MD521613e2086b8e78a2f344378883351e9
SHA129d04f4d5c01a8105b7e5668647c9015c5039c9a
SHA2563ccf814d276d5b1e305f8e4ce10f240e23c9e786cd2335ccd67dcc8856dd270a
SHA512109c11c686d075553ec4234dbb1dcbb05f858437b5b013d918d95852c9f5b0476704d0fd5bb3dba7465c28bd709ff820eb2014c8d8ad150ab5ded4b2f3ead71c
-
Filesize
3KB
MD58401595d33cf3d12a7989f0e7887ea55
SHA106cdad8d72b6620e7496ba222ae2e235b4fb22f8
SHA256e3be5f788ee91e6239eee96271b479ae9e16b202264d2fcc156f7fbb5450bf6a
SHA512c2444c5c14001561477e64acc9bab4c08b0839e165baf3264ff726dd6a1ec82d7ad4969a0105f706c105bd9f3f9793d068505ac2deaa8b167bff85139b435100
-
Filesize
4KB
MD5f73e1ddaabb38b79467f5c8272bfd52f
SHA1f1e5e00a626338e39b4edafc0f15f40320a45653
SHA256e5f5d050f6858098147698b8b3240f9fdf790ec535397a8c9f63465067d8c729
SHA51204f82a0e24dff93baa1c072026fad9bbc7528e3473544d92c7b694e6cd7923ae81f19a42225bb06ab07b5ff65968d94dc7fe0720c2fa0f6adf1d0b75deef1ea8
-
Filesize
4KB
MD52b922d575e79166620ea5410984497f9
SHA18df27c9ca4c81bebff34fe134a0e2e8b151284b7
SHA256933fc7d301465a6236b19dc1993829c8de53c1fd66c4e544c1b95ecde2be9855
SHA512fb8a35caf6ee1b109fd406c43718138579b89b8f17b82ddbf42902f45e7120cee4f8f6739bd5f18a1292ecb0b6937bcd92fff316d4da632f65ae0f82ed073db1
-
Filesize
4KB
MD5b6ce0dd4bfb670d4e0d46da1d47061de
SHA193239936306a968cc0f5a8abd33b09e802f715cd
SHA25645b384e42056df209ad1fb5ec026e7184c305a7ce6d02086c36c2890bbcf1346
SHA512ab51dee355a96f45695c845741f78318b22986a1569b7c9e07058c1732d824f75ac0a71b66caa062e863f241e0d831b42fec1c40f50f62bba2827fe242c805b3
-
Filesize
4KB
MD51317b5c682569389cb61da8fb63726e8
SHA1a0c9856e3c907c9d569ec1b45810747c8bfcec52
SHA25606553651a893b7411749780950e0be30d694bb8000349893b904c31fe3309eaa
SHA5126f276f758a094c3becf22bba800d15f71d0a040a62f768d3dcf8c7960f7efb0f7b337e96e937c03c3342c0cfc240676ccff778ec8f559c99119e8a560b0d44da
-
Filesize
4KB
MD59396e4dc75cbedc07f242c97ae1c99f0
SHA10758f2388fc14490937244a844fc097b4a10f389
SHA256d7e52017c5c0953e19ceafac25bd75d99c083c5937c3fdbb974ffabe7c3b81d8
SHA512655ef87770ffd1900a303db68d314d97fd8aad7fe531473b47d7a2469b6b7b13ffbcc6ffd8342a80a1064510903fd101ef467d394a65ef5ec378c3f4795fbb8d
-
Filesize
4KB
MD503ec6916618af69097b2f7d5966ca9a1
SHA1629934fb901ad192445cb238e0c61b05feee4ea6
SHA256aaadc2e2c3f4b47ea2c98e4ac67bbb644a66370f1888db84f09bc6efac0c43bb
SHA512ec6cc8820a982513d078da08a965bb33c5dabe22458c10373850eb6946359a66c703ca3c9d5a67ce2294a0188d6908434917fdc2f831ddbcc93fd5e918a0df70
-
Filesize
4KB
MD5372196416fcfe144b9bebb52d8944549
SHA1d66e1b6bcc70849c09877a22821978631db0b814
SHA256ea8eb5aa9ed20483f2d194c08c1fa5bf5c800454b899fabcdc4135cbbe216476
SHA512e2880ded1c4cc27e51b283adc4f0e02fd046445b7c151d788490cf80d98612eddd2216314ea44f05c38157f581260f638678c187a8545cc7365938042ee08c23
-
Filesize
4KB
MD527c76e0824573b2c39b9ef2120192610
SHA18fd529eb8c5efbf2386c02720fae6c37bf1f02da
SHA256adf0f3207d4ab688f37b68a7e29cf582fd442aaa0634ea1b4ab8aeb64202a3e5
SHA5122790c4d30bb932879b11510132bfbf16f3395331df933bcaece4be55314653afff7c6f5f2071dc51de289491d8f7236a3990701b48f99b132a5f3169138e34c5
-
Filesize
4KB
MD5d74c6976367460060b7e5670f2871feb
SHA1d41e05d04a30d595a40d6d111ce0ce1615d86481
SHA256d4db6cfa94de6efc5326c8cbe524da823d583f2866104408500a7d32e92cc9ea
SHA51298ccd168537e6b41c841c8f8a0d8eb46459b4c220aa6f6efd8f91fc58340d5090611452755fedd53345fc7798d8d8a0aa05828320a67df8bf0e9847935dd9e2b
-
Filesize
4KB
MD5d2c20ada4541a11d53dc5f0d31adf3b0
SHA1028c3aee4f290869b68755974bb3122b4a9c547a
SHA256391729c5bd25d4d3d295d2dc0345600312961be9e15185e26e5ee1f6b85bd2d5
SHA5120510fb7200ccb931349a003f7a302fe7c0e24397d402fdbd74eaeee85c59288f3759d465f5fa574f6677d8891fb6cfe8825d6d9f731f5fe09d485386941e3d67
-
Filesize
4KB
MD568f47445ecdee626e2b6281b9bc503cc
SHA139824409c5ab6d07b3862bf6aa29415106beb157
SHA2562aa163f636d726be9a6ce2b0e3f37344c51daa568134a1a18b44b6a0f7535012
SHA512f415630ec6aacfa12647884c7e287b918a3e0ae3bb07c447fd3d7527683d56c84d7c3c63ae02a637a3bc03b64d99a775dd894a28d35a232bf6eaab8b31aea4cd
-
Filesize
4KB
MD5869d42b95223e5acbd0476b58bc10ada
SHA16b775e9ea9542774e82a49478a84cca0cc2b808c
SHA256b1936d8e3f9513acd7ea466c434869ecaac32ecbc95459564028f33845c7d36c
SHA512b5695d8f80c4f79004b0e3ffcab4c076d7af21282907349961206db98af4b20705836c4046748b9a17d1710f60a2b93a21d5c2e14c0ffb2d13bab3759bc2f2fd
-
Filesize
4KB
MD5e02d5215100258a4ef3b8386ddf2166f
SHA1a20183906dfd35e1bcd8fe2e6a3777102498d091
SHA256e5f0259f5df3d7c70f000ee9542e65e1bef7cc257692dfd9675193545db1bcd7
SHA512871aa7a7d1750a2c9ce71252c452150a117e3d3ddaab6c9fc8ad9c44dabe8a6b54e892b298dc6da803be53f6277bf897edf3da9b986f1a7505b7955436596cb5
-
Filesize
4KB
MD5a2383810d5b41945b33050ffb685bc3d
SHA192307d1d77b85962af39ebc707f9dd75ec0f4087
SHA2561cc169fe4c2dc06ea56630df27c66f084485cc5c4d90cf874101b70fdeb4b7be
SHA5120ff388b9c5deb39879bbfafc3b74ebb975a746ffd2743c3f1493e1b597206572ea3d5428720d8de60cc2f0e8e84e35d92a06550f235adaf707c52b0893151c42
-
Filesize
4KB
MD5fc2b98b262f1563eaa3ec811173957af
SHA1028151ec2bf808741d0088747befae3cb090320c
SHA2563a8f8c402e0a027d91eb3c646b8ac1d51b7c66d8997562fde21d2d77d10f298f
SHA512b657c4540916f2262fb83ce5787ca60721d460b42a5155c4676326dc7035f484ea563c817473392523f055b18a59971da5c92bba054e8fb76c744bbac1ccb1fd
-
Filesize
4KB
MD50c6a627ebee47aca632fd8f75358da87
SHA142412a0a8d26e4d5b8859079c333187eceb5e755
SHA2569da7c4dc8e0fab8c8429e9f5224b230e51069fbdbc88c69668d838931d397540
SHA5124632f81f31046da9cad996a919bc7e79fe1da975fd1069b98efbea0ef49891dd46686d793b31ff494182b172029eef1eeca51f4d1ed00d4288b659428f91b93e
-
Filesize
4KB
MD55ce0471240ce20be7cdab08ed8a6d5d2
SHA18e23633521688303914a96350f946dc670fcde65
SHA2564779c956fde5c9819cd46930b95ad1fe91995eb632292dd10c5ab3c8b45f880e
SHA5129920163f20c79744501a6551e033df8a9219478a9cc28577aab0157519d20d47b5994c0f310757981ddfd1e13e26e6f4dff6545dee7f71a4460e533c81776c0b
-
Filesize
4KB
MD5bc4fc8378e88cbd44b2f48aa4215197c
SHA1ce8356b73c843a5df4e632a42cc4a4ab2f11bda8
SHA256a8d8ebdcb16caf1e1873a3cf8aa893555b2eb0536fe4d51ac7d6783a0ec6cf86
SHA51216e1da56b00734b98f5de2ff941d36e372c84e9497d7d1427c0565b82a6c23c2f2015c282d19994c875eff9666b10ff7c491a7a99151ea445900e624fbddc4f9
-
Filesize
4KB
MD5b82f5be75387e200b81b2cf94441cbb3
SHA1638905fcae4f820974ce5eb13399854dfe5ec84e
SHA2561e8eaa76f3c09abd381f3029b070ddbaf89568d309b69c691e577cc66057aa39
SHA512a88dc54740def6091bdf6f2d8d319e848aaf0edf120763ddd21f14c16da3a38847aacd44066745b9389692567f9f2cfb01c78f1bb930ac1420bca612e5d604d5
-
Filesize
4KB
MD5d94daf7f9ada3da96ee504c313610450
SHA16a874c4d13b920d05704b18419f0ac4c6b680b42
SHA25673764ade451a0052d9281cdda29a4aae5e8ce71024324b4bda6c03a4de97fd80
SHA5125553ca10b2763961d4e951473e70c1d3475352e54b8b89889d7f83f20d44f96a55157a60acb6a0c8db86e0e4cdad0e5f53d84368b48711d8e240a481abdb5ed3
-
Filesize
4KB
MD52a71a09fbfbdf5c68a1b0d694f5723c4
SHA1cb1f6d07287804360dd4c86e9c15d8591c2230e0
SHA2569735e9bb315545dd347f1ae1547ac1479ae2df739093792c61d8d4e75dd82e6a
SHA5120e71897214493f8ed1540d6fee3e52c131361b94f5009e2dba923702ed0e0e3138c850ed636cbb3deaf7f0360022c5783a7be1663f4826e5d4659affc53af009
-
Filesize
4KB
MD56ce15075c5e4a5e417e23a7556680c83
SHA192dfc392e335e3eaa0cb1a8284ce27f271f004cd
SHA256fe9948d78a7c79f366afa3f10bab4684fe293f9ab962e3ddcb0cc74a8fb2944b
SHA512262af3d796033a1ff2985393a5fa4be8b17e6600d917c5bc2072a8f98a71db34c69df4120a7a056c004f5f2a9b7e7738bedd4402560909cacc149301ab2d3a10
-
Filesize
4KB
MD5a1388bd3451f3b52a1102dc86f087567
SHA17bc1eff2ad3aade7d6a9db7727f2d1b42dd6b118
SHA2565db6c4fd24c9387403b7afca59233bb8eb123ea76c66e77119ed374de7d09532
SHA5121a61ad9cab9b6e61af1de239b8a8540a4cf140008ada75637e5f15cd749b519a5e058777d524797e7997675aa941e139c7847e4d337ed7e357a102ba098da923
-
Filesize
4KB
MD50446e5a06a921b94e630b8213dabc1e2
SHA12c3e8093e649891afcecbd3852eb7d1c0470514d
SHA25649d833f553e115f01959e081db71a49447b37fb658112e4de8bce3b739706b6a
SHA512db96081be7a26cdfe40dc9f62f7017ead4484ab84bdd61b758b2c7a27be79a45e98faa49fa666925e6b7700bad5365cbb43d5179e90afae98e8541ca325a321d
-
Filesize
1KB
MD5961549568f9b68e540a381b05ce383f4
SHA1a98cd901bcc9bca3093312d09be7428a01bf5f6a
SHA256bee855d1648583cf11a1c80429a698e97188256c0fc1f9d21e07f657aa3bf47c
SHA512cd8dc55941818bedc5d61853e38b73684b6bef2eaf899faf938bd3ae89dd2fa0a5976a337e94d809e51a495a77e38bfafb3c388ee3bd85f7a618f564ad6ea189
-
Filesize
4KB
MD574b50d7f57006389ed89b84d2e10a909
SHA199597d36e4a5e9e6efa151e5c6fd518efd1159e4
SHA256decdaf21719a959d50d11fc8c7cc8e33357ea00995734af99438f4b413c7e91a
SHA5126ef5c37f062021e472bdd18181e4c79b55a239342aef45abea99e9ae177c113ac5f845ed9e88051f7cd799cce8dcdc855d4066ac54fc72c75d6ecb7bb140b16f
-
Filesize
4KB
MD5e14228a1873be4eb9230fd7b917e8244
SHA16b1f02e169654d4bd275eac8ea6024c9149232b7
SHA2563d7e1bce8b8b04592b0901ecd9eb70c740f6f7ed4b69a2d4319a46eb7512ee3c
SHA5125124ea8af62af2e13311207c287b9cc9ae189cc6c8e67ca014d39014898f4db7e8a58c7b49d3c1a3898047bf53737ff9f8165bce95baf2ad7be21ab03faab07e
-
Filesize
4KB
MD5a6ee3695b85707ae5ebf567a6f718d63
SHA13440e5c22769ea6dec310a1310b4253c4f7b4794
SHA256ab28799feb543ec57bae77c3d0630d8b7cec9b9eaf510b2803c310327232e3c7
SHA512deb7a1ff573fbcc31b4b310c0d8f057dba77707ea3385e03f2df749d7047dea244c9bb0f135e41ed30ae4609ae8ed36a7e69b03f58a5d7a4a7f73e0d77c61e28
-
Filesize
4KB
MD5d0b311adb25243c377fd92508ac5fc0c
SHA193485a3f972d31ada7af40e43f5d02f5da740ec8
SHA25637aa8c9d91d3784f828f4b7abf32ae1bcc87cbc76af9034a05773ce6d4b41f6d
SHA5129069f70916d2fd4cac79ffdbb6b6c28d65301be61605eb94b81336290125b1d02f992edd8500bac75d0b2b492b8780b65f1baf8ee4624d7afe82f5ddc901554d
-
Filesize
4KB
MD522e0efc9ac9557b7925e4ec208c2ec24
SHA121dcb34b00623c37cd27a69211382a544a3aa7b6
SHA256a17c81693349f27af83f9ca00d412866eafba81483a5ef6e13027d91653d0bb7
SHA512f0c09e75b27aba13fe90fbf57f93d2cdfeddb5ebe2fd52dc86f30fe94f23e91ee9c12f7d55f581fe90271573e9c0ac687d24465bdfaed7ba26413501515ff4fa
-
Filesize
4KB
MD58db8f31d6d103c661bda1d629d40c99c
SHA120cdcb98c5c613cd75ad401ebb1b472fccfc9a11
SHA256763b4e1c317e0a4c97019a8fa467248236a81dd9e4ae9682e7d17ebbb94b8625
SHA5123e865c9ba41ef84f6fa8169d06d6302ff00cf5541da17d31b4ff2f3dcc81a02b0e9fc78003e92ad8ebed605e7031ca6616919e4b9a0c126ca0b1696935641a2d
-
Filesize
1KB
MD572a8fd1b2050318cb07c0694d17c6c47
SHA1446f74e3780201faa483755905e604fccd9e03c1
SHA25638450b2fece544a0423b084664d1a58ea2d60b456eb35e255df60659c96e4bc2
SHA5129c3253e8e227e47d98168e4ca96491be0766c2a962f1d846e77bf2fef93d72c2d09b855c8edfa90ef66c4e4d869d23ad3040783f37e2ec102167941f9f83ee3b
-
Filesize
4KB
MD52faf0692c323145f507227ff1ac83c06
SHA1548a0e44eb2e3a2be322203b8dd478dcb73f0d23
SHA256a862c0bb300d4671bce010fbadc14dcdccec8fe1fd51574adea54540d2a6f946
SHA512de3b15f52bbd90abd83874572da00cf6e34658e29f152bb811331abc858ad5a405e9d20132ecd88ac4f95966a0e38fc315258d91730eb7cead06d9b0955329d5
-
Filesize
4KB
MD547fc903413a44a7dcf7c6111befefae7
SHA12bf490df4c54b34fbffbb3a87314bfda01f026a8
SHA256d7e2d16f05ad9afb34d20d722fe04893779a43a91357857176381841147f0542
SHA512a5cdf5f1cb57c728fb540cb4afd27819ea46cdda9eac91b5aaf707c5bd0226ee38b6899e6fb224b106d088d83786031ae273746a9c4e9ccf9ecf4afc9a419a81
-
Filesize
4KB
MD5f4a4bdc7b503c4e00f9a15a0421b9f80
SHA14608765b0ec20787b7b2808438f4af1a39816aca
SHA256d40bb60872eba93eed1725892c5b3f0e1c12d987f9a2cfd5e0db3044262c8856
SHA512e0ec57203e02c0619b207a5ba37ab36c0e1334d1ae492c44430709cce2960b5bd87bc4e74aa86fc42aedccb2a640cc462b853ca0e498de084ed0999299dd45c4
-
Filesize
4KB
MD59172729cc06c7a68d25e18589f92c9a3
SHA154b4dd1e6b58488d190844fb6a15fbe71bbd1458
SHA256e109c4bd360664d33fbeda4e1bde1ed24b6c16d274689f0a95b4b217602ccb7a
SHA512c1f629e458678a54f67a1e2243298a5978d02c91bb8881f39a32f4b63923b2af9a0cb0c76df643f65f8e540daf6b5f2cd2502034cd33b923e699a70be5247c09
-
Filesize
4KB
MD51e1820dbcca2ac256b735a0f230122e0
SHA10e418ce19fea6c0d17e42edeaec0bfa61251e86d
SHA2568b2b965243035fbe46473cb6969abc04b61d0eb626828c60977effdda8b5a386
SHA512f2544efa5f4eff8594c953d4491bdef2ed52cea215784cc8dc2b9eed66cda5a477a3f312a14f8a888197f377b04a5493c2b4d73d645adca9c39d92b6cc332e9a
-
Filesize
4KB
MD5d3bfc2d6fad92725fc3e5b08d1377d94
SHA1f8d6f86405cf8ebffbf12dcb41daed9ab956d6f5
SHA2565c86528ce7e30b3313f01bc3a31c9f0eeacb2c72c4c904f4451deb17268328ce
SHA51255f95154d30ee0a692fc8295b3a0d4595743d47954685cb7089fec0f0d85d4b6a6ea1475e2df11d8747ca1ee7f9a91ab6461224b0a41d99e5ade68572ba5230c
-
Filesize
4KB
MD5d1db008664b9cb43bde0e7109d309582
SHA18254982dddf076caf631aac37b9483140b78f77b
SHA25691a5b4bd77a3878dba51b7526c6dcc345496ddc79fe19aa473d5879161944d27
SHA512300738e70da602ebd4b488d2f248dff7f5fba2e2a4d3175b2429f40a13474d858483980eb10721a0daee7be71803529fcfa6493c2df473fd08867b596ca93012
-
Filesize
4KB
MD5798c3296ee2b0196d3072636a9b23883
SHA112453ec65a81a17d925a5500bc155d5c54ae1e4f
SHA256d22593005caa73f6a904102accaf991868f6cff2e9d16f6dbc5a9d139eb18bf7
SHA512ab80d2fd2f764ca64fe6d1d6a307c4d17b7670ac104a89e71773cecd55c635a028fac2c992aab9e2910b2936d1960a25fde39d3c6ef7ad9413ca0a613cbf393d
-
Filesize
4KB
MD5883b6c978ce0b867eba4891f676a2c28
SHA1760217d28fc51724a0ab7b3ab8405b081fbc25f7
SHA2568106cf97149b5a165252dd0bfe5f2f259caff6adfee38fba2a10ce140c1fec26
SHA512e5ed88e063c5e72e922f256097d81c45491e2c997261165d43a7ae1afcd07dc7f53c2d8231d54fe92ec878064d57fe1a27fc441ae0d37e5e5957144517582062
-
Filesize
4KB
MD5f7941b66365f7715bc27f4310ac07873
SHA134acbb8e484c3621687f7c6825a624545f69701c
SHA2564c7b177922edb2c6bf957edda0223059477f6a28f76f5ea5053e3d4a64d4b688
SHA512ab7b68ae5f71d5b1c62fbb151aaf1e000ad18c8a671b4e3d90810acb99bfbcc878e8335938d5728661ff80468a545e26f06eeb38de373e5a5f4c816a5bcd3b14
-
Filesize
4KB
MD5e11cd2bb96a829cd4c81e3fe270be150
SHA1d7c6a1bc7be59c0a437ac6f50d311ad3c4402817
SHA256f6eba7104c2cbc08690b7b42b9c8796e8ea0b8ad1585a7a0bce9c52e680db65d
SHA512a1e99a76505187cbc9c00693d0671f638a5513847320884a0e53c4f8bde0d3ea833591120a140e8529ecde18cfbc240ba3346b9c59745dcada83d681dd3184b9
-
Filesize
4KB
MD5067b6cfca6030eb4272db51e04bda30b
SHA168352df274bada68214bd18ca23f70676cf1ccf7
SHA256cb9cc82067dc32281a08ff2d2edb64309f5f905aaf798c8437d96eff28b5fff8
SHA5122ea0ed770e8dc962e25751f4c2ecd4bef4a915d7aa6574d67f30bee143189fa21bb0866cfda4fe9a1cb7e7be7e8db057a20a2f81d32ac99a6505378d89b42660
-
Filesize
4KB
MD5a006a744155d01a9a59cd430a99cac86
SHA1490fc8c892426b6d10b34f4c43d263f5f9a7446e
SHA2564adb7b59e847bffb51efca939d68473de10d97c0acf0fef9f8c3e666b5a4351b
SHA5128e5040a15a78c5f0733f83f55992f68dcbe9e4559e3a12bd8adaba3d3247b10c97edfb49be5a94c5ab422a989b9a98c92fd1bf106d945253945f59720d126acf
-
Filesize
4KB
MD56bd9a3be70456084ec0f115a859434f5
SHA1a226d3538ee0b471e5a3ac570e78fdd2e76b6f2f
SHA25639e936f54dca1b3f00419c8d672ceab47dc391b51620dcaf9e0544033b92229e
SHA512f9894440a288ee6f07e05a671a9aca345c296629403fe9a1e537fab6afa2193af55c02bd0b33e7fbdbce2b766b1e4470cbb2bfb8475fefda4bb1474045f0ae4c
-
Filesize
4KB
MD593f053034f7eb832a1d4af3c33271cd7
SHA1e4a81252c1116f7c968cab81990e1d29fac29afd
SHA256e4175cb29e3198aa1ff9bb33c8f5f64ee1b57e26cd3191f676b32fdeec38b06d
SHA5129c76bb0e124c451cedc6af1910c8e0f5404e63cd4477ace9c43397043342675e3282ec05a73037726d7f119a2c3687e224bf0d91ddb1d472c53a1c28d131acbe
-
Filesize
1KB
MD5431aa97a5351d0b1393c346b4ccb5f88
SHA14e43707b8dc9c21f284a65d40307f053da95c939
SHA2561b175601069da6685173038a36adcb1ed9657389b01255f28c250b4fa8efc130
SHA512880531879c97668f6cfd5f584f2d5c861d6e7303a17c842b82a66e0f030175cc6d8d749e70149ab2e81e16c1449267f6fd034e02a1985b4b0b9c581f8b75d5c5
-
Filesize
4KB
MD5f9cf89571e9e193dd8b4bc44be259d0f
SHA112d06d2c410e38aab65f72b2a00824c473d8fdce
SHA25616068d89f6d9ed9a08451d3fce75e4e3549e035e7e7f9564f9bff0d6410cb7f9
SHA51234558a805ffca645639897c625cfd1fe16b7aa5412c41de103b228e61fae13ec910cd5f6d23078817e30840f3ce9d05f698849449e5b3f6374ee3b7679aedc04
-
Filesize
4KB
MD58a80fa140cad5fdfcb5788e8ee282a7a
SHA16a52f63dc7ab338c774ab174b1dce84e8933a763
SHA256ea1611f08dd66409bdea0ed8408e6ac81c876af253c45d11391aeb647f82d0e2
SHA5124cf06a41c4d0494ea33de16cfd366cd888354d40bbde807c4fc86c336a8d49802cb75a8e2dee99a2c59e62a6da712e4af8265e33698fea2501f2b73a35849142
-
Filesize
4KB
MD56f795a538ff991916225a31d91ff0ce8
SHA1d1dec82b3917ad81899622bfea4fba186d8253b5
SHA256d99861c69ede1f87b1821afb08b6d5078be2cc0b2308f73770af1a786be79a4c
SHA512e0e2a77b4e73c12c35874b46052f1160b3715e79536d9c29a36a9aecade6c51617b1e1f2d7bd97791b442e1de7cc3e564baef2c0b6a9bc4492e9a8bd8d92b1b8
-
Filesize
4KB
MD544c0040acb429a1fd2143e0772b52679
SHA1b45b2225518c629645e596f9c2a4dc82e70717e1
SHA256523262e0b1d85a8d39d0da4282e61c9414e090f9f4d0c8e7b6f951fbf4114773
SHA512715d107bdb14dee879c26031ceca9cc766ddb8a7644dc31c7427a2c05aa4c423fa5ad38bbf4765808874df91fc71b0c1dfa6329b766b9489f8a50e4e80d4076f
-
Filesize
1KB
MD507aca8566bdcccc168d03ead295bd1ee
SHA1cdb5ece42d9e07bef95c464e493ba7fa21737d26
SHA256b7e89d98da0dbed9f7deb608ba59021eacec4563a0959d67f85c1ae143009efe
SHA512e6ba2f5cb3f981a085939784069940262a0a57132409928656e7030fbedee0612f9feaeb0a499126d54d499f9096586d64a30c0405645b33e480ac408200d377
-
Filesize
4KB
MD5b24ef4f53ce73b51f0892593a08caea3
SHA12b3fb8dcc4cf18a40533f4467b500be61ff26693
SHA25623707cd6275b46b1a5bc14ba8a8da270d726ce31c4ab4c1e18738602e0303062
SHA5125748d65388200613344d519be7f5644d944a17c34e9eefbd8300eb6a5078f179e1116fb124dc22f6577cffd78b62e70896ae45cc6c3c770d070571894497af5e
-
Filesize
4KB
MD51d9c3f9979b69326ea2530099d889643
SHA1af546532cce63df2ffa41a9269e5990b62846439
SHA2567dbd65a8e75e1602c2fd28733b7cad79affd2f6ba5a8bfeb212cd395670aff51
SHA512394dbeed06aaddadf52a88b8a5396dbdaa02d4f6bb8910ffb462eb8d4ef1438cab602e936edce75f6d14cdb49bf90432d186562898b18ae4617f7b47c4ab2b6e
-
Filesize
4KB
MD54904f250adf10e265c2995b7c6d23526
SHA1698ff76660d0dfd9715fcfdd1f0447cef9f72bea
SHA25659e3aafa183b5a18bfa8ded3da691ab1f24c9967466c88af618876672a2088eb
SHA5128796925a89b750b48140c71662155bdded1000ccaa6cbb476a677ded544f90d59921f2e8ae7583715d77c7d64b7221f6717bcbfe85b8884bbc3248dd1ef7bc1f
-
Filesize
4KB
MD54233a705f97ef34304b7234831bdf947
SHA1a2eb0f7430e0c99610b7c66436a547dff8b1336c
SHA256b8d9d6a661a0ee9101d665814a6461ef0ce240b62b628afeda0cbbbd98abfe27
SHA51285d7424625970a6716e9b1c3cf70365e7d96cfd1eaf648a669c3720f7fb4b7f51d5af58b013e23605cc3b2b8d3bff94a775b828f65c1a5d2757c86666b683ec6
-
Filesize
4KB
MD524356841aa2c83fb3dbdc94916e80c4f
SHA11d7d8a057b7cdb9b96e3814a189e78460f2ac7f9
SHA256a74c89081f877104afa4464e68266b05019c8c9595b649ffca3613aec6fe6eb2
SHA51277db03383836a4319e7592d701568985297fa3d4d647418b4269bbb507ed094ca30aedd14b94c28761b922654af3aca2f9c47f0eaf4e947fcfb1b3808cc6b753
-
Filesize
4KB
MD579eab7c4662be7d9f81a0c6c11701c2c
SHA14e2d00e353ac1301de3fece2a0e9d78a9642845e
SHA2561f8bd5710240860ecde66c70dabba0ce3e718dfc4ae4f634e583177634e13648
SHA512ac36dfb4ff5e67c3636b873bd07b57c965cbc6df70c038c1afcac521ff9215795d88c25a9318abe507547aff7d331526ee20882161667f2ef361eb3352e2b253
-
Filesize
4KB
MD5f130967c3e39dfc71ca73159510fea2f
SHA1ae5e5a4db572653651121d76e46b9c2df92af771
SHA2561f603ea7b6e19069fbab3db1e753787526d20eb78c829195af8b2d2573d705e3
SHA51265acef52f8e977b09b5e8f0df03231055de33f76148ef4abc5215b8715f91b7a22ff041046513dffa699e98acd731956961ce6a11289fc3379acac6c69fdb574
-
Filesize
4KB
MD57d37c3c1e4cb777826b939db285a9a08
SHA1f24e17658b257ec2146aa6555e49636ac315bbf4
SHA256203e588f74679fe12c48c2f6b42f3cb61ee6fc5333c013a206b30153214325d2
SHA512f970f77edbc0e04d31ced8879e2878d5024a26d0a437b95a440f865e42491904a8f97955ac8bb531abb1a45918032b50b0cbeaaaa88466d64c011db7a95d5131
-
Filesize
4KB
MD51abc888a5e494ce1e8bd06a68d930717
SHA1bbec9256112c552a0ab2356c6fbf6af853c1ace5
SHA256cf9985b4e76ed8dc6e9753b72066b0066f284549c62c43b4cdc940eeb7ff09a4
SHA5129375855a13a85b42a027ac2a2662b440bdb9e2c197b7119d1a1fc8be985be74428e604d8394ce78c368a9a257d7779f1618ff0ae649b30d3e60c9f54ecab0f60
-
Filesize
4KB
MD58244b49e182824978f7e6d3295e11449
SHA15f7d347b6207ee238313e993f21eaafee00c12ce
SHA25670513716445c16a4bac6addc25b1cd09c900a481156d4c2f1b3d2433c68610c1
SHA51216c8a596bc2cf508f589b2d718d3294301638774a5d84d26ebfa810116a0d360e5341edfc7e41b8a8db3664da3935f38128c300e82e758b10ca487d0109e3a60
-
Filesize
4KB
MD544818a9a6d552ced00d5f87fecac42f7
SHA1a12f5d9b35300b3dca55e5f48559fbea2ca5bbcf
SHA256e125af68e941c292d6a457bca99e1e1fdd610816bc597e8835c8f0a5ed089861
SHA5126cafaa6748a1e124adefa8aaf6121f2b86ae9f10312d5aa834e5b435dce01b6290bee073f6dd405d92ade9bcc0740e3853fcb65b61f5c3cd3b81a30855b23da3
-
Filesize
4KB
MD54f55032c3dd5574693315ba22dcc1880
SHA1141a3e7861f7cab1bcf06090fd30ae551cd567ff
SHA2569aee2fb2a734b94b04c4e6fdf9ac7faaca405f43cf92252d1b412121b19b7c2e
SHA512982c7e3ca1d67d72021e5e47ccb0c6d826c346a04fac42bf9ce9d5387094d17c4973ca8278ecb830712d9823c7716159e265b47cbea984cd85a3ffc21003ff5a
-
Filesize
4KB
MD5ff597350923c7808721a02a9cad16260
SHA16cafe6be3a8382f6e5f0eb238e580f217c5dd4f0
SHA256a3fb5b5fd47623aa8c7e2bc3d80917022d3a56795e8a5f7ad1fa237759713a10
SHA5120465a1ffc9690dcd09d18d3ba69756400d75cf94a95d6c30d0c82eaf4cc2ff68b6edba0776845689e825625a35633271a89f4af5b4b2ec542f009f62cc0f97d0
-
Filesize
4KB
MD5eab250e8f7d69bd1e27630d9c305bdea
SHA186a52189822fcbe279a70ea7cf7679551a151a97
SHA256f9e0935386462defcf41f7e7e03e08f06ec38ea41af8071583bd6b3755d1ea74
SHA5124422cfe4ed358b1163b8ca552b922bb243db83e250c12ef50b458379f61276457c4fae4cf48eb32af381847802fcf014471bb83bf304f5b13aea8ac18b02269e
-
Filesize
4KB
MD5599c6de1c8f45d7a0d69a47050f99c5e
SHA1de6d439710259362ccc4071d86c7ead6df5ec227
SHA256f25b7bc5822ad12f384eca5b8ba324f314d3710397d2b9c3ef6e95d5030fd698
SHA512701a83b138f34d6247a3e816ca6910581933b4487ea161366d67d63805b7eb61e90ec31711e87af7da152d3b870fe1bd713d5192ba01ae1d2eddcff0b448da2f
-
Filesize
4KB
MD5a849cebd53d749c7df23de3e347719fc
SHA105f7a0a26b81d5f94da5d709fbba8ded96cd4db7
SHA256dec5405c154757e75d42920edd6b7bebacd9c3c2c46c87789a33fc5fa215a426
SHA51242cfebb945d7d4b0eddfc60b0961d95082ac6feda061cdc166e6054e285122c74637c340b79f7b8174a02dabe32001093f8c2aa254c00b57a26e85c10a2f720c
-
Filesize
4KB
MD55f9b1cd4545eb04e0b6f91eb8a799934
SHA18bb5d6fcc484e17c2362f5362e00c355e77400a2
SHA256468e8754fc891a883bc60dc883e2949b7b18e16048fb99763a3f14258b9b79b8
SHA512ebd1240058b933b4ca16e3b991fd24e6244fab3fa2101d39677b3a826632365cf6fbfacd3b20c8e874cdf0b7cb575263023306e57d3a9390324d2b1d8ff2b314
-
Filesize
4KB
MD582dca09a5ef29d10d85319c1e9072cc1
SHA1f795a082d92a4a1eebc7391780396f5c2f6ea616
SHA256d1560861ec303ea57ec1180ca06fbbb2a041c0c7c0da971491565bbc0a43a643
SHA5123ca237e2ff8d1cbae6184bbe085ad68d12de825452dfde41a6e09aa47162f37cf558bf256075963f84018de0f5e92a8ac17f267a5b4c4d1a4257fd4d107f69a5
-
Filesize
4KB
MD548e5e58960a1ec6edb70a52ac60bffd4
SHA1ca5b1ecf5d47f56083101af3536f5568b9b886b0
SHA256e6a34a94a99e6be32a2578db4420bc2e8021e5b6496cde7b7416f502f3964301
SHA512ad2147e28812670673a29cfd4c207e1993125dc727524af5b814424a66a7b166e227be79287431b6268109261643f8e6e3b3703202d0966954f9474a03a4146b
-
Filesize
4KB
MD546b6534545b3825a8ad8581aa873ecf5
SHA1efe1f0f79690a83828901363d35f756420396a1b
SHA256732a055478e1346e044ca2935b2c6c2a73495b12846733c0c1aff770bc22f983
SHA512872f95d93d9325f6957a9af203641f8e69f454ddf65caf575a57824ff9a82c752f03a24505fbac4ede887480a1cb997f481bd71bd2a18ebacaaf6a8d6e3af538
-
Filesize
4KB
MD598bc1b1617fafdaed7031d96452f9d37
SHA1d7d8503e7841c95a5bc494d7edd3d6bc1e861e8e
SHA2561fca477504587a5cabde5d921778d4d74543f9949a83e0da9ee67e8099bff2a2
SHA512eaa56b2b9a3fe8201832e3f0c60e836bc251c83907c29a4e54b4feb60ef9c39a701bfe27c013f6eb6f15ed8878828222b1446aa60ecef7f5835e3315df2f004a
-
Filesize
4KB
MD591039b971d7678dfa2b44d9bf45a22b5
SHA1c19d5d3a0750d6867f6483d4776dd9662e8ba0cb
SHA256de03e2314ae08bce021dd24ae2020df07f9183c1de95625b5cc22d707866a473
SHA5124957a62c4c4586f5c60c4ab4564bcdbda7a69c791edf4ba89b68afcaaa774fb88319aba0b51f88f7b074345b946dc7987ae8b71e8144dc2557a2688105ebaacf
-
Filesize
4KB
MD574824d7bb200ef11bfbe03256e04a3ab
SHA190aee9f704b513ba691e896944565c8eb9a2b3fb
SHA256b94835c2465e975a8c40276c1f234db22a4133658a3681f7d6a8c9399d8080ec
SHA512a940e06782b2c0b9939fdf152b857b1ae2dc997f4559178f9bd50ea6abe8fa4b1d5db8d4171dcc71602ece0b651bc25aa72bfa031e97f564e44ae778384b75b3
-
Filesize
4KB
MD5e05654395ae01c32b851eee8bdb01c19
SHA124198ea4183476327ab37f978e9954292f9aa283
SHA2560bc63079156e8382dc12e3f66de4d53224caa810924e59c3c490c8b870c178a7
SHA51231f39ee0702b0d879c2235d4cd47fd9d6cec221ec16ac2dda58ece97d389055539d67018c4f795bd02e3ab4c295358eb84977de503d55cee685cf7024dfca285
-
Filesize
4KB
MD57e47cdb0fca531e2da6fe87764abcebb
SHA106f79a71c859aa0fff2316706cdfd35bbaf8b23f
SHA256bf44da2e9fbba6532f19cf53d032521edbcafd9ab70cdfd4ed16b69ecfd4d823
SHA512571218ac68e842f96787600bcf0db0c9dcc3695818c51124a0c1135ab91c1f227798d20f1da26705f9e60003e2ae3744e81927064f9b8e99b196cffc4b0ddbde
-
Filesize
4KB
MD5bb11312b3ed102b05acebb7224400eca
SHA1133b163f520f8c368b0a3d1543723319f2f7d0df
SHA2565a01b91872d647691fda98da804da550122b7a8de8c9511fcd24ae584336073c
SHA5124fa3bd10387bea0d7ef71e5d538d2371e3d8c2fbda59cfed0cf9472034bcccd2180ddf1e7f7ee3b7840baf25fa44c7a386b9652bb3ed939fc5492f7ad2daa9b1
-
Filesize
4KB
MD5983a50763bc33a8f323ae45dc3388758
SHA11474a5f807f85f3541a7e568a456099b040247ab
SHA256aca00c537a91c95b6bcf1eb94211658778dcf2e9254f0ac70617edf819003325
SHA512d8f408541fbb237b2746d0b3da9cb4ede97e3545fa229ab596044001fafc1d7a337c352991e97b607b3c690bdd2db84abc21b27d68a91f6aebfd057ee06fbb1d
-
Filesize
4KB
MD57e5d14f93a70249ac1ca2f9c29fe28ff
SHA1e51642fbc3f4b6df56cf0ff40f4ca2b49775848d
SHA256a0fa46713d0d55b97dddebc236243338a265c02e8a3f8dbb4f7331f4bf687a6f
SHA5129f508a1b7594e42ecf15f182b71cf311389922c553a12af817846717b3f92366e461f78098c8bbb40a13c24263bbf3300e2c3676fa4c9d002ed383fd3882fbfe
-
Filesize
4KB
MD5d8af227d0f5d9d977db505c84b85061d
SHA1d30293ca9bccdbb639cc084bff873038adb37630
SHA2562b237e93529d65d72dca5bd37b0de21d5e02b00dfa4d4a23a16328c8fff926ae
SHA512a7f8056591e5f3b8f1b29dfcd135eb8bfa4a15bb2deeb64ae31e58ee1e45c250c2c12ba9b6362805e0dc1b747a68dad1c3cfeae5aa74f55abd41e2627a39653f
-
Filesize
4KB
MD5fdf87921698c7662077ec593a4e4d779
SHA1664910e6ceb9a2a31f1da19eb54ef9e2e6152dc5
SHA256e77c03f2001fa619bce1a15a5ae588a2cf6ded877f0104ce8749c331b90e6023
SHA5124197e65fcbf3b2565c3acf3cdc92ee44a7848a9fce1f0b59bd05c1ced772ee16646bd1ad12bda5f694c45f958aaf9df8499b194f7d9f3511349db5a714dd5e10
-
Filesize
4KB
MD5f9023d587279a9ea373d890bd76a10e0
SHA14cfe9c74ec26896783d7cd5c7c7cfd49948bb75d
SHA2560640d4ed8fae31f1c26291f0ed0c88aea75b9bacb4f0880aacee59dd42332a1b
SHA51259763ebfd33211bce505a3abce38fff77c62d764dd199f4600403d6a5106ad04133607db1c79f6d052f15504efafa2a00167c582e0879e0031dbeb290c4030c7
-
Filesize
4KB
MD59f54cfe9e705a3d6b51273b22ce5fa34
SHA19ad98eb1f49be561021bbba2e776f2f7514dd0ea
SHA256a44d8ccf170c03a6bfa2cdd7f2aa4dc0d5ff4f357dc8599c6796e581e8a951dc
SHA512737703935e758e4f4c1e445b57ccbcea50719fb708c57649c67b4beac767482b205b2e275dde6cc4b4124472cfd73419dfeee5878f1e62dbbace041aae0b9ba1
-
Filesize
4KB
MD5352d8d46ac23f8ca5c587b3ab169aa68
SHA15a6e84c9ea634ddbaf12d82d8b7b633c130525b5
SHA2565c083e87807cd7090d8b11217aa8003bf2d3721d5875729b796bbf0f70a26f0a
SHA512dec4e95f9eddbe5d9e86425239f43e2ef8e3ef626be4ea0d626056ef0016095d2ec59e5a99c01679adf5f707772685fc4d6fd7dec8b3dd9ce5332315727104ae
-
Filesize
4KB
MD5c90bd55013173d4210e7f1c6f11a824b
SHA1c027a7a9f83540fe3c4e3e6f4360d8392c4373b4
SHA256eb73a488a13ffcffd9fac3d2a22f406f1c77420723992c7469bf0dfa1820b593
SHA512a590a56b999cbf4fafd9ce2c25ed4387baf9969a85dc4283733654eadc85f1ec5000f16264586fb1c13349a2c57bc94f84f00e69c2ad24ff41ebaf14026b8f99
-
Filesize
4KB
MD5c13190099abfd9e9f09f39fff8c10855
SHA1e5f035466c431aba4e63602753a92a1f02b165cf
SHA2567212aa8104e03fcfbe846b7d6571555b27fa821358c1a351fbfed024fc6bfa80
SHA512f4c5a886e774b746241230294d1c051df8376d78c64d38ded996ecd09c188e67b58e66209fbfec2480d5ab91e8e3d2925e6cde96dd85eb11ed291e6518f1fa00
-
Filesize
4KB
MD5eb58f2afc90bd68526889367bc319dc9
SHA192884ffbbe9425c7f069399d9aed2f53294c963f
SHA256cb4efbb521811f7ed047ef0d0d0109d98e770c7fad5cd72c3f008960f78c978b
SHA512fb770a903211d1ead980820dc49aa0729ad73fe78041aeda515669a8248689c42767aef66458b2730f2d6c93deccd6c83de5defa7eac4fb8611196540dbf1b8c
-
Filesize
4KB
MD54c64bf1214084c3abb8ed47016abb7e5
SHA1648ea8053ad70f7fbb622bf3d117928d2a6ff890
SHA25654539253fbc477df29d81d4797d87606bfa8901060f0871a26caf4875dcea8e9
SHA512da748269c3ea72bb45b984858de79d17b22b9e16dd234a2327e662733a5cfcf98f162d2f5d442146f8d180344677fcac52113798b78540f9bd48d566808ac91c
-
Filesize
4KB
MD560f49f27c13c45924e7c14fa966ac41d
SHA175565fefd7ad428d273abf9e839092604da9dc44
SHA256e5a8ec40e46b3b6d8866d18bd9937891494ef6653c9b24bcda4435d8345d4275
SHA5121fc08c3a09981977e2774572cb3796a4b5259c634c82c9d41f7df33b08d773c46f385cb7a5868c9c30a6cd7eac90c4aa9020930addd34db638f20c100a0595d8
-
Filesize
4KB
MD5e4cdc24b9b2468394e98d61a2df93ece
SHA1a5cb25568540e08abcd5ea3b23d04f96eada2a3c
SHA256ebb834aeda24ab716f58243b9eea8490273d43890fe12093288a1b065f4fd6fc
SHA51258d26a336bcc4c8c979e883dd530ead8ea366f9cc26254d17c6dd20e7e4895eba885b3219c675004176e7be046f23b8d65a705dc29ea36259484fd2106043eda
-
Filesize
4KB
MD55aacc1de08747efb6db2fe4e3a2a8b70
SHA1abde3ce86e8374582b9f0c704e28792f3334e8fe
SHA2563624136ecab6f8607e3d880b12967c5302024222ca53661c27c24ccd592a576d
SHA512c0459f6d19c13ffa2762b702c411d6ec4c7585bb3a09be9efa5c2f177a1e99c711446daa52992cf805a527c156396955f9d30f89c192bc4c1f2ecf6c183c0a2b
-
Filesize
4KB
MD59968198e6adb520d2ab48624ef69f762
SHA1d6df20da3aebdad58865c4412387ddfb33b6b6bb
SHA2563b284b00395aa30c226facd2a98d1dab1e089b569e6fe2baa0ea80c7dcea6b5b
SHA5121173047469290b03a9f6e2c7796515241b5b313be95abc22dcb1f6ba7b680b7405891d506598478b047bf0cea2b743fbb1bc216e9d1e11e40f8f9d02b3b27cd7
-
Filesize
4KB
MD59dbf67044db2a9fad01ea2c604400087
SHA1eb49d2e22cb676563182d0725747940ed67e2234
SHA25696334fad63e8af4ebac1c2ffa440c63da59c12cd4fdabd1d6e34fd1d6fdd86ad
SHA512789ec99de597c046ffbdbe9a17103a4b3457c8dda65890ebcfc425469739bead3649352616ed2e3dd98512572bdb8f8aad4a8bd0d9b1b0ab51201322345710b1
-
Filesize
4KB
MD5ca7874b8e834c569c06075dd0c7798d2
SHA1efe8447c6a1f753c3d195cdb83eb2367414f5580
SHA256d72d9bfd62358f7e82f94a6fe738f5dbc608b059f97e09e62dd90aa74a01e8a4
SHA5126a693b17e2a6017206650f34c4fa24f9d1fdec0c8bb66e60b80c5d839ad191f80b22bb0ad3810920ed7ef19acb1e3d8c7bd9c53b573cd537f1ac4a4094cb7a92
-
Filesize
4KB
MD577c9cdeebe777ba56e581e96abb984be
SHA13246f98a1d6de732e49741ca8fe220d1dd8e738f
SHA256176867dd5f1ff14f371d3272d17fdfe8acd781e6849bc19680f60ba5b6b046ab
SHA512bbef1cc8f1c743f4216a13fca9ea3465ca7d7a805124f19353240230180cad064de92fa1141f59059648c78d950966b2065d538298b80892087a2af297a5df02
-
Filesize
1KB
MD5f1b51752f098747458ab4aceb16053f4
SHA16a0effb1556651d3951851b6bbd9cec03d267fc9
SHA256cd9120636be175e59d7f191853d85dcb1dc394b9ad36c6f09ee7551c2bc83680
SHA512bea52f71373c69ff25cd492fe9c9999943369522858b65909d2a17123e4142ab9df3b08b630ecc350b4987b68c9de4c185d5d02e393bca465dcf6751f65ac060
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
12KB
MD56bea83b36bf404e3cc4031150328e6b9
SHA1bc9b6d6be6c099d0c6ede5069ed41dbf380100cf
SHA2563c157b56b31cfd9e191f08a600400e5ec8e84238b7cdd4c4cd2f4f8feb392be9
SHA5122cc6ab15dfaa7217fc327fda28c90a3c8c63f364f4c107c52dee40bf78690e94840f99ef94d27c45df0243ce7676a8bde7541e44f0ccf774ec8569d501638a21
-
Filesize
12KB
MD5e97669951fef661f1c7af830acca9ee5
SHA1399d169b9facf30041404dba4356c7d115f2c221
SHA2566e7a6b2b7041954d522f356d551aa606a61e2ad8ed4c59f5c4d2b2caa6f6700f
SHA512c1af19ddceac55b4dd752502137a0a5532cd49d0960a497858ca999add3c7d8886e19573cedcb561204949f0943c13d47a5442c5909481cc0c8924f241ab2a0f
-
Filesize
12KB
MD588387bf5de2aea56994d9ec82fe3f5c1
SHA19bb87501d5f55ed89a272a3cded1af429e37154a
SHA256e3d7c53bb5144529dcaa826e20ca4a98cf919201236aac20ab26daa818830c2d
SHA5125b976474ce6802a5d6365c39c132d3efdb5ea922ec20b9d57bbd6b9de4900aac8cef5cba8597d81bf038e9c6541106412fb7eeb84e1f6346ee8c454c731c85ea
-
Filesize
12KB
MD5d404452c85ff451b4fcb5c5367e17ce1
SHA18c09f7417e70798c618bd823e94b22b9437433b2
SHA2565854ded9170d26b4391ef7fef7a220ec3ef4bbb879a94a16ad85383c56cbdf31
SHA5120534ff92a9b9b9c8f79aad8c23c4e3d70145961d8a2b5ab44227da13b89fbcad60c4555fe19dae79b6d82178b3b5ce3ea0b2874751da267236d5e2f5d0b86fb2
-
Filesize
12KB
MD5f3ba06b4be55738b4a5306e38c6ed42c
SHA1bf67ee74d69104efac0c71d5d8cd07313441c358
SHA25659e6485596a1b4a75cc863170aad1014664f0153404389a9862cd77e5fa0efe8
SHA51255c587c8393c1e773979c24c2602614e058f8f5ece7216d481eb08f662b3865b87c60cf01e9af419eed2e884baa39a9b49d87e8b2363ff2428ba137ad29ba7e2
-
Filesize
11KB
MD579738736e4518ea69ff6c4969a139572
SHA1f18c7e66e2b6e29d226e1a70d756d2a3d60e8f86
SHA256d87d50b0ec1925d04f3f475342fe96ebcf2e532a89a6e47494226ebf249fb7b3
SHA5121fb0f1226493a1c8d6472362785ef6195577cd933e4e7e9be95c2651fa35046d3a7b33508dbabbee33f1ae2f3e2672ee559e6da5f42b1ec46efc351a3bf725cd
-
Filesize
11KB
MD5c537c8ded08bc39880458bbf3b8fa1b9
SHA12daf5f5722cea763671042733457db5df5a3b11c
SHA256c18fe02f9cd13b7a07fbfa48565909813a7f2d21e8efd84a0169707b6e748105
SHA51214b4127380f9b562bacc2d47a62c0fda23d6db13331d827916f674db90b8b7d1ae4c9f4a391fdd470e7abb243586c96d18d6316901d10b15fa228ffba23ec75a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD53666df2ff733f6b10620b7e074035e80
SHA168f43862b4587320cb1e76adf8b29969a3e5bd99
SHA2565ced85231e0910b3bf4c19effdc71f2706dc64bb62bf64d6e12f89689e9cac3d
SHA512ea9239788113fb460b85c6306b83b2d1b3713b5f919c31fd052bddb12f75e623d33d445924454da6d641d73996f9673ceb4f4c25ca4b5633b12371443f886a9d
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize11KB
MD59546ae2c9fec12a2d8ecb758a1987252
SHA152f0c29958cc896bd41ed7f9be4f2a39b54ff607
SHA256d68da3edd45943c0e83b2978b459941f7b22eac56268ec50f79f78019b981948
SHA5121e0cde2fc9b302bbe77fb9d2d305cf513f5311a2f8a6faf1cc18c6e6eb48a6d09877e9da59550165dd9642ef8bad560053df834921c3e1891c47ba7f1942d34d
-
Filesize
5.7MB
MD584ebaa7c95efeca73a5c0f2deab6a455
SHA1c072da28301354bb4c94f14bb7a70f48552a7f7e
SHA256c626055a1bde4c4a28ded2d8830f8060633cae35b224903ade01c7227d74ff11
SHA512500c7aa69d1b81f23c85f1f5d289958910954937d132179a71b5d0fb17d5bed64a3bc0c2c2bdfbcd739b5a290ae2fc5fe0c7ee2b91597450eddcbf92744edbdc
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
530KB
MD594eb2ac2c0cca7412c1c2e48bb23fca8
SHA1a28552f8084adc918dd409258e09fb5567eb656b
SHA2567901199b673b8cc0d79a2b482358335f938814f08174cbf7e7308f7940f15772
SHA512ede79e666e68f844e8e63292a27c31389bdc5902302ff950f64f5699b1e4caaebb5301a9419274309b5c4bb8b4fa1676205bca0cfc807001408b84a87bb414dc
-
Filesize
572KB
MD52b322930a35ac6c1ef885877fb253ae8
SHA10cf0923170c381c64c08c8d5b0987b5fd0236649
SHA256300de0a0491b498378d42fe644217233b9236390f63ecac70c3348920f84977a
SHA5120e9d7716f813edab8c1ee66f10bb051a147e55b4c92913db1179b829fc35046fa6e6aaf2b5712bb8948901fa100f42ee9619b808bf5f6a353efbaabf3fd763ae
-
Filesize
445KB
MD5fb6a0dc50a36bda5a56ff20314af43ac
SHA1c0225ec4288ac2199e7d1469e9ed037b14dc9c84
SHA25620c3047e0b55d77591c4ca081b9153d318258429f66d425b7b985ba46065a7d7
SHA512feab505a8d111707232f224714f51ab6051397ae402089a0817953dfb60346f305f45e5336f75858ea3b0c4ab8b2b4fe2f04ecb00d669c8561a7a5b7d6cc8746
-
Filesize
487KB
MD54c52c36f5484b61554929d1a077b4a27
SHA1cc158fb27a7315d81d27752e079cdf214ee0f831
SHA256ecc780a4a523c3af9f4e7126abcf7faaa13a968e4ccf33f21063e3d505c2c41e
SHA5121f553c5e63d0c4299e1b6ed17aec7419f80ff05dec878c00d2360d7f359acfd86de8b01822e34f1a678d3470026fe225e6c9de02fdc44990b7aea0a591f34ad0
-
Filesize
381KB
MD5f1b7c188b2456845364e01cadb030dd5
SHA1595eefeb30d6f8b35dcefdeb0f39786b7cc1fa62
SHA2569714f353f6712e60391d9734eb574f5e590c42d56901f7361da23348ca795290
SHA51258b588bf4f5d047d35f745464d58fa79c0b4be2a452bdccc3de793d31fe3ec578b90e7b037d5a2120bcea7817190efdc84d5da058e32d3b1d64d1771fd1a5472
-
Filesize
360KB
MD5738be643ea0e837150cf162acf2bcd19
SHA1f80856932eec684063aadb5e52b8dbd26e5d703c
SHA256b0f2407113129b7ad280020c121e9ad772deb4a39f8dab6ae40ee121b21296b5
SHA51277e4006453660e7784675aadf7d29f46432d7ed21825d3d9d2589f782891c5630bd575871e0f8ff8f833fc1f56eee06d34cf0b23c96b8757d47d787bbdb28477
-
Filesize
763KB
MD54ae6a4e0f9667d9fb72e673083c77e4e
SHA15333c17b277b5dcb24b1a67f76c20f21ba5431cc
SHA2569a54bf858658903f31fe4b2179a62d57a78569022a80cdc2de150f6f95d7020a
SHA5121fe1c11434958297a89774886ed8cd88279db1b0674fb0e1d0523716a3d4375a44e21c200ea68ff9d93a4615758356d968676ed7acb40b0f7a4d8a0762b6aded
-
Filesize
636KB
MD5ec68e1db5fcebddd317613743f1f3b34
SHA15c4b9a06c2b44682edb9d3c0d981b18f5a59a824
SHA256ddfac962b729b4e2b8aa6e2ea5240ff30da2672a421421996811257c65abf0da
SHA5124085f1a0e844c0d6fc7bbc2f70cd5503378cd01c673327cfa94fbfaf74fc1e45f6f1569175c64acefd79885ba77853696e8d00e2888f7b25ce77937beab1fdc0
-
Filesize
508KB
MD5741bafc3c704004132a3688b1cdf265e
SHA11f08b9dcd09ed2b5bb3cea9e508760e1c0c658ae
SHA256fee22bbbe934227dbe231edf8339d3e0b1b55b92bc4d1019355071d9b18069f1
SHA512fd027ece862f6f2c6a8e0231961b20175e9fe14b1534e34298ac5eee05ccf30f4488196c3f874d6543b742378b32f22a6637cbc3d6e5aba46343823dcde3c8b3
-
Filesize
402KB
MD5e3fadc2fbe35af0c921ca035ee39d74c
SHA1b1e9590fa634900902be2c2ba5ab36d3ae9eb65b
SHA256f789b03d5540a19e88062ec746cad31581abd1b495b6576eb7807cd861c96240
SHA512626bcfc7361f48346a2e9e2d5fb10d72eb7feca34e7639d7a2a573fdc884bff789570e950555e76665edaab88f2a3537fc4baea9155745c31b394bd8207b5f04
-
Filesize
466KB
MD55a366e5ff8c01a3b216e40e835caa01d
SHA18ccedf92928211d0b797ba92d9d3c3e99ab50427
SHA256d207c9f5a9d4783382e48659979af6c8d671f8ca5bb1862b784830f77d736a44
SHA512f8b5d35e0fcfea7a536ac9d4ff3c979e8c59f9dbdc819f009592c49be22a4e7aa57a26ab297f6d8794365139405a1f0cf486a2cfc5d4c0c6784eb33a4dabaf64
-
Filesize
721KB
MD5e0e36b6a62b08deb5f901b9def997d1a
SHA1b76c9dc5ac6903168c494a31b5ea999af7be628a
SHA256f063ebee5ef3287366a266d88bc1d6114a184aa232da5b69bb7421e33b1a4097
SHA512bcb8922226d790782c1f173dd95997dfd8c595c951a7502b58135c19ef2e3bcbe76a0ea90847a670dd28b44115f32a7acdab712a1123ef16f5f5cc07b40b8256
-
Filesize
678KB
MD5fc2228e578fc03dde17794eab444ac05
SHA11765e7fbf933d0a2b4432d2216201ec181795f5d
SHA2563674276cca6ed9e15dd4fb8f39974d23ea23acdc413830d0e232b1316d1da8f7
SHA5128c6aa7d3e0efa4f32bba2427389d59639bc7f9c5efb53de0391f64487939b1e6244715dcc0486ae012cec5634256233b7568b299a8ed3b167f967bffff033d0c
-
Filesize
339KB
MD5ec600464820df238081bccbd2304370e
SHA17f89f4a7acaba90018c0b432969884327931f021
SHA256da50112c47da6e6ab79f654458f1bd166d849e02d4d82c0a2f6742f03c319e96
SHA512a94f2399f80366e09ff50bc1f6be74922b9d73a53d65522e113e41e14f8e57e2000313fad13f9cb671430f2243521b7b8307d7f61ceb81aa4372589ae0d5203a
-
Filesize
296KB
MD52f7848d90a8c2961ddbf4ec8fccfa08f
SHA110d5d8de6851535c008a94f6a6eb812f884bb7e8
SHA256dab1859dbcbb90c850f99d2b5ec8069893c8d3ee80e59c46a67c3294028804ae
SHA5128b4d122998e6df3729b6f56982e45adc1e6357b0317a60f806e94480c552855336e8f7a44436cdbf13e13c68a77a40e898fcb8e401a89590fb3e4afaa7542b37
-
Filesize
657KB
MD5063b468ff5ff86954ae2b6b52f64d57c
SHA1ad66397c9bad91ce9f124a5d99fc6b742bd29153
SHA256cf8496c763f26cd0023f9cc6c28d223b1d16ab6c35521bbf6ef94fb28f5b984e
SHA5129a1e47f185f9557661c52a8f20399e72123f9d01f5aabbee36b49ef63fd8e46616e6684e22994af6dbf9bc81563b3538fc6d4b881b6e9f727aa23e08383debc6
-
Filesize
551KB
MD573ee9de566657c93cfe272bda285ad2a
SHA1d2f4cb038981563aea19759f78223330abe18372
SHA256951dab2486f376b6ee0aef681674056bb43de62bb6627dd29a8d5d7b0adef9d8
SHA5126a3e66342918f5655a4c4fa5bd93838e9f61920d4a211795fa850467401f56431141a4eb187ac620b9199f57228ab97445c078d57320862b9fa19db344a8a7bc
-
Filesize
424KB
MD5587b8fe040027379df191a9911a15717
SHA1c513f886d11ba2090451357289db3b819103858f
SHA25618c328b20ea916fa11f9f139d5697cb7b34db7b64d1ec78f72f1aa7ceb927923
SHA512911c6807f2c1f6d06dc0576058b9f5c7b34f50be4d63579284420764681e8e259ea3278d3c35e2e4f1bfae4384eee5cecab8aca0aee60d6309d57b20765e090a
-
Filesize
615KB
MD56fda9e0f48c2d0703e8e9fa8c1bc7b5d
SHA1b2be3244a36b6d108b6c63591b1bb22b0b1a95bb
SHA256870d3d6edf26c23aea4bdc13ebe1bdb26ae68944dfdad94fd666fae6ce130fbb
SHA5122e3d0317e4f2a8d24b3eb79e8ef70aee30f6b293cf56add337c82ecb352141978fc22f3865242f65cd98efb1c3e67a5d66a097ee964ec27e939f94a177e3d528
-
Filesize
318KB
MD58476df9dc909053073b50cc940b7cd9a
SHA1793f690f91a9a02673250e94151ceeed6fa9a347
SHA2568b653484ca61691b034e0dd52ffee5a3b01fe8fa30335ca06811dc45f11926b4
SHA512a4bdb05f400db181da78e9aeb01a3124f92336d0bbcb4b1715b62a52e640c93b475ccab551c853709246ec81f755c4dc86a9501f0c5f1e37f5f9e044f1e2aa84
-
Filesize
1.1MB
MD5173fb13a9794ae6aca901f27ff798b9e
SHA1330f6511702753bf2826852f330114785e5d886b
SHA25647025d557e57cb0e889f807e2f583c1e372bd1b0908782840f63b2e8c7d63882
SHA5120a095f3897aea9245be5e4b7ad7a7637e5db03cdbe773ac609e9c8f294a7e28408a0fb7a66c8beacaef2179fdc9bd9fc71139cd28f014978d06cba3d8f938f9d
-
Filesize
784KB
MD56599da611a0e25e298caeb30d9b2d665
SHA12233bd5636d994a547e711b3e6825aba3da9e68f
SHA2561ded4798440f566dacdd66c09f7232b7aa8f305aa9bcfe6e852a7be58382cd94
SHA5127d0d12a3f755ff10ae955937b9bd2c94d2d8802d904f10f3cd24bb2294817ebb34abe4e15b92bb08c86c3362dbf95f11aff4091b5a896a6017fa664c01e13c28
-
Filesize
593KB
MD556b7c7be0fd147e334f730028d93364e
SHA199b9a6198e2c670dd45a4713945e784cd4928598
SHA2564a3a8d9b2ba85a4ec3c51f80127e8d7d4a0a2719c75795bdf00f3092b260e49f
SHA512b12e5bd453a322925e7064f76a5713f708f133471186335f9148e8ba2192f30af85f314b5e2826a61a7b6d1fb96c370e4876d956743033a66d2db0867eb9e46a
-
Filesize
742KB
MD5643578eb9606afda8b0d3ed56e1c19ef
SHA1b4b5efbfce6d0a8a146b659887efa31a513edc2f
SHA256645376956104a7d1bdf5295aeadb9e40cf7fb9310b5ff39b28d016594339252a
SHA512c9845edc74c8932604246c848102e710c2c66de281d7ac560ee195982fbd554c9f840a34bdb3db63c49ac4b6f564128f515b39c3e2d2ade8935072e26342ef25
-
Filesize
699KB
MD540d4563dcd864a75535dc95b24cc10d2
SHA16e7fbb5939fe731830be1a784fbe3f8140602f36
SHA256d271250e8176488df4908e12c2e3371786b196e099690871b9339290131182d2
SHA512526a6c9838d63f7466f6268ff39b1a7ee68b9050dd435bc9bcc6cc1901127406168dce1f69af797bbee935ed0b3253c6343ddc238c8281f4f79449a2efe2df82
-
Filesize
275KB
MD5655d21fde4868f95713526c62cb24283
SHA174b5ac0aabb19be197c5fde42806ee099f0ee96f
SHA256f300d014babbcdfaec716bdf738c5e42d2c877d20ea48d14a8df0e7b8b17aa1f
SHA5123916d938f4d0e6dae06dc8ab2a760bb02edfa72b8743c97ec009cc90707723a9265f0e22a6386484a7101724d5274a6f72c6e8a5fca6bb32864da92e9343b776
-
Filesize
115B
MD5bf26d3d75cf5b754f74017829e5a80b1
SHA184b829c973a96cd84060a64fb9f68882e4537bba
SHA256476026d75e7f4c12c08af616ecd59a003a9415f64b4a7777ccd158d13b8e865f
SHA512406208a5111f6929e53625ae05d6a40ecd22bcdd14e723692553e57dcdcb9381b679f600932f5d85490286abddc8a4160256673962ddfa7813bf4d083cf68878
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1.7MB
MD5327394a452bc590a8dcc35499ec21060
SHA1799eaa40f88bb3a2a5b385e6fb51675c0da69981
SHA25620fe34797b5d870900402aaf927136076111bec331d6bfc443b86d66c551243e
SHA512325529f6fc4421e299c9e23139b43647301c90d7c2d6524f8aa64e52b5308bb9d67125e90847f740494da06140dc5753ec73269b117c3687d788983bfeb4e02d
-
Filesize
5.3MB
MD55760bad46664c1c9079d37bdbc4bbbad
SHA1a67cf6f0c1a164940c1562be1f066e85415dfe32
SHA25670be452d5ca4dfaeec5fd02652dc8c4d3c76ac329148c2bbf358ae8c829d4d73
SHA512b75c8095cc7f9d092edaf32b51bcd5c4ce98315d73a4f8f244a0cc42edf091509a17db02bf7e8fe81a0975b0b008e2b6c44cdbcc48ac7d0dacf02514f353d2f7
-
Filesize
280B
MD52692c6c0ce008e64d9d31e0f0f6fc85a
SHA1ce36abd9c2bf53dd14d92f5d893e2700b61aff6a
SHA256ce9bd366af1f0b97596e3df3d3f9ec97438aa12ad4397f18ebd0ab4e9de71545
SHA5126d879aaae781cce6248a071707888360067cd2869e4ef60de17138a97c8c4f5b1c9be1306198c739d1bb0e09d20fcbb317fba35eb4e59d21dfbac249ed13e488
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e