8999aecee04c3fc85f7a5e829336afd44e3e9fc493c68bd1a86ffa6003cc759c

Analysis

max time kernel
1049s
max time network
1035s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nedladdning.png
Size 2KB
Sample240527-mapq7ahb32
SHA256 8999aecee04c3fc85f7a5e829336afd44e3e9fc493c68bd1a86ffa6003cc759c
MD5 aafea989469fcad308fc11708747a342
SHA1 f2dd90143c46fc653a706deca1abb0557a7b012d
SHA512 a6bb253346482794b4b910081e6c8950a8d39bb48a9c46effa6963ba3e2ae1a4241d43562f0c04c05d080ebffa341c6beeed118f40feb02708c4ef59e6f076ef
MD5 SHA1 SHA512

Score

8^/10

adware discovery evasion persistence stealer trojan

Malware Config

Signatures

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Executes dropped EXE 45 IoCs

pid	Process
4592	RobloxPlayerInstaller.exe
2956	MicrosoftEdgeWebview2Setup.exe
4060	MicrosoftEdgeUpdate.exe
4068	MicrosoftEdgeUpdate.exe
4376	MicrosoftEdgeUpdate.exe
4008	MicrosoftEdgeUpdateComRegisterShell64.exe
2636	MicrosoftEdgeUpdateComRegisterShell64.exe
2836	MicrosoftEdgeUpdateComRegisterShell64.exe
3504	MicrosoftEdgeUpdate.exe
3212	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
5024	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdge_X64_125.0.2535.67.exe
2000	setup.exe
2636	setup.exe
4508	MicrosoftEdgeUpdate.exe
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
2768	MicrosoftEdgeUpdate.exe
4588	MicrosoftEdgeUpdate.exe
312	MicrosoftEdgeUpdate.exe
1580	MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
3660	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
4412	MicrosoftEdgeUpdate.exe
3868	MicrosoftEdgeUpdateComRegisterShell64.exe
912	MicrosoftEdgeUpdateComRegisterShell64.exe
404	MicrosoftEdgeUpdateComRegisterShell64.exe
764	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
4712	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
1628	BGAUpdate.exe
2412	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdate.exe
880	MicrosoftEdge_X64_125.0.2535.67.exe
3376	setup.exe
1648	setup.exe
3532	setup.exe
3472	setup.exe
1500	setup.exe
636	setup.exe
1224	MicrosoftEdgeUpdate.exe

Loads dropped DLL 44 IoCs

pid	Process
4060	MicrosoftEdgeUpdate.exe
4068	MicrosoftEdgeUpdate.exe
4376	MicrosoftEdgeUpdate.exe
4008	MicrosoftEdgeUpdateComRegisterShell64.exe
4376	MicrosoftEdgeUpdate.exe
2636	MicrosoftEdgeUpdateComRegisterShell64.exe
4376	MicrosoftEdgeUpdate.exe
2836	MicrosoftEdgeUpdateComRegisterShell64.exe
4376	MicrosoftEdgeUpdate.exe
3504	MicrosoftEdgeUpdate.exe
3212	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
3212	MicrosoftEdgeUpdate.exe
5024	MicrosoftEdgeUpdate.exe
4508	MicrosoftEdgeUpdate.exe
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
2768	MicrosoftEdgeUpdate.exe
4588	MicrosoftEdgeUpdate.exe
4588	MicrosoftEdgeUpdate.exe
2768	MicrosoftEdgeUpdate.exe
312	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
4412	MicrosoftEdgeUpdate.exe
3868	MicrosoftEdgeUpdateComRegisterShell64.exe
4412	MicrosoftEdgeUpdate.exe
912	MicrosoftEdgeUpdateComRegisterShell64.exe
4412	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdateComRegisterShell64.exe
4412	MicrosoftEdgeUpdate.exe
764	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
4712	MicrosoftEdgeUpdate.exe
4712	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
2412	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdate.exe
1224	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\BHO\\ie_to_edge_bho_64.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\PdfPreview\\PdfPreviewHandler.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\notification_click_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\notification_click_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\EBWebView\\x64\\EmbeddedBrowserWebView.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "\"C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.EXE\" bgaupmi=557B3857FB134D9E8C42A6B56F3F7B3C"	BGAUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
297	discord.com
298	discord.com
299	discord.com

Checks system information in the registry 2 TTPs 30 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AnimationEditor\img_key_indicator_selected_inner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\particles\forcefield_vortex_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\TerrainTools\mtrl_sandstone_2022.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\fonts\Montserrat-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\LayeredClothingEditor\WorkspaceIcons\Center Camera to Mannequin.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\Mu\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\wdag.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\avatar\animations\humanoidR15AnimateChildren.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\is.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Mu\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\advancedMoveResize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\StudioToolbox\AssetConfig\marketplace.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB995.tmp\EdgeUpdate.dat	MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AnimationEditor\Button_Dopesheet_Darkmode.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AnimationEditor\FaceCaptureUI\button_control_record.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Lobby\Icons\back_icon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_1x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB995.tmp\msedgeupdateres_kn.dll	MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\DeveloperFramework\AudioPlayer\audioPlay_BG.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\LayeredClothingEditor\WorkspaceIcons\Auto-Weight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\PlayStationController\PS4\ButtonShare.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\LegacyRbxGui\PlasticBlueTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\ne.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\fonts\families\Guru.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaApp\category\ic-top [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AnimationEditor\btn_edit.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AssetImport\Import.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\waypoint.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Controls\key_single.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaChat\9-slice\input-send-message.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\Sigma\Entities	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\models\AssetImporter\bonePreviewMesh.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\loading\loadingvignette.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\ui\Menu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\ExtraContent\textures\ui\LuaChat\icons\ic-notification.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\AnimationEditor\button_control_next.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\content\textures\TerrainTools\UpArrowButtonOpen17.png	RobloxPlayerInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\125.0.2535.67\\BHO"	setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612785710497176"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4828	chrome.exe
4828	chrome.exe
4592	RobloxPlayerInstaller.exe
4592	RobloxPlayerInstaller.exe
4060	MicrosoftEdgeUpdate.exe
4060	MicrosoftEdgeUpdate.exe
4060	MicrosoftEdgeUpdate.exe
4060	MicrosoftEdgeUpdate.exe
4060	MicrosoftEdgeUpdate.exe
4060	MicrosoftEdgeUpdate.exe
3904	RobloxPlayerBeta.exe
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe
2768	MicrosoftEdgeUpdate.exe
2768	MicrosoftEdgeUpdate.exe
2768	MicrosoftEdgeUpdate.exe
2768	MicrosoftEdgeUpdate.exe
4588	MicrosoftEdgeUpdate.exe
4588	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdate.exe
1500	setup.exe
1500	setup.exe
4428	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
3904	RobloxPlayerBeta.exe
1992	RobloxPlayerBeta.exe
4436	RobloxPlayerBeta.exe
1808	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3052	4076	chrome.exe	90
PID 4076 wrote to memory of 3052	4076	chrome.exe	90
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 2576	4076	chrome.exe	91
PID 4076 wrote to memory of 4300	4076	chrome.exe	92
PID 4076 wrote to memory of 4300	4076	chrome.exe	92
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93
PID 4076 wrote to memory of 4492	4076	chrome.exe	93

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\nedladdning.png
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6153ab58,0x7ffd6153ab68,0x7ffd6153ab78
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2284 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3592 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4448 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4288 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4560 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4104 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3184 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5080 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5188 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3092 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4060 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5928 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5952 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6100 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5460 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5508 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- - C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2956
  - - C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4060
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4068
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4376
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4008
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2636
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2836
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MzMzMxQTAtNkFFMy00ODBBLUIxRjUtQTZBREVBMzkzODE3fSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCQ0U4MjdFMy01RjRCLTRCNjctQUI3Ny03NTQyQ0FBNDAwOEN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMzMwNzU0MDAiIGluc3RhbGxfdGltZV9tcz0iNTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        
        PID:3504
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{3C3331A0-6AE3-480A-B1F5-A6ADEA393817}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3212
- - C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe" -app -isInstallerLaunch
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=1492 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:cPWHxVSb2kSXld7tNVUPofv7LkSP52ZoAjkGrNazRnbk0SmHWnDu3lEAtKHw9Q9itF2EgPgcJ4TrmyEBkjebSCZEY9Kjg7thJQAkqPlzh8i8zlUpOJ7Nt8Q4BUaywdHLpN_7RxRCY4Tq6_vKuC8yoZH8rJpKjthNbZT1Fr0OAzzgJscuYH8me0RV5alq5BemlRpfe18gqwT0xdi9q_f7bp75Zs6OL_Fgg1eDc8d9avY+launchtime:1716805236196+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716804981403018%26placeId%3D14184086618%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D98989806-dc4f-4c69-93dd-cffc25cdf63d%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716804981403018+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6244 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:92kjYUpq3pe6DXVj587n3oZFUCTLt8mImhuEzofJUSZrjA2bmOrbw8rbdbyLP8FzhpZoNq8LnJm6q72qpimgt7wCjNdLE9R1zLHGTwqstBPw7KU_GQHE2r5H1cyr9LAbIuy1bVFsWDbfqjFE9ADFhS_RKtXApzqHMQzGG6AZAACl6eh-t786FEr-QgCRo1nUf8G4703VA8vvIFnz27V0rI5gtKr6e9cNog3bHO7cCX8+launchtime:1716805282598+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716804981403018%26placeId%3D14184086618%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dae900d50-3fd5-4d5b-b918-8ddbab0e3d71%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716804981403018+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=1604 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6076 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6496 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6500 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2956 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6040 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=1120 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6416 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6136 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6960 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1108 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6196 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6684 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7056 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=6544 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=7124 --field-trial-handle=1928,i,13957217973769797578,1853328216544790351,131072 /prefetch:1
  2⤵
  PID:4068

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4596
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MzMzMxQTAtNkFFMy00ODBBLUIxRjUtQTZBREVBMzkzODE3fSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QTZGODlDNC1BODlFLTQyQjgtQjBENS1ENjIwQjk1NzI5NzB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMzk1MjU1MDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:5024
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\MicrosoftEdge_X64_125.0.2535.67.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\EDGEMITMP_236CB.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\EDGEMITMP_236CB.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2000
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\EDGEMITMP_236CB.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\EDGEMITMP_236CB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CAC9150-FC13-433E-9C5A-CC7BC0325BDD}\EDGEMITMP_236CB.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6c3f14b18,0x7ff6c3f14b24,0x7ff6c3f14b30
      4⤵
      Executes dropped EXE
      PID:2636
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MzMzMxQTAtNkFFMy00ODBBLUIxRjUtQTZBREVBMzkzODE3fSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1QTA2QUYxNS03MkMwLTRCNTgtOEEwOC0xRjU2MUQ1MEQ5OTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE0NjgyNTQ3OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNDcwNTUzNjgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDY2Njg1MzQzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzA4ZTc3MC01MWEwLTRkMDAtYTJmMy1kNzM2ZGI4NTg2ZTc_UDE9MTcxNzQwOTkyMyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1kc2xGJTJmaGowcmxRWTI1ZlQlMmIxRlQySHR2aDlxeDBQZEVSdThNcTl1Z1A2MDNjcHM0VlE1dXR4emFDOEFMcHdieExocWxWZmhlMHZBS1Q1RDh5bTljZnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM4MDg1OTIiIHRvdGFsPSIxNzM4MDg1OTIiIGRvd25sb2FkX3RpbWVfbXM9IjI1MTg2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ2Njc3NTQ0NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0ODA3ODU0MjgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5MjA4OTUzODMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyNjUiIGRvd25sb2FkX3RpbWVfbXM9IjMxOTY4IiBkb3dubG9hZGVkPSIxNzM4MDg1OTIiIHRvdGFsPSIxNzM4MDg1OTIiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MDA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:4508

C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1808

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2768

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4588
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB143233-44F5-4F17-8E51-554D6CD924EF}\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB143233-44F5-4F17-8E51-554D6CD924EF}\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe" /update /sessionid "{01C8C653-14F2-498D-B484-16FAA6B9E19E}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1580
- - C:\Program Files (x86)\Microsoft\Temp\EUB995.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUB995.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{01C8C653-14F2-498D-B484-16FAA6B9E19E}"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3660
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4864
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4412
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:912
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:404
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDFDOEM2NTMtMTRGMi00OThELUI0ODQtMTZGQUE2QjlFMTlFfSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MzYyNzEwNzctRDM5Qy00OENBLThEQzAtNjQ0RENFNzUzQTg5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE2ODA1MTIxIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDEzMzc5NDI3NSIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:764
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDFDOEM2NTMtMTRGMi00OThELUI0ODQtMTZGQUE2QjlFMTlFfSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEMzAwNTgyOS0wNEIzLTQ5QTMtQjc5MS03REI4MzJCRDk1OTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MzkwOTU5NTA3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzOTExMTQ5NjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMDgyNjA0Mjg4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjIxNjY3ZGMtYmIwYS00YWNiLTgzM2QtNWExMWRjODhhOGJmP1AxPTE3MTc0MTAyNDcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YmVlJTJiYkdmYjNqb2w5NG9kRk94N05LYUNzRGVYUlZ5SCUyYlphNWVWNTVjZHR1UkVHcG9OMGZCU3BUbUpFWTNnSkVtSyUyYmxvVzk4azZ3b0pSUWVrZUoyM0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDA4MjYyNDMyNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjIxNjY3ZGMtYmIwYS00YWNiLTgzM2QtNWExMWRjODhhOGJmP1AxPTE3MTc0MTAyNDcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YmVlJTJiYkdmYjNqb2w5NG9kRk94N05LYUNzRGVYUlZ5SCUyYlphNWVWNTVjZHR1UkVHcG9OMGZCU3BUbUpFWTNnSkVtSyUyYmxvVzk4azZ3b0pSUWVrZUoyM0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjIxMDQ4IiB0b3RhbD0iMTYyMTA0OCIgZG93bmxvYWRfdGltZV9tcz0iNjQ1NDMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAwODI2NDQyNjMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAwODgyNjQyMTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSIxOSIgcmQ9IjYzMzciIHBpbmdfZnJlc2huZXNzPSJ7QTVDMkQ4NUYtODkyNS00Q0ZDLTlCODctQzQwRjE1NTFFNEZBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1OTY0OTEzODE2MDM4NzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iMTkiIGFkPSItMSIgcmQ9IjYzMzciIHBpbmdfZnJlc2huZXNzPSJ7RUY1OUJENTktQjIzRS00QzQ5LUExQzAtRDlFMTRCM0MwQTBGfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjUuMC4yNTM1LjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzNTYiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins1QjU0NDAyNy03MzBGLTREMTAtQjc1Mi1BM0RGODAzNDQ4REJ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x4a0
1⤵
PID:1212

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4712
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk4ODk5RDctQ0YzMS00MzYyLUI2NzUtMzE1MzM3QzgzRkIxfSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTFENDA4NkYtMjkzQS00QjY1LTg4MEUtMzEwNURDMTZFM0UwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0Q2anhQZVVtS2ZoOHl0eTZGMDdZeE0xZVpESC9UVjZGUVQyZmZEaVp5d3c9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTcxMTkxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2Njg5NDE3MjQyNDc1Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMxMTU4OTI3NDQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1204
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E538867E-8761-44E2-B01B-0534A4968420}\BGAUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E538867E-8761-44E2-B01B-0534A4968420}\BGAUpdate.exe" --edgeupdate-client --system-level
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1628
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk4ODk5RDctQ0YzMS00MzYyLUI2NzUtMzE1MzM3QzgzRkIxfSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4OTEzM0ZGMy0yREUxLTQ5MDItODg5Mi02RTFFNTEwNEU3OUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzEyNjQ2MjY5OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMTI2NTcyNjYyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjMyMTMyNzM1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTc0MTA2MjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9QWx2QVNHdzFDOXVNQ1E4RjFPd0VpamdTSlF3b2ppaExhSEwzQiUyZmtacm9ybG9PYUQwTllvUmlsZ3E0TzFoSTRNZnY2bkFUYm1mQ2IlMmZPZGZ6WE4yQVpBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzYzMjE0MjY5NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTc0MTA2MjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9QWx2QVNHdzFDOXVNQ1E4RjFPd0VpamdTSlF3b2ppaExhSEwzQiUyZmtacm9ybG9PYUQwTllvUmlsZ3E0TzFoSTRNZnY2bkFUYm1mQ2IlMmZPZGZ6WE4yQVpBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgZG93bmxvYWRfdGltZV9tcz0iNDYwMDUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzYzMjI1MjgwMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNjM4NDYyNzc1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM2NDUxNzI2ODYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2MzIiIGRvd25sb2FkX3RpbWVfbXM9IjUwNTI5IiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2NjciLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:2412

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4428
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\MicrosoftEdge_X64_125.0.2535.67.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Executes dropped EXE
  PID:880
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Installs/modifies Browser Helper Object
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - System policy modification
    PID:3376
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6bec54b18,0x7ff6bec54b24,0x7ff6bec54b30
      4⤵
      Executes dropped EXE
      PID:1648
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3532
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6bec54b18,0x7ff6bec54b24,0x7ff6bec54b30
        5⤵
        Executes dropped EXE
        
        PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6b5d64b18,0x7ff6b5d64b24,0x7ff6b5d64b30
        5⤵
        Executes dropped EXE
        
        PID:636
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzFENUE1M0ItNDQ4Qi00Mjk5LUExQTUtMTcyQ0JBRURFNjFCfSIgdXNlcmlkPSJ7NkZFMENBMTMtOEQ5My00NjcwLTg5MEMtRTFFMzUwMkY3MzI1fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0RjdFOEY2RC04M0M1LTQ4RUQtQTYyNC01NzQwQkJFN0M4QzZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zOSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45MCI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjM1NiIgcGluZ19mcmVzaG5lc3M9IntGMDVCQ0M1OS0xMEFFLTQ1NjMtQTNFRC1DNDM0MEYzMzdDMzl9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS42NyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTk2NDkxMzgxNjAzODcwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDIxMTM2Mjg2MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDIxMTQ3Mjc2NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDI0MDY5Mjg2NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDI1NTA0Mjc0OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQ2MjE1MjI3MDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2MDciIGRvd25sb2FkZWQ9IjE3MzgwODU5MiIgdG90YWw9IjE3MzgwODU5MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzY2NDUiLz48cGluZyBhY3RpdmU9IjAiIHJkPSI2MzU2IiBwaW5nX2ZyZXNobmVzcz0ie0UwN0VCQkE2LTdDRjctNEY5Qy05RERELTM4REU3NUY1MzFGMH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI1LjAuMjUzNS42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MzU2IiBjb2hvcnQ9InJyZkAwLjA5Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MzU2IiBwaW5nX2ZyZXNobmVzcz0ie0NBNkZCQkNELTc5OUEtNEUyOC1CNkM3LUI4RUY5MTE1NEYzNH0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Installer\setup.exe
Size 6.9MB
SHA256 adbd1a10981cccd00918d924ec93a9d6f29d16190691f6984b199f9a42cc0cb6
MD5 6aafb8c6ce355a80514a2f3abc13a9ad
SHA1 2db9a7dde9086dd415ee41b4b109a3311f088c8c
SHA512 c9f23c68b7385d8edfdbff7b80a6064ac8eb879384796e7f54b094155feb32a86836c4a910c323128a4a6b3b15b7fbe1a9b0b56153ff0e71c96dce7776b0f848
SSDEEP 98304:sKD4hdFWw+WqdM425fQ9/Ls9yXqDQgj6/D+zZ:jD4hdFmeSsyXqD1jXzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BGAUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
Size 17.2MB
SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
MD5 3f208f4e0dacb8661d7659d2a030f36e
SHA1 07fe69fd12637b63f6ae44e60fdf80e5e3e933ff
SHA512 6c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740
SSDEEP 393216:1JmA6wjj314+lu3aEjdAynz9EHmiqEYDJDj/:vt314mmsyzKGiqEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.39\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
Size 1.5MB
SHA256 fa7d8a8cae60ab620d2aa887de62039d2647e4f5c1c649d75f0f52e14ec11a99
MD5 1f744e1c802560affe8b308640b6ab67
SHA1 bbfecefdf891c11d573760d4dabdf86091463421
SHA512 780440aa518397e52bb429b5a8e7697bf0096db0fe343cd40a541b60f34ad4976ef7fc2204737d296a8c1fbed2951496503dc50158d6455617c67483f87f3015
SSDEEP 49152:wiEt3INrz6JcC2WSoRQ6dQz1Gz+nOwumDCD4JBE:wiZX6+9WSoRQ6Ce+nvXDC0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP.EX_

Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1AE53AB4-48DE-4237-9946-61F52EBF4902}\EDGEMITMP_882E5.tmp\SETUP.EX_
Size 2.8MB
SHA256 83adcbedcb0e3d11e39c5c276b0314ead57925b164670fd4f59a909729d4e6b2
MD5 047f51993bde0b7add44035ad3c5fb35
SHA1 7d56baff27be27df8c2d3ef2bfbfd14e84d2b70f
SHA512 14132d71e02b97fdcae7cbb0d3d4c92c1f7c044ab63248d0a717e41e64ce96e1c533e1fe77a85fe93c8d12866f30ccfa5bd0a37a516b5d223973980ebf54e603
SSDEEP 49152:Ahtx0+uNwoshC1SGjLx21aeAOSk5PFaxByB8yNFt9+8pBJdsxbkvvTadk0QMtGyh:f7NOhAB4whkFFWBFut9fKmqQMtGKiqCo
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 179KB
SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
MD5 7a160c6016922713345454265807f08d
SHA1 e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA512 c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
SSDEEP 3072:H8czUqc3YHFwUztZr3OtjwC/5kPghc2dFi1CJhf:VUx3YHFwCtZr+yZgd81Yp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
MD5 4dc57ab56e37cd05e81f0d8aaafc5179
SHA1 494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA512 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
SSDEEP 3072:wHrfzYYc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+s6LRCkuB9N3iQzFXf8qUV:0Ael/DRfkTC3dM7B+mCDH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 212KB
SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
MD5 60dba9b06b56e58f5aea1a4149c743d2
SHA1 a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA512 e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
SSDEEP 3072:LwZr2PMjkqEq/X0GbjILfh1W5vpynTywTZoY46OdO8A5l3eX7jR:LSr6akqEq/X0sjIT25v0rohoJ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\MicrosoftEdgeUpdateCore.exe
Size 257KB
SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
MD5 c044dcfa4d518df8fc9d4a161d49cece
SHA1 91bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA512 f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
SSDEEP 6144:24yWbEHb9XVfocP/yd7UAOuJ1NXKSih+9A:PEHb9XVfomq1lK5h+9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdate.dll
Size 2.0MB
SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
MD5 965b3af7886e7bf6584488658c050ca2
SHA1 72daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA512 1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
SSDEEP 49152:T94O+C4rss1x1pBVwRQjS729TKQ3M3rMv7:TmO+LrskPjSavErC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_af.dll
Size 28KB
SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
MD5 567aec2d42d02675eb515bbd852be7db
SHA1 66079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA512 3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
SSDEEP 384:5f8NVFXh7JWmyIWxjrYiVDxlwC3W+uyeHRN7HT3OOP5AR9z5z/S:j6mW+LKz3OOPO9z8
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
MD5 f6c1324070b6c4e2a8f8921652bfbdfa
SHA1 988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA512 63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
SSDEEP 384:7inQVFXh7JWmyIWf0Kl8js/MyeHRN7GkGER9zYb5Nf:cee8js/1KG+9zK
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
MD5 570efe7aa117a1f98c7a682f8112cb6d
SHA1 536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA512 5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
SSDEEP 384:T2LPBbJWmyIWcYwTPsQ8XvPGCdyeHRN7JMOOP5AR9z5zKk:RCbQXvPLMKJMOOPO9zkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_as.dll
Size 28KB
SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
MD5 a8d3210e34bf6f63a35590245c16bc1b
SHA1 f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA512 6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
SSDEEP 768:ekLZ452DuUu3+F/D06DpJKIlHpbKSOOPO9z6/:3S1Oizy
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
MD5 7937c407ebe21170daf0975779f1aa49
SHA1 4c2a40e76209abd2492dfaaf65ef24de72291346
SHA512 8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
SSDEEP 768:cfIOFe5FEuo//rtkPFS5OrF9FTFYF+uzKi+9zH:cpFe5FEuobuFJrF9FTFYFuPzH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
MD5 8375b1b756b2a74a12def575351e6bbd
SHA1 802ec096425dc1cab723d4cf2fd1a868315d3727
SHA512 aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
SSDEEP 384:0DTJVFXh7JWmyIWbdsSCCdrwdPMQgv6Sf46JyeHRN7RsWAR9zgXb3AQe+:QEVdshCJCgCz6gKWL9zcbAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
MD5 a94cf5e8b1708a43393263a33e739edd
SHA1 1068868bdc271a52aaae6f749028ed3170b09cce
SHA512 920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
SSDEEP 768:yZvAGEtJtVWCZsnM9/r94amPdQ8JBlHhKZ+9z2f:ydAGEbOmcz2f
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
MD5 7dc58c4e27eaf84ae9984cff2cc16235
SHA1 3f53499ddc487658932a8c2bcf562ba32afd3bda
SHA512 bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
SSDEEP 768:fUvAGEtJtVWCZsnM9/r94amPdQ8JBlHMKL+9zzCC:fMAGEbOp+zWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_bs.dll
Size 28KB
SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
MD5 e338dccaa43962697db9f67e0265a3fc
SHA1 4c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA512 e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
SSDEEP 384:NEDVFXh7JWmyIWGaDAmqRDU5NLCdJlwcSXp+U1s477yeHRN7qxkGER9zYb5BTRZ:ZH6lwcSXp+2s4CKqx+9zuRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 29KB
SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
MD5 2929e8d496d95739f207b9f59b13f925
SHA1 7c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA512 ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
SSDEEP 384:o7VFXh7qWmyIWMbkbOnGNfNFoBWk5S0IlyeHRN7/bFkGER9zYb5zO:u6bkbOnMffoBWfRkK/bF+9zx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
MD5 39551d8d284c108a17dc5f74a7084bb5
SHA1 6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA512 6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
SSDEEP 384:yyUVFXh7JWmyIWFHEWdvDNfNFoBq1ZqFGyeHRN7+UAkGER9zYb5f7:rzHEWdvpffoBqiTKe+9zG7
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
MD5 16c84ad1222284f40968a851f541d6bb
SHA1 bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA512 d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
SSDEEP 384:VnPVFXh7JWmyIWXTL7PGmxQEnwd/OyeHRN7NkGER9zYb5+B:MtTL7orKN+9zVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
MD5 34d991980016595b803d212dc356d765
SHA1 e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA512 8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
SSDEEP 384:wEcVFXh7JWmyIWjtZEmiuTHsyi7zAaaVamYylVb2UFxOF6dJDyeHRN701OOP5ARQ:zFDVEUjxdJmK01OOPO9zq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_da.dll
Size 28KB
SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
MD5 d34380d302b16eab40d5b63cfb4ed0fe
SHA1 1d3047119e353a55dc215666f2b7b69f0ede775b
SHA512 45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
SSDEEP 384:saIhVFXh7JWmyIWmm4HcyvBdck0yeHRN7lb7EHR9zKRELY:2Av4PcktKh7Ex9zA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_de.dll
Size 30KB
SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
MD5 aab01f0d7bdc51b190f27ce58701c1da
SHA1 1a21aabab0875651efd974100a81cda52c462997
SHA512 5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
SSDEEP 384:mjPVFXh7JWmyIWqeI4FBhj3ZnswxWbzOyeHRN7PkGER9zYb5AWK:doetj3Zn7xWbzrKP+9z1WK
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_el.dll
Size 30KB
SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
MD5 ac275b6e825c3bd87d96b52eac36c0f6
SHA1 29e537d81f5d997285b62cd2efea088c3284d18f
SHA512 bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
SSDEEP 384:M5jSVFXh7JWmyIWHnBzBUBOTG94vTZtfFtSmFK9q8LPgbYyeHRN7OPOOP5AR9z5z:iJpnxmFTAK4OOPO9zl
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUA8B9.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
MD5 4a1e3cf488e998ef4d22ac25ccc520a5
SHA1 dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA512 ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
SSDEEP 384:W0WVFXh7JWmyIWAkagyDl9FR/lyeHRN7AI3kGER9zYb5JFBG:XfagyDldcKA0+9z0BG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 5.3MB
SHA256 00314da401908da37ebfe9b642506cab81a4467c092719fcf007be045bc4a9e0
MD5 0469bb703f1233c733ba4e8cb45afda2
SHA1 a07afd7ecf1d0b740b0e2eddfcde79dcf6e1767f
SHA512 342c9629e705eb78c7bd52b3efe4a92b6a8bece9933956390450600635e4c0511ca96ccaa25e6920e9d25ccdf444dabfea7b09f8fbcba2f371655f87633b6d67
SSDEEP 98304:zgvbSU/pH19TO3/SkXlRyHJy5gP2PucfqCRt+62Ilh/pulde:cGuH9krJgPjCm6rJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Size 1.5MB
SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
MD5 610b1b60dc8729bad759c92f82ee2804
SHA1 9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA512 0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
SSDEEP 49152:Jy53/rfy7dJ1zlMCXCFaJQyiOMFxBBr3kqeac:JyJrfy7dvBMCXEaFrM3BBTleac
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Program Files\MsEdgeCrashpad\settings.dat
Size 280B
SHA256 0a065364a08ecff6a68ca06fdfaa4842113256c6d154c2fbd0bc9dfb36d1e452
MD5 b98a06eb9b071632399e5af243e52eab
SHA1 a868e36e6260a6b27a024e89777295bce666194f
SHA512 0e3b35d318ba12893ca6d2402cc64b1fb49831370147fb5379c140318ab0ed1bb803b1dc4eaa930bd12ebbf42c333b9e31477ac7a4fe4cb2c707d0c248b68e9f
MD5 SHA1 SHA512

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 61KB
SHA256 4a30735198de03d4f7460e711d5c4b186e8ab6dffed223f3716a90fa46d1dc1a
MD5 c199946be878703695bd28c22c2c0276
SHA1 ec829d3fbe932d77a62d5633cec337171f6a8bc4
SHA512 a06b6ff77df80a384d80b437f2791ca2f0c591756af2e29c0e3e8caa1c5b38e45ef71ba4f363c471ee0097ea1f122c5ea56d5c22155e4c1c3d5b22773cf18bc4
SSDEEP 1536:s8HBSAPlVhSirKh3d/oDOQgB89dH6Yqm0k:s2BSAPHhSirKh3d/oDOQgB89dH6Yqm0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 59KB
SHA256 cdeaef4fa58a99edcdd3c26ced28e6d512704d3a326a03a61d072d3a287fd60e
MD5 7626aade5004330bfb65f1e1f790df0c
SHA1 97dca3e04f19cfe55b010c13f10a81ffe8b8374b
SHA512 f7b1b34430546788a7451e723a78186c4738b3906cb2bca2a6ae94b1a70f9f863b2bfa7947cc897dfb88b6a3fe98030aa58101f5f656812ff10837e7585e3f74
SSDEEP 1536:WJ6YchJJbJ17H1RlOgLqDBL4+T+CFlvQJZ/Eu:NYc9bNRl7LS4nCPQJpEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 24KB
SHA256 d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
MD5 87c2b09a983584b04a63f3ff44064d64
SHA1 8796d5ef1ad1196309ef582cecef3ab95db27043
SHA512 df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067
SSDEEP 384:tWRPGBQntHHPd6PE5E6YmHdflgl0Eo1prsMV+5rKxOmtGPGCtZD7v6:x4BEPElVHEl0f1prs1wGOE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 326KB
SHA256 b66f217f073ab97989c7d874d6e9ca4017289346ec8e1d4462c7e80c8a6d5ba8
MD5 c5ea7d4c5638afb538c2ff5808b98cc6
SHA1 56414b2014fb29b78316e8ce9941a0e6be065215
SHA512 78341567a78b2befa4c0cd4f09c7bfabb5473a7f7aa4b6954a3b27d203bf34aae4afcec8ba93cba0960f592529055df17452eb3accf395ba212b98e07b5e67e0
SSDEEP 6144:rLxOdfkZrzGqn/rGRgaBgxlDuBuGZIq/jfNDwJv6wHObvVD9:/slArqq/rGRRgxlDuHZ71CDSvVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 133KB
SHA256 d24e3cbe3927d6225fb5aa27b745caf8b079266e9387c1b755fabc33b48c60f4
MD5 4874fb82da9e619ba014c987a9d29f4e
SHA1 496a06b6bb1551f79ad40d25b06cc63c4754a5ff
SHA512 488b6aa4ed0e810311b9a40d82707008fb01036aec8abede9e947ab9c6495b9455691caa7398b4f597546237aa3f34cfc10c7687889952b1db706c4bbe542efd
SSDEEP 3072:nqOq2uF6IMRXMVc1Sv0vYzoOSzIdi5ei4erSkK7tOFI:nqOKF69RXqc16QR4erSkstOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 73KB
SHA256 e37077347f624db0db7966799b1fd84654602da75c1243e8412d81e0bacd463b
MD5 676a2ab7fe2f8a43ad8a54dde5ad3497
SHA1 1cd0ee9772ed8e2aa5a8feaf799779e641c6e054
SHA512 248eced8740aceca62f85b31da62a0d5c642a80097cb01ebd0ec000d23f30cb5881e292026d65268ec2140d60344b82ccd02751b3ec8d871f6a06bb4dd26d79b
SSDEEP 1536:hNp7JkhO+NkkZtIGuy+mn27rXs5hwhY5Oyvf2mijg3jtRChHggb:hNp7eO+2Guy4Ts5hwG5Oyvf2UBRCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 40KB
SHA256 675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9
MD5 5ce7bdeeea547dc5e395554f1de0b179
SHA1 3dba53fa4da7c828a468d17abc09b265b664078a
SHA512 0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e
SSDEEP 768:zznaC0S3xL3wn+dljVGT3tOkaSOzWS64CLUulVINZQ9vQMAdS:PnajS3x3wn+XjVGoknOiS6PzlVIEROS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 86KB
SHA256 0791bfd5c9dad4b28433efe5937084a816644a47560926dae6831452468c718b
MD5 21b99db6353764fcff850ed4de1489ee
SHA1 e1771dc14a7d394e89c3a222993ce56c86f44236
SHA512 c92d27c11455e82d60302a0c206e711400f1a74f91473ff1a710453d4a23aa7e4f5632e349c12e4d6b3572a03f0171495bf4782c4ec67101c705b570ed76de4e
SSDEEP 1536:N32zLj0o7qlG339S0Wz5Ltszl1Bi1iFXOMjbz0uOx/8seytVEOWClnuBy33k:N8fru83tSD4TI1iUML8/nhVEOW9M3k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011c
Size 206KB
SHA256 374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef
MD5 f998b8f6765b4c57936ada0bb2eb4a5a
SHA1 13fb29dc0968838653b8414a125c124023c001df
SHA512 d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716
SSDEEP 6144:rByHI/jQOq4dOccc0mN2EsmCkJO6hBXUmoq:rEo/jJZd+IZJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 1275114ab7fcbbfc0c6e38e51f40f7c992d653ac5e284d61e98d915eb77ac161
MD5 8a231d08d40f713a30820129dc46fb85
SHA1 d1954ce719bb6082e690a6c91420e331d7f1f1ed
SHA512 9c4659cf7b2229b28f82fb9b876b89f65fe2cc7b4efa321503d457ac102d1ae5a645b08598ff9408d0115fbb272fa967f58de28ec807827f4ed7f348545df6b6
SSDEEP 96:ovO7fNl1TXLDvrNT+n1Xhie5eqP2KlW24SiU/3hj6qsnz4lnKMGDjxi27ppXKWhs:oESX5nu1Mj6RjDpXlhH84Z/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f7687bd439ba0ba401f44c23fea1f72cd9f3920e5949849867d90ffcc9e2a270
MD5 a6b8249c7c4826022f9032e87ef954dd
SHA1 4bcfa1e6443fd35b7842d158f9b01e243a75c458
SHA512 db5bd3ee0f211715976b793b60eabd53a70e57cbcb9d1f60887743d97ffa62aa545b10e1e6fa2093b24ddcd51933c27e845967383ed1b824fb36fdc191e38d57
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c52001d2e2826a927292609efb83b2d22372da443632e9090238e7d86a0dd51e
MD5 0f095ff5b34aa282a02d2a6afe866bdb
SHA1 fa6bcefaa0ec8f67d31942f107091b60e2973b6d
SHA512 3dfbec8c6d0ec40b922eca75ea21b55de3d28c64fe8c312223bc4647ae94d5eaec05ddb641bbb483e818d8f7454b3f6ddd0a572f2748055b411ea878c3bab4ec
SSDEEP 96:JCP2PWS4jU/wh68ql3K6BM2WpXsh++jxN+jVp:cuOdh6f6pXsh++OVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 0c682018f75bd9e5a97a752b190ccfc6b80c7c501ec844506f3a3869c735c399
MD5 2aee1c2bd333f038693d650025fb6d50
SHA1 c5e22bda77d2faaa147b6e73193a9a7c11221ede
SHA512 cd5adc8aebda4360bfb57c9d702d274b078d16948c3e5a2481a801adf4f18e32a33d46384b296a57ec9c8ccb42a6d53e982abf4e58090848ee44b20c6191e122
SSDEEP 96:oeB4HvO7ANl1XXLDgrNT+n1Xhie5eqPVKlWW4SiUXqchz6qsnz3TQiSs5SAxmP2k:kjbX5nd1Qzz6CA3K0XCh5Ots/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 7369748fec4da9514700abe8daeff2cfc9f060173b07182d1c41e2f80a334161
MD5 19ccdee3df003660956d71033f979b3d
SHA1 e5ceacc857cf46578f0085ea0398fa8942c69ed5
SHA512 651f91ad83001877d481f537626528bcef6f3f40e93818a37fb66b91ccb051b0e5c0617e3299629d9cf408c1cfd6017c12976ea18ac64b669733b119011aae5f
SSDEEP 96:UO5O7fNlmTXLDvrNT+n1XhieNeqP2KlWS4jU/wh06qsF4l3KMGDBi27ppXKWhH8D:UORSX5ju1r06nzpXlhH8GZ/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 0437777561066486f221d298e0427872d943d62b4eca8140e281503059725362
MD5 14760bc0f9420304634aae955e5329d7
SHA1 9f7c8fe2a0c16e48c90c8d092ea73459480074bc
SHA512 114df65104d74ef66b1ec09226c2a2780f585316c08efa98d417f7cffa5b8b660192803fc8fa69932ed4b88cb9c2c0c6f233b93a988aedf85a347732c317d346
SSDEEP 96:GvO7fNl1TXLDvrNT+n1Xhie5eqPVKlW24SiU/3hj6qsnz4TnKMGSjxi27ppXeWht:GESX5nd1Mj6OjDpXZhHO4Z/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 04ef1639d8a04ae4de73d44cb4966acc8a910321d3283168bdcc6fca38082b09
MD5 9d9a9ed811ecb086f4defa315b281e31
SHA1 0f31f6300c3ebb9779478437e5a7045545a291ce
SHA512 07d95e186505fde67295e2502b35f0597d4585db60d35b6f33dfea50891eeb1ef364b545abe4701c2a97eeae88389ce1ffd7b24593625fbc435e166ed321ea4d
SSDEEP 192:9HiHmHFHRHaHRfHNHQHjHDHIHfHAHWHLHNHoHoHQMH6jHiHBH81HQH2HHH4H6aHw:9HiHmHFHRHaHRfHNHQHjHDHIHfHAHWHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e5edc6edf474ef740db992150e25c2c84bab94f6aa5e118bc8920533f71e1b36
MD5 8d6db3389948111a7a06d546497ceb9c
SHA1 46a150a87aad517a3402179d1a14be5fb1dde3c9
SHA512 8226cc3cb94161b62e887c87d1e679ba2cb1145a4554945610219fe24dca5dccc467a4d1580e6ae1e3a3fd38d1ef9ef6fa1fbda2bf05f047e3f9f292aabaa14a
SSDEEP 96:9HiHmHwH6jHEGHtHDHWHGc1HYHGdH4CHJHGnHMHGXHGmfHGIHG7HGEHGUHGDHRHx:9HiHmHwH6jHEGHtHDHWHHHYHUH4CHJH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 9f7703cec5de866cda97ab5b782b12c28085daf460af5de11657fe10dd02612d
MD5 ee7aaa0cb876143946903f0d3fff0752
SHA1 7d4ce3b9a731a5bba90a0e583790617d5746c847
SHA512 edb9116ebe2b40a94aaac686259b52e6423ad119f871e7628caf692965b866103af48d15573cfab2e68bf2fd24f1030b8a7fe621873295750b8fcd4d0989fdad
SSDEEP 384:9HiHmHFHXHDHIHfHAHBHNHoHoHQMH6jHiHBH81HQH2HHH4H6aHqHxHeH7H0HYHYZ:2v1Aq2eF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 6fb8d15555ff2b27d8ff7b05c9e20114dc60eb12a00094c541586c5d8afef4c6
MD5 56dd42ca9bcd920482318361506e2843
SHA1 c423255e9b93ab2ceb5e6d1f6e6a270831a15594
SHA512 4da55b6f413d779a2382afbd6aec66f80a7e5b850d51d0096b67c308810e2ad0a611e74c48d54c17d52045623dcbaaab6ca0b0510748094983cf695542131332
SSDEEP 384:9HiHmHFHXHDHIHfHAHWHLHNHoHoHQMH6jHiHBH81HQH2HHH4H6aHqHxHeH7HOHa1:hv1KSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 93a1cb383ab34dc07e2fcf8aeebb19f91ec896c15454e3d27bdbb7a0f7da2758
MD5 c4d7573468e78f536273a0341b60546a
SHA1 cc1edd3a9976db7c33fe6a472e1180db2c33d8a1
SHA512 1ab2295c74ff8f8a277d67ba4b5331ff6e4c453db354f52e9bfff4f163b8baa550f9ea2d30128570e58f3cee3a20a7b6c268d9ec4d19713c20a2f9cd6e7b1835
SSDEEP 192:9I7UYU9tkU2lGUWIU3UDJUu/UZoUfUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUJ:y7xDjGHIs8vhMSmL/UYdgqzYuSMUd7P4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 f65a876d34c3bf8a02025beeea4a9855dd52097a7ea2e210b27bf5230f1fc6ce
MD5 77f98277d7fc32e5643bccb0691ffc4a
SHA1 6a6b3f299e6ac9bf93c00f817ed30f9de7d09f70
SHA512 e597885373b38409a53c3eb8d3d32f01de417dc8668a24572961c5f3b7e36ca946ceace265ff1fa2bb415da83392bf2bfe87a18882f5cf05ccce53148e3af311
SSDEEP 96:RQU9ntkU2lGUXIUWJUu/UGoUcUdU6/UVhUXbdUugULowUzU90AURU5gUu0YUCDr/:mU9tkU2lGUXIUWJUu/UGoUcUdU6/U/Uy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 15732c3745ff183dec76d3d129b38890345e38c5585846eb36c2b9bf38273b37
MD5 863901d7a29d0a0b57f25bd157316d99
SHA1 1305e2d2bebf533b3f056f388a9584815071a411
SHA512 847d455cac15769120b42b5b66ece9d290c73b3ebaadef3314931a43dde3abc7b51bd1a2f6d662b397da36a996648865d95ae995e9c6d1bcea9a1061ef79374a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 c33d904fbf730c17cdbc7597a010ee25ceac8b0a2798b1b1f0eb4af4f03ac934
MD5 7b794a87ffb751bee3544143d6dccb0f
SHA1 7d05485951ae162a9580d21792c34afee26dd082
SHA512 8d9df63339e73d482b280b0366aac82fdff104de3d7f57ab1c6ffb55de82db620521dc01582ad50d6f01162fcc12456e9b9617197479e011474470c1c7e32e1f
SSDEEP 96:RQU9ntkU2lGU/IUaJUu/UxoUnUdU6/UVhUXbdUugULowUzU9AAUNU5gUu0YUCDr/:mU9tkU2lGU/IUaJUu/UxoUnUdU6/U/UC
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 3b2181e362312c7e048687020520cdaa11ec299591f9ab85df4b8b20e45cf32d
MD5 fe6a4f45a74267712d3a1906db000c23
SHA1 71121fa51e87c7cb37653cf0c3b038764e8d24c5
SHA512 ff12f19bcb562b31189cf5efe43520a919ce68004a051eff6cc106faa64013492e93aaad81cfcf218093157658b532bc9abfc69909535442676217f6c36d8e1f
SSDEEP 96:RQU9ntkU2lGU/IUaJUu/U8oUZUUdU6/UVhUXbdUugULowUzU9AAUNU5gUu0YUCDn:mU9tkU2lGU/IUaJUu/U8oUZUUdU6/U/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a1153c5cafeaaa6a94b91d7149fa0dea9980b67fad360d7706734e878218ac9d
MD5 6bdaed2e3030e0b183e90a6e58eabf2d
SHA1 a9496ccec43dbacf21fb67af067cd31e416434bc
SHA512 525ed19d6e465d9881fdf9091ebea6cc8d36b59ea81925bfe3fbf6f7c6e4197180d5952539c4ee378e4086004bfd65db24d3d4478401bca71e8f68f803b6e32f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 036528ea70a33445a5565c58244a19f5f6ac154e63d734dcec114eeabd014817
MD5 2278a6db54f3e58a1d33350e1126388d
SHA1 ad2b0fd62c66d414fa9c30ed250cca063f8cc604
SHA512 d18f00a6c210df1680a5c285d5cbf13f901c10c8ca05383a9009c47c6d68bfb6872e989fcddf77dc224bae3df7715485b4bc1769e5669bc95d63ee7130ceda16
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b9f06b4e119bd933096ccff068adfa6922fb2c7b1437eb8cba5378a80b4366e0
MD5 5a79f88471f1ef040973da299afaa530
SHA1 7af77bd6698d43be7bc1e0429685a0b0e52c23ae
SHA512 383175931c25119a6869d62802945bcaa5de367db9add513cc801d81df89f62b9e389e167b7549bbd4a1baa68ac54934fb3dbb1532d7dc33bb460877c79e6718
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 4e01658c25eb5f7c58f56427c9b4cc804b3a490d0b5290fb7f515acc11942f46
MD5 f17b3f180c1fc537d57702285df6fcab
SHA1 e959e979f95aff9aa6a266716b21d3f1ecc7c5cd
SHA512 623ca137e2227a1e8e7bb357b6852a816d9003601d79cf1270e83bb6e583f55ab81ac88d9a7d8d1413dd01fd5126d812693b42d714a6efbd91dbe1dcc191297d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 7bfaf7b35ecfaf9cc16836321697ea16186c4ccfb49356d252d002afe8440432
MD5 1b1ae80d7a25a5792e1959b87c9ffecd
SHA1 651fe87f82cb903ea45aaf0670bbf957ecb292bc
SHA512 6c2bd37cabc5de856283021756bf2b42dfa8b9b608670715fd280b84df0ca1450c01d28414281d266f9063f23a259f9bd99f1de2efd932a84e821236db0ca116
SSDEEP 96:RQU9ntkU2lGUCIU9VJUu/U8oU9EUdU6/U7hU9fbdUugULowUzU9iAU95U5gUu0YV:mU9tkU2lGUCIU9VJUu/U8oU9EUdU6/UT
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 1febd19e5271373983254f7c56f9fcb15834607273535d536e0e80050cb90837
MD5 1eecfb8d026921bbbd92827e31512eb9
SHA1 baac6d0974714d03b908cfe526c2665bd59d2708
SHA512 a71fe6edd9f5aa25471131d5b695d2ec2ff10344c701fa942c88a7f258855bffb148a31beb135ecef073e58d3c9f2402a8a9488052e595f5288ef9c40974d3ee
SSDEEP 96:RQU9ntkU2lGUqIUTJUu/UboUVUdU6/U7hU9fbdUugULowUzU9iAU95U5gUu0YUCh:mU9tkU2lGUqIUTJUu/UboUVUdU6/U1Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 fafdd164ebc1eed01465836a0a80006d44b117c36a74f47dfa12109a12c34d1c
MD5 c024132062fc6e37ebccb84fae2a75ae
SHA1 32e1893dbe3264cbfa088a0b5a289425a236fec4
SHA512 e291be35454d98d55beeada83faa26bf7d824dd35113951e0a1d47210950c5f7eb06582ef76562a29ddcaeca4ca5a97a150a0c1073330f3768c02ce51ce0b7d6
SSDEEP 96:RQU9ntkU2lGUJIUuJUu/UeoU4UdU6/UkhUqbdUugULowUzU93DAUwU5gUu0YUCDl:mU9tkU2lGUJIUuJUu/UeoU4UdU6/U0UL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 fd5ff28e27e1c75eb1a555877375d4b0c84e9fab0857195a33025642d4be4cff
MD5 75709f0de48d419d5d34fd0459c04e33
SHA1 338768e4ff0367f613792c5cb33351c4e79ae2ef
SHA512 33c27b9603033a0a6493fd805665d82786acfc7047f7ce8160d0fff71de3737ab4f31f6f56b6fd78f90512615d31c92b557304210277c3c299286648786d590b
SSDEEP 96:RQU9ntkU2lGUVIUqJUu/U4eoUMUUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCb:mU9tkU2lGUVIUqJUu/URoULUdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 57b5e4a2045751a670b12fb00a1de9eb2e740c8f843623ca89e49cfa65037573
MD5 e9c9729b1b9e2bf60f1238f6b5b5006f
SHA1 17584c83ab2c6273055e2a44825280496bf13105
SHA512 a2c800804b86be378706928769f8e41fd2c3b7156ec1e3449ff532657acfa50e3f786e2d8507f97fe8dcab5f5ac7dc01b1454759e8248d5c2ad71a422414135f
SSDEEP 96:RQU9ntkU2lGUVIUqJUu/UHoUZUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCDrj:mU9tkU2lGUVIUqJUu/UHoUZUdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 0b4225fcd0264fa7c71ca6a3b880a7b8e4757246a9663e56c72d81fabbad7869
MD5 0ff920952d29e954d4df61ab48cfc273
SHA1 04b5ed1c59eeb71512e394508a6de48356c0486e
SHA512 00920ca83ff6c5c02188bfd8814cd5db9eaaca475fb81fba8eaf0617699ffdcf3ae1c6b9d5e976038e93497abdba11346e73836a5a9a0cdc2afa2bad0c597295
SSDEEP 96:RQU9ntkU2lGUmIUBBJUu/UqoUATUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCb:mU9tkU2lGUmIUvJUu/UqoUsUdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 6e1a608c8d1298296e66ed94b49b2a161d55ffa2436ea21d36ecc4793b3d3789
MD5 e9f8897dab1c21f5efcf4b34c7c8a25b
SHA1 1b1c49e8d65bd6f0d00244d4040a3a91b2b6ed23
SHA512 91f95cf47c9a858c45fdca660a4b539dd3eb143da7ad12b7e4585a47451436fb2029efc3cb266fc4e7f8945c947a9cf879954e8b7ecf4b584d87bb82413e0390
SSDEEP 192:77UFU9tkU2lGUQIUxPUDJUu/UioUwUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudU/:77ADjGdIAP8vk7SmL/UYdgqzYuSMUd7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 7cc84fe8119dbaf24a40423f8147822106e1fdc3fb2de8ec57a83c5bcc4cf706
MD5 5b6e315e261eaeab7fb9491f1d15ff00
SHA1 a06ad03a549652929e055643bba9ecd85aa0b4f9
SHA512 cfd7d4a35b6d9c505f1e64039cb3d09b5487a5db9a48df07e94385064d3a47c71fd4ac6480f6c5fd5d56c878351d3161b201e0e2cdff6f60d43ec705e015c3de
SSDEEP 192:L7UxU9UzU8UdkU2lGUwIUGUvJUu/U8oUdUBUnU6/U/UrdUugULzUzU9bUNUc0ULG:L7shzhnjGVIlcv+mSmL/UYdgqzYuSMUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a526f79c9f7e21d2a43b2d526eea6e156e020c42902a3d9d187fd5b485cbf855
MD5 92336e584060bf6abc6bb0c7059f1104
SHA1 86dd20923d671fd0c5777aa7a82e31a0acae8908
SHA512 d273ca8148f21c69fbbf316db0be4321c235585ce77914a662fc52a9c169ac749fa9540650fced7b7a8cb582789f46e45f3ff4d5b33385bac633527922542f32
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 6c2b39a9657fedbe29271d82348bfd975c542f67d01bd4d3d4a009d71891fd31
MD5 d6ad786b02f0375f8604f339eeb4b8d1
SHA1 1b4ceda53dc1f864970c924121e358a1811c39b6
SHA512 ef1f6ba29f4758a457ef8348dfeac906a586f1b374df6eaf11a0de2b80be133c80ea182366c590d0866f0170fba22288b841decb6a4c75126df6539458df1a73
SSDEEP 192:L7UxU9/zUZUdkU2lGUwIUGUvJUu/UVoUwUBUnU6/U/UrdUugULzUzU9bUNUc0ULG:L7sCzonjGVIlcvpPSmL/UYdgqzYuSMUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 fbe227f558ca1f5d830825a73766fe8bbda2da3eeea690d3cf9cd8b92db8ea60
MD5 60431a75437d3d4091682fff80d4f91a
SHA1 f6c4fbd6a6096b678f15112942b7576992d78bf6
SHA512 c7afb2c502e48718617535fd77d512d64f47be395f7df216f20248e0f6ff40510bfc139fe5da1b683def601dfc98118f350ecda61651a1b322831022dabaadd1
SSDEEP 96:RQU9ntkU2lGUMdIUBpJUu/UKoUrQUdU6/U7hU9fbdUugULowUzU9iAU95U5gUu0k:mU9tkU2lGUSIUXJUu/UKoUrQUdU6/U11
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 11827a69374225d83c98995f0ecf81b5e7871bbf282487332f29092327ea6d9b
MD5 a21cbacdf7cfab72752922792a16dac3
SHA1 e689f460c615e4c4b8a29009779b8e25dbc90e8b
SHA512 e3a461a52ceba3ab6c42c75beff9f9af4e094c77c47ed134125721e677d8862f313e4ef6ec0540b9e0ca22e1ac761fa5713abf2c491e44916efce71c3c704e36
SSDEEP 96:RQU9ntkU2lGUmIUVBJUu/UKoUgTUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCb:mU9tkU2lGUmIU7JUu/UKoUMUdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 ac1e9f6dfd5e53818366555bf8be16af1e7bf084cb5e8de45a9a1c073c843859
MD5 bf57c1c68f0247b9f882f64686d23a35
SHA1 9f5ee2e7fcb78b84fcf1d8a4ce579efcd06ac10e
SHA512 2124bf82e949f1674551c360102f2709e6a9886497e3f2c53735aa4a0ae3dec2b80db7ab0570f8e32ad598150d2f5da56f36271e30a3d6b5ea8f987304b05bb3
SSDEEP 96:RQU9ntkU2lGUYIUNJUu/UfoUNUdU6/UdhUbbdUugULowUzU9AAUlU5gUu0YUCDrv:mU9tkU2lGUYIUNJUu/UfoUNUdU6/U3Uq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 acfdf97ad61b6d10d8f0427cb16901fac1f82c659751647d11efc2f825709287
MD5 fb16617e233fcf52c2cec2c554a10402
SHA1 9f41c749e0bc6f62de9030718af72677197d2cb2
SHA512 ce28a99a3f5e8e551997f65a15b315f534c721fba67c738b3725be494f938a24bf0c6aee4e5cb733d032f7eb60660a2e9915b67c433a3fdc8ec359b304aefb85
SSDEEP 192:X7U1U9/zUoUBUckU2lGUwIUGUvJUu/UVoUwUBUnU6/U/UrdUugULzUzU9bUNUc0S:X7kCzh8ujGVIlcvpPSmL/UYdgqzYuSMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 84e9812fd90c45471dd9bce7570763892380c2ec5b918ff188fecb9190268391
MD5 33268e518dfd8a4e390f3a9144acc9a4
SHA1 23b9231ac422c36c11685738e6b5e8d323c40036
SHA512 b0783a58312db3b69a473f4ca03390a3a123bfeac6e041e08e06047d9779dffdc4c9788e0d2215d081d16b63b4030fec871d4a78b02816f8c435249ce4e428f9
SSDEEP 192:2Y7UHU9/zUoUBUckU2lGUwIUGUvJUu/UVoUwUBUnU6/U/UrdUugULzUzU9bUNUcr:F7uCzh8ujGVIlcvpPSmL/UYdgqzYuSMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 6a6c805f207ff3f86b4fb52ab55371e26724d57d80cbd9c87a58f8e5931c6773
MD5 fb97d7ac9df3e9f9e6d08d99df12c811
SHA1 435504a0d0c794b5ce5c978cf176ec6a25b0792c
SHA512 d97db81414cf9149f4466149566827ce2773298d76a696813b1e46bcc0cf939c3db75188ef162b068b408627ddf6922d9495a51d98476e3b9b3b1c8dafcf6204
SSDEEP 96:RQU9ntkU2lGUmIUBBJUu/UaoUQTUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCb:mU9tkU2lGUmIUvJUu/UaoUcUdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 ad867738d3d827d3682ae050a42471cfa8da74e8ed864dc836950d62f46a4382
MD5 5320230c7ec23853573f3a584aa4248b
SHA1 dbdbff034d8351d44c8cb059954543f24099a421
SHA512 6d26bb21d3180c2355d8e412bc0c6d24837c6763dc98ae9fe0ec92aec220c4f3654de76576e771a92df03ef37370233198488fb0a3df132128c6ee578d56b099
SSDEEP 192:B7UbU9tkU2lGU1IU3UvJUu/UNoUAUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:B7uDjGgIAcvZPSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 7a5cb8b199f9805665b6e97534edbb4f45f2747c42e8f97f932f4b65f74f7d8f
MD5 3169f075ba402df49c442247f61d30b3
SHA1 f61dcaacdf26c8cdf3db2412bc0b171ae6d5c753
SHA512 5a71baeab4cd742873eefac4e07ab8e3f664449f5d56d5af167b84a91fe9f9a6acd1228286833d3fec7e7d1a72b6e4611cb0607015ebd4694700d7dd4973ff94
SSDEEP 96:RQU9ntkU2lGUEIUfJUu/UhoUDUdU6/UdhUxbdUugULowUzU93DAUwU5gUu0YUCDf:mU9tkU2lGUEIUfJUu/UhoUDUdU6/U3Ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 01231e6aadabbe2201876573dac7c16f162611745f8402464f047338a591257e
MD5 5de2769c9c86dc7244f58067b31e34e0
SHA1 bea303e2424656fa60f81465cf59e8da7b863c72
SHA512 87a950234ed64f0b0b314963239fae4122fd6a1b8108d2e192256af520af71db07dd85ead2c3ff2dd6866bd4b5252096f8483fce1957c674abc832f39eda8a26
SSDEEP 96:RQU9ntkU2lGUxIU2BJUu/UCoUITUdU6/UdhUxbdUugULowUzU96AUgUU5gUu0YU2:mU9tkU2lGUxIUoJUu/UCoUUUdU6/U3UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 a53138b63ef342fcd88edf107e14b582ac0ad6c70be0f3739a3f2ee43c43b80a
MD5 d3ffbb76608da2d9d21c6eb29a1822fe
SHA1 de5f9ed08b2667da7edce91826606247577bd5d2
SHA512 206fd21531c1e9ada14b145f49b39d6b91d64bc1dbf2c36af377fdea4ffe6ecb94bb1abd41bdcfa04cc375aec4179811c5ae2f5df9f52c2afbf658d409603174
SSDEEP 96:RQU9ntkU2lGUpIUMJUu/UooUZ0ZUdU6/UdhUbbdUugULowUzU9ZAUiU5gUu0YUCX:mU9tkU2lGUpIUMJUu/UooU6ZUdU6/U3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 5a7db7a0821f55a68c78cfff0970227378b2f48dddc0c50e220cd0b55922cd71
MD5 552caa67bda9b687656d077e2f15fac7
SHA1 e45dac91f9e269b9419b5b36a6ddf241a3b0f7d8
SHA512 0461ffc114ab56c97e3a8d13d2b7b20ee974699905fc1c0db8823ffe782c43744b69dcb64503c8f2ecf0d392ab764edb52bff2ba9991c614992b5e5bdd87f593
SSDEEP 192:3Y7UmU9/zUoUBUckU2lGUwIUGUvJUu/UVoUwUBUnU6/U/UrdUugULzUzU9bUNUcr:I7HCzh8ujGVIlcvpPSmL/UYdgqzYuSMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 1823e54d1d02c97ccceae8f38ec341f0cf94363037b83eecdcf760b8b3f5b67f
MD5 c4de32cf00559177c0ee68c92388f279
SHA1 275f1d8b30a8336057dc3f732ab67d0c5b7b6ebd
SHA512 e6d91d01073d763a358ef296e4ef331dddcd1ae50831d0bc2cf075534795da8bf063118f6124c9ba849c3d923b01216f8a8e93a81fe0006d84777de82c0edcba
SSDEEP 96:RQU9ntkU2lGUZIUkJUu/UeoUkUdU6/UdhUxbdUugULowUzU96AUgUU5gUu0YUCDf:mU9tkU2lGUZIUkJUu/UeoUkUdU6/U3UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 1838874a91e894abc1322e17dc47d5299e0de0e952aab6793f2107bd86d1d6b7
MD5 b0e353cf561a5c9b79dfb95727cf01e9
SHA1 1af65b7e1994a112538931b313bff2b3f3c34926
SHA512 9d33b39118a6b5d6dbb1631eb73144a0a982fb4ebd1c2dcaec8ce8f70a301feee63ddb050875e95eeeea48aa5350ebb1580f6193a244d6135f6d28a1d1b0ec0f
SSDEEP 96:RQU9ntkU2lGUmIUVBJUu/UIoUiTUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCb:mU9tkU2lGUmIU7JUu/UIoU6UdU6/U3UY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 676d461f57f4be7b5acfcac08b916f57c1f75a048dd3da4e857814fcc4e570d3
MD5 56d2ca11fbf02344bf3d01823e44ad10
SHA1 b341130563b5309e03d4d24244174596b9c89543
SHA512 455c67f54de6affeacf2373216e0c8b93252c29ae299873542da84bf7a3a7e07e4bc4a0fa470283b0364ea415dda65e2beb4e8a8c397689b9ca9a24eac0c0041
SSDEEP 192:77UFU9tkU2lGU0IU1UvJUu/UEoUNUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:77ADjGJI6cvi+SmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 38c8200f6347a9a80fd3b0d910bc135479d16905fbed769dad23c390525317af
MD5 c7d3139086d46ed5d393f6309b453412
SHA1 95113a42449eafe9d392c22479b770a9a2424344
SHA512 59d19e018dc1927cadff5139cf93c65966a1cd920532b351d1b7dbb7e9540780ed4b7fe42848a17da99002b729f751ac7aab597df92e53a3c6ea449fd64e967e
SSDEEP 96:RQU9ntkU2lGUZIUkJUu/UPoU9UdU6/UdhUxbdUugULowUzU96AUgUU5gUu0YUCDf:mU9tkU2lGUZIUkJUu/UPoU9UdU6/U3UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 5946c8fd19e7a0dd3a5e0d9b6b0e82ef5abc5637f33bda9ef02fc3214dd812f8
MD5 f42a032ca528bd2883c9ea5aa2027420
SHA1 cf0fccdd7f4e1c97b6fc014ca7740f3b46ab44a2
SHA512 3d3541aeae72a1d5cedc1c3b9c8e294d427c3c85be3f75846900484ba02cab9063cd8254fe218727dafb49508bf3671fb7670ec6997176c27fd951cc6beaafe3
SSDEEP 192:B7UbU9tkU2lGUGIUUUvJUu/UloU8UBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:B7uDjGrITcvxHSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 afd14bb36521265e1698f06d290bb8ab32dbf68d1bd37f2d26b98dbebee5bc2b
MD5 fabaa226c4e604b6d1ddc4ee6553c99b
SHA1 318e83e6cddbe394e2ce92bd061aab1321e80472
SHA512 dd19cca1eae31e61cbf4db1e698ce0269b93e78ac64a4d1d5833aec7d50f04676bdda652d61180987460601a179cb950a1d62eb5c8ed6841ed6bc9067e4e0c4b
SSDEEP 96:RQU9ntkU2lGUeIUDJUu/U5oU/UdU6/UdhUxbdUugULowUzU96AUgUU5gUu0YUCDf:mU9tkU2lGUeIUDJUu/U5oU/UdU6/U3UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 1521ed2e2121d72ac3ea43e00a0fed4b0cb8e6a5c8a53c16bc1ecc8aef137064
MD5 506830696f73268da328d52d05361627
SHA1 e04f097a8e18e1e5b96f954b62b14873c5cf5382
SHA512 d44df8eb5838dd1ad3c03a831e8a1b6d4c59f5bc9bfc34f4463e2218f6603b0ccd38ec4c038151b1e8b08882060c54ec2464a83355c9df3fa7628a1b620061f7
SSDEEP 192:77UFU9tkU2lGU0IU1UvJUu/UloUzUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:77ADjGJI6cvpcSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 7da5e1ac7ddcdd0de14a89ea5d23c1d96c87dfd9b8b6355c6ab0273dbad3b56a
MD5 89b55bd41c1382f01a6fa11e79ac91be
SHA1 8f59a2b121556cae07f1ef8461f3ae792b0db9ea
SHA512 fef60fa4cea6343e93ae537a329a23558b05a63ea8e4213037fe53d46e38f7c7db3f9e567896485354fe3f9d92ef109a6d60e8e2a9cdcf92b96b9e953dce5921
SSDEEP 96:RQU9ntkU2lGUZIU8JUu/UsPoUgUdU6/UVhUXbdUugULowUzU90AURU5gUu0YUCDz:mU9tkU2lGUZIU8JUu/UsPoUgUdU6/U/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 c2a0463484f4efb5b6f54d039cd8d5ce184417600eab42335fa4a48bc3f3c37f
MD5 d6d2e536f630aaa353c2184d6fc8346d
SHA1 91b44b686544250d5fc4a6a96dd9352e480a6195
SHA512 d9e8a8d09047f4f97c6f928ce04a9ab463ce0d6e1e4cba3e84c3723c12a59aacb6da98c26a88b26a183f1c1434286d7bd6340f5d68ac42d764441019aed6a28f
SSDEEP 96:RQU9ntkU2lGUOIUfJUu/UsoUSUdU6/UdhUbbdUugULowUzU9AAUlU5gUu0YUCDrv:mU9tkU2lGUOIUfJUu/UsoUSUdU6/U3Uq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 b0ac4a8581dcbfa746fd00d82be34f9362b85d800bd3e9d35578b9e1eec034f6
MD5 eccff9f4c3bf7b6947d8a1574c8819e9
SHA1 3732a27efe2beaa3e9b8c00437dc17b17baeaced
SHA512 979306c8bc1a85c60e74ce46bdcdff7ad435af679093edb7eed9306f114cf2b37175268f7724cc19da8cce42eaf4108de0e2610d8fc385108060f963932a753a
SSDEEP 192:d7UPU9tkU2lGUzIUZUvJUu/UkoU9UBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:d76DjGOI+cvCGSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 cf173167de4ed1b22b3e883a86df6d8f7c78fb00f4908fbfd2b194471a99c41b
MD5 f058fef5094d1955442459a703513b13
SHA1 f3cded2f49b4b010dc16695a5111d388d910de3d
SHA512 9f15bea46838fcebcd46c0578064f800f1190f11eaa1a1992f3d41fd4d0550a1bca6ae5f45a8c4b12c499286587927a6dc46c71863db0918cf808b73bc9757e2
SSDEEP 192:I7U2U9tkU2lGUrIURUvJUu/UNoUUUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:I7bDjGKIKcvBPSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 dfe22216c11c89baeb33c978c4df79fa80267fc280d69ddd699a9a6556b910d1
MD5 cd81982fe0eba9e88b5bd940b8f74bd7
SHA1 d9c721311bb81e8591e8a036b5ebedc8d54c829f
SHA512 9f63598cef58721c2548994d4eae698b0cafd2b419ab1cd24280db72c62ff54f50166e34235c00ce6e3d67da1409ac3ef71e9a27d0477fdc12b8c3a5ce954f05
SSDEEP 192:77UFU9tkU2lGUrIURUvJUu/UXoUCUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:77ADjGKIKcvXhSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 44217c02965f7defc1a8616b920af4703a1f128e39e32ea9f1a0b1052ada894b
MD5 e897037065d8d71486a5dfdfa0f6a8e7
SHA1 0641af74d107b52d640bb170e916d3c52deb36ef
SHA512 bd6d1ecafe3b679013db66cacbfa41cacaa69d80708b85ce5b9ad59169ebfca2dbaa32fa60ca1dd509095673b416067011139c803ea363f299e0061c09de4fe1
SSDEEP 96:RQU9ntkU2lGUXIUWJUu/UboURUdU6/UVhUXbdUugULowUzU90AURU5gUu0YUCDr/:mU9tkU2lGUXIUWJUu/UboURUdU6/U/Uy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 49f83f46e1fb3e6900f2263f761d15c46a05654b0ef41ef883469e47ec398ed6
MD5 42c0a9fbb8c41739536f154160438126
SHA1 cacefad9acc06849ed0025b69e72011de8bb2c97
SHA512 1d62f82787ce06780096dad5403ff5befa78c27375cc385630375ea42da95b82b60767460553d7e101de43375bbcfd31349ff1e4cf59d715fb610441e956349e
SSDEEP 96:RQU9ntkU2lGU12IUDJUu/UkoUuUdU6/UdhUxbdUugULowUzU9yAU9U5gUu0YUCDf:mU9tkU2lGU12IUDJUu/UkoUuUdU6/U31
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 f2761359cd65b3c0ae0aa45a74b5194f5b36427e13957843e571676be8fae242
MD5 3da328fe0db055cad13493a37402c7b1
SHA1 baab31949679ac5ebbce2535f5e981402674a277
SHA512 d5b244d2a642b9b7070530bea0d53ac5b5d192543bc201a736e2cadcdd80d6fcfe4f9800227c0923225840ba0fb4480a35e0d29dc408ebeea7997669ade0eb55
SSDEEP 96:RQU9ntkU2lGUYIUNJUu/UHoU1bUdU6/UdhUbbdUugULowUzU9ZAUiU5gUu0YUCDz:mU9tkU2lGUYIUNJUu/UHoUFUdU6/U3UA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 f12cc289bbc556c1c56ea82b0b48264d289f6a94e0a9f0acd142f1198bb50465
MD5 20c2186cbfcff1e512b61d8bb97d40aa
SHA1 1f9c4889357620ddc27d5b9682520227b5677f61
SHA512 d21de58116bffe2f56ba77d8fcf8f94120dc0cea0920f3270a588b9a647ca7e25b115899b819a64ae96fb59aa5b1379e7d0c326f7da7a3e9a72e5681b0a87ee7
SSDEEP 192:b7URU9tkU2lGUWIU3UDJUu/UsoUSUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCg:b7kDjGHIs8vOdSmL/UYdgqzYuSMUd7P4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 b8534cdd110938e8c5f01176a03e073076de07e83666490341a39353d88dea35
MD5 cae0e82e1e5f5e9bddad947dbb3888df
SHA1 54a746b186419de4bb914f9485fd7fac006cc8a8
SHA512 30288c86226ca0ad8a37ec64e531fee1b28536bc61381199389f85dae7c8aa3e35deb9073d5bd3032958facc9b4b9b05ebd846f1442b9cd9d50e34666e66b5a6
SSDEEP 192:B7UbU9tkU2lGUGIUUUvJUu/UPoU+UBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:B7uDjGrITcvfhSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 521f6b21e7ca76524415a6345efb994057e13bb602dd84510815381d7d9bec04
MD5 916f8d79505f6ce6f02bf0693f522a4f
SHA1 dd0e11e9e4c1c72f538f87e6ef139d1e0b443e95
SHA512 68bb783335b64e0a8b70a221871fce55350b4b64aef717289ab369a0d804df268d1af77be7e89d4e90c40b57699a245d039f4fcd775cda70d281aebfa4a18f86
SSDEEP 96:RQU9ntkU2lGUZIU8JUu/UtoULUdU6/UVhUXbdUugULowUzU9ZAUiU5gUu0YUCDr/:mU9tkU2lGUZIU8JUu/UtoULUdU6/U/UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 a88bf79b896eecc31abd3fe5f9b8818ebf82ccb000c1fad086334195acc100f0
MD5 e5a80433005a68547b0b9602aa489d03
SHA1 d077f52d1e44cb98203c88990019ea3a38e516f4
SHA512 b5ca1e40c2a18d39ae51768d007e5182d88112dd17079f4cb075bc9695806033ca54d1e151e360a9474b53220223559f8b15cabc98685980440bf3db2329a48e
SSDEEP 192:G7UwU9tkU2lGUfIUdUvJUu/UnoUtoUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUT:G7pDjG2Imcv/SoSmL/UYdgqzYuSMUd7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 d5b6f83689db47d42f3f6419e76ac5baa6a0c605b802dda6358eb35336c9aeae
MD5 65c2966fd4f46e354feace241e16cd16
SHA1 e626572c62f3ec99450fce8e19a8fba00276cf1d
SHA512 03c42bcce56771297b506cdddc6388b14b6fc233ac973ac602c6f922ccdc1558d8b1379792b551c80ccae4b0aa175a243b4324c78b3f4eeaacaf3cdf0d311733
SSDEEP 192:C7UwU9tkU2lGUzIUZUvJUu/UloUYUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:C7xDjGOI+cv1nSmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 8248990d656cad1af4761f813cb5502e94e1902093f20a15d9959efee86fd39e
MD5 ec1d8c34bbcf1ac6403542cdf59935da
SHA1 e0d2ebf5a103cc8e643a26b041d43e5f24e5b12c
SHA512 efdf8b23a0242988a74b4eeab31ce1c96b83205de1549b031ff23d6f1706e128e24cd6c103a0bccf34ef45d6837809b7ce4fff8e4f8699bc5fcd3600b1157ab8
SSDEEP 192:G7UwU9tkU2lGUfIUdUvJUu/UwoUZUBUnU6/U/UrdUugULzUzU9bUNUc0ULUudUCW:G7pDjG2ImcvWySmL/UYdgqzYuSMUd7Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 8d1c4ee3cdbf8c5682a72a6ab63d8f1dae26ae779137b06ed35e2a9e15001447
MD5 f6fb9ab238ded2df88234039d1274417
SHA1 af577cc6d55405ae5971a16aa523bb115ab04659
SHA512 4fb6cafc4ee1b645532d2165523b3e7072f54637c668373946a1d09e998660f93c199186bbae6c21b7435a26653ae1767d8accb4891f6d5038d06c7b9989564a
SSDEEP 192:HFc2kJHVcmq/E8aJG8Zyh+F0P0u614ZP+tjEsXtScR:HFcHVS/g5yqmB614gtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 0d1abe7468d472c6c360bba7b6e195e0365d0e5f418c5b9cbb7726247ab09df2
MD5 50209901b0ee116525fabbf9cc68be04
SHA1 badd8727bb27296d733624c73cd75019c5a5299b
SHA512 a500e72b4787b02f279df48e69e4519d1b8a32bd41c11fee0268855b396d3c689533d8ef19bd9fd7558d50a43a5dae11a5020c5090d4a4f2af019a9ef5d681e3
SSDEEP 192:H7c2kJHVcmq/E8aJG86yh+F0Pi14ZP5tjEsXtScR:H7cHVS/gayqmi14HtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 6428a855162f8f1ae27edd6a5cbcbf8a4dbbb540529c126027e805704338d98f
MD5 201a88b706de5dd74e1c4c62b83753da
SHA1 9164aa870b2bc1daf1ec7ffccedf0ad469c49c04
SHA512 6a4068a6b5dea18d1a8a4af019aad0fd1bc36dea9e06bc768f94fb9c78101d7777033d9882885b62a9e72e8bf1ba604a1065dd3903981035a65c3d78feb623c4
SSDEEP 192:nFc2kJHvcmq/E8aJG84yWE+FuZPbBmzDo14ZP+tjEsXtScR:nFcHvS/gYyWzuBbsPo14gtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 88597d7c61b2f4a3c9421513de6210d872e073dd34853c9693b8bac95bb10304
MD5 d422518021df9b378ddb1be6a794d41b
SHA1 bd6bba4acddda616534f3ec8ca2a4b8af21bfc44
SHA512 d21865b34cd2e7bac9589765487bc9497974e64c7b3f1e37635cb18f9958c6f755d4562e36d1f335aeab9c9e490ce17d6c9d67fccaebdb9e712430458dfd53ec
SSDEEP 192:HnVcmq/E8aJG8syh+FCa14ZP5tjEsXtScR:HnVS/gMyqN14HtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 97221c6364076cbb425d666bf931a0c36cbf79b7e3865fcd9efa8a7fb4ebd099
MD5 0acd8e7714baa750b2a83c022b03e80f
SHA1 e151f7c019f15139a248d5aa17ee602236d588cc
SHA512 4c75a096c6c6e4d7fc8a5b8119ccd7a39ca4fd4270128ffc1fd5f190bce80a827d7d261fa690796ac68f0a4a97b13ed1937649dde5dbf8c4c5b42c901ba845c1
SSDEEP 192:cFc2kJHvcmq/E8aJG8pyh+FDDZDD14ZP+tjEsXtScR:cFcHvS/gJyq3BD14gtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 a12d32497a89614bfed8c514868666f2cc28d4148838ca1ae6107afba5750746
MD5 921b0f5b4e8cc69f18b7ee44621be67a
SHA1 af5c5e3f7120cf7a4a8a2e0b5a493bce32b6031e
SHA512 7b90e50b901c2b2b8d415b0b9c1d1bbb3e10cd01d26ca5441adf05d046415474de15806544b53e2c1cc79caac203500da4e4ee9e50a173b7fb25f1192abc72f5
SSDEEP 192:HFc2kJHvcmq/E8aJG8Zyh+F0PGQ214ZP+tjEsXtScR:HFcHvS/g5yqmx214gtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 6c3cec0fdf0cf5b2fde0b9bc5aec2b0f003e54e1bd4cb6a715e19f34dcf4e51c
MD5 50f501cd29eacad2b4344092ae057527
SHA1 274226b45184450ecd52dc694f497fdfc9c041ad
SHA512 21f7e9a5a38964254615781757a9835a9338178ee01837af39a52b5a2eb8577d5dc6a1afec24e8cbcee62c1d0b4d30885ef2215d9bee9e32e249ebf6a41e9a03
SSDEEP 384:Vx1VLPLeCAXlj1kXqKf/pUZNCgVLH2Hf94hrU8MHGkvcjHs:VrVLPLXqlj1kXqKf/pUZNCgVLH2HfGhS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 53785f1ac339f560ef0c8010b62dde649ff7925b64b96fbfb8aebde76ca979f3
MD5 e5ff411397d53e7a55113905f534888e
SHA1 e036d05727319f3de9513916df1fbe8d246180c8
SHA512 a69bedaef1107b6cd4662b6aa85395260a13675e333e73e0d74f60a70d117830eb0291d5dc36cbcd2ee8102e3fd244d9b19e0128fafca4779f64d26367429f25
SSDEEP 6144:uKZ5IZXqXHjTdCP3y/7QYRPILxZnhLMJjX0EeGzY2rLD:TsqlGS7Q5fnReEFsLLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 e2a39325b3b2da16602c4a9bf29b1dc96bd66969b446ef26c122a6f8f2db7b58
MD5 05ca9434d30f15cda1bbb8e77a4bbfe0
SHA1 56d474801aa9502c334e1994963ff7a613517af9
SHA512 ab1ae797b4be579867abde855a6cf8c5839d52d21a13440ec9a317692b6efbdd5efdce2c38070cb904d4477418531cce4a0df852c037a8f4af7d85417ea316ad
SSDEEP 6144:48ilamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:Di9OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 f2b2c2e061042dc7cb9d9acc4a4aabe38b1a60c7ed83f509c10b3a664d0cf242
MD5 e3bf301fc54d7016cb6a46fddbb7ef4c
SHA1 5555d802d156387455670850c68831161a80a31c
SHA512 9f8731d40734c2466ba72dd48a22e159ca3fe9be75a37c80c4288193d1b7203e7b6d385e190c6f45a578fb577791416d1b586790bc42966e8becf45948e7cc7e
SSDEEP 6144:4nARoESlamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:eUoV9OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 60a0952fd3eb052417baa21a710a4514e757d13076f720e3a6dce229f1594e73
MD5 950d7eac3c73f421d3bc1a6fe5a64a04
SHA1 68430cda972baa6e3d6f8a835a9c44cd00298ae8
SHA512 82293ec4c486d9d7dcc518870ffcf4c9a1d0563e5c2825d3e463033f37a9d7642bdd002167d18ec84904f670a8fcf282525416743a1f0fb3359cc3fb3beacba6
SSDEEP 6144:48SlamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:09OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 7f19382ffe787b8522835b056ed5cfcbb21aac29b1d0d5cbb52c2234d11db4ee
MD5 b8f437bf16789e047026d11231ae097f
SHA1 156a7ef68e25aee7749052059df4caf3d7ba9c46
SHA512 ff8e1a755670e975e1587c95df9875993ae3feacfbd978d7af649a4574a7a8dcdafb5cca8b94e0b50a96df5523db6812ad24bac934da571deaa53623627da7b3
SSDEEP 6144:4/SlamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:z9OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 11bb7ec01838f696d99c01fa612e383f6f5337f9729e87d522be0d2aad7409af
MD5 e2f2b42d990ae8188585afd0e6268284
SHA1 3d41e0f8a91a9e05bbf9b82b7045360f50f0ee3e
SHA512 c00a2333d337d392b26674f19cc58a742a471292e6365bc5e2e3aab607127aa34b876deb28aae29df0fa183dd39399597d312322d44843da7ba1ea2aa1cf9298
SSDEEP 6144:4NSlamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:x9OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 4ad2348a055ceb4183f1f2573a26bbbefb8e49a0814b79678dac0703e6660376
MD5 1b20fa5b092319fd991f0a71abe2a29b
SHA1 f558f5b56bd8d48660a6df48ae9b4bc75bbf8441
SHA512 75c7cbbafcfd8db87edc0d7c9541375fe5e233aa2a0471cb66e5f443505ff126af02051c815784abeab0a67f2c90ffebb8f92c94de66f01058518020bd5c5704
SSDEEP 6144:4SSlamLOGrJZiwb2Z5IZXqXHjTdCP3y/f:69OuJA46sqlGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 111KB
SHA256 0fb549478f4e34bd9831d1eb188538975bd897baeccce21ae0e6b3d84918d300
MD5 f6362a7adcc17b5a10c3d31e8d8bb51d
SHA1 a9a31750e475a266c1c8828c63763cb2468a1135
SHA512 88ac6890a4cce4aa1254ca6cf0166153c133f3e713517c89cb80773ea7a78994a525bbdfc6e613797404a24b4e9cfb5e723b3c4255551822c64e69a614517540
SSDEEP 384:L1ifxEQecf33HBvHlgapGy4GfHNLWpD/owqErEicNRsJiZ4f/JzMHOGAbrMpRru/:yiQe+B0DVcQWs0vfrpldFsGKPa5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 108KB
SHA256 77520185257f64096d15464a7b440f8431108361b0e402c2b00514795b13f9b8
MD5 ed089e976e33be591a1e0f470e139bef
SHA1 0cbe13e1daf8b37fabffa784b1b23692aa694364
SHA512 ad6263be3e38a202d27d242cb26bff414cc6decc40dd06e813e524312880f6067293b5a1c8be69651c1e34151bf66e421158c65d6c38e2e8482f6e20b959ed94
SSDEEP 384:d1ifxEQecf33HBv1gapGy4GfHNLWpDjqErEicNRsJiZ4f/JzMHOGAbrMpRrumN1n:kiQeWB0vVrQWs01frp9dFsGKPa58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 93KB
SHA256 ede11e0513e87f134060effa7f3372a4cad70f0baf8de11d252b28e8017d0acc
MD5 c60ab2a77e519597b886fc3a3794aa17
SHA1 2f68eb37724311a4b486150685ddc3b0799e5d4c
SHA512 50f82c9bacd2ab7e28ce0c75d76977a296692ca444d9bba7effd84bac863046a4a92e045743142b36a357f99bf477774bf6bce54185d4a839a4e31d8b86605c5
SSDEEP 384:X1ifxEQecf33HBvYGy4GfHNLWpDjqErEdNRsJiZ1/JwGAbGRruN1Pgc6H5Ntz0Z6:2iQeX0vpQWs0rBp0fFsGKua50
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 95KB
SHA256 d5e6854f0606005b273d7f5a509e943cb60f0c1c9afd2b7b8ca3a4b5073dbe4d
MD5 4169dcd493076285dd90f680025ac120
SHA1 269b0d7c72c04f62c1cbb207326380aa9ad97d3c
SHA512 8583fdfbbbb96ecf0d88565c9b1dd61790de4273ae16f6351bca58026a37432123d7b35e873d429740c1a55d398b0a39fe5e7b1d3ada18b89a9b6830cbe188fe
SSDEEP 384:s1ifxEQecf33HBv6pGy4GfHNLWpDjqErEdNRsJiZ1/JzMOGAbGRruN1Pgc6125NG:tiQer0vcwQWs0rWp0fFsGKua5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 101KB
SHA256 b2d0c83e84eac4e74c3fbc3c0313634f7aed599b1b038930cdb2a3dc6c155257
MD5 e0c50b9aeb7bdf441930b72e79826959
SHA1 a04885aa0948bec825cff18e00d611b819039629
SHA512 b8cc44b808104377ab44ce428a0b6ba5a9489f5718ab9fac77089cc16b7734761d69a1ffc7f3eb189a7df8b0484aec0ffa4d0d08a7f79313b0c379a477692ce8
SSDEEP 384:61ifxEQecf33HBv6pGy4GfHNLWpDjqErEicNRsJiZ1/JzMHOGAbmpRruN1Pgc617:biQer0vACQWs0rZp9VFsGKua52
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 110KB
SHA256 2171aac07ac275698d1054dac4c29992d007af2621451ee147262948110eb86e
MD5 cf24562abab5f6abc84fd55f4eec73e7
SHA1 41ba99863ee4afa6031601e60b27ccabe5f403ab
SHA512 eed0ba783a4e2b9701acb670953a61e40f87a95474a38cdd5c1c6cad4b5a3283fcfe391f22f001e9c914824914a895cfdb1e2e617a8596b95a24efc2a3a0df85
SSDEEP 384:YN1ifxEQecf33HBvHlgapGy4GfHNLWpD/owqErEicNRsJiZ4f/JzMHOGAbrMpRr0:Y0iQe+B0DVrQWs0vfrpldFsGKPa55
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5811ae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5811ae.TMP
Size 88KB
SHA256 2779268d90aec87943d7cac4401c5449a71780bb75960266dc947beb4fd2d3fa
MD5 6334c7f591ec2f76f38ae32d6c17d570
SHA1 b5584313adcf3f46406c9df6c887e2dc2cb03cf3
SHA512 1b62ea161ed3ef97c51e03db724b35b53a000d6158e50a34a55e7b8630c445be6b6c4d83655b02bec1a65ee9bbd9791af744aa9d3778ba9249fe463b3d5dd181
SSDEEP 384:l1ifxEQecf33HBvYGy4GfHNLWpDjqErEdssJiZ1/JwGAbGRruN1PgQH5Ntz6aXNq:MiQeX0v4WJBp0fFsGKua5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

938199ca646378b696716037afc964ba

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\938199ca646378b696716037afc964ba
Size 5.7MB
SHA256 2acc3e0879e4a71a6b08e2d6af7b238198d2eda73518b9394d82d00b010c9d7e
MD5 938199ca646378b696716037afc964ba
SHA1 2d865bfeccf3badef2f64e5d6453e6ab71d5f5a7
SHA512 1a37727c5dfaffa3023845592b400acc226face537176064698b8415d79284b6276fe68bf0e5870dc8898a846f923bd95eaac1d185613759ad6ca1068456b322
SSDEEP 98304:/gvtZLOEVA+Wg9S5S6biBgjKzK4LrJgrWteDRCZGFy8JsuWb:A7KEKnm9K8grTCMywsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 796094.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 796094.crdownload
Size 5.3MB
SHA256 c89eda2b48317bd4da398d59213d86afa0c06034cab5e3ea5df5865e369d2a0f
MD5 f8abc05327115c321307efaf662498bb
SHA1 4d848adb9b0a5b278f97f75fa125145dcbffd572
SHA512 a6b70331ad553645cd82edc5f6bfa50b4bb16bfc2443469c7eb1ff79e6b4a246cfd7de0691da400777651529a2bca20311645a763dffbf7e10cc4334ab074ae4
SSDEEP 98304:UQviMiwd+WcstpBagkqJE6KFgKqkMnb18/KCmJxNE0iWu2oC:/F++7nKgfNCyEvWcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3904-1622-0x00007FFD7F180000-0x00007FFD7F190000-memory.dmp

Download

memory/3904-1642-0x00007FFD7E380000-0x00007FFD7E38E000-memory.dmp

Download

memory/3904-1624-0x00007FFD7F1A0000-0x00007FFD7F1B0000-memory.dmp

Download

memory/3904-1610-0x00007FFD7F3B0000-0x00007FFD7F3C0000-memory.dmp

Download

memory/3904-1646-0x00007FFD7D400000-0x00007FFD7D410000-memory.dmp

Download

memory/3904-1611-0x00007FFD7F3B0000-0x00007FFD7F3C0000-memory.dmp

Download

memory/3904-1647-0x00007FFD7D420000-0x00007FFD7D42B000-memory.dmp

Download

memory/3904-1648-0x00007FFD7D420000-0x00007FFD7D42B000-memory.dmp

Download

memory/3904-1612-0x00007FFD7F4C0000-0x00007FFD7F4D0000-memory.dmp

Download

memory/3904-1650-0x00007FFD7D420000-0x00007FFD7D42B000-memory.dmp

Download

memory/3904-1613-0x00007FFD7F4C0000-0x00007FFD7F4D0000-memory.dmp

Download

memory/3904-1614-0x00007FFD7F510000-0x00007FFD7F540000-memory.dmp

Download

memory/3904-1649-0x00007FFD7D420000-0x00007FFD7D42B000-memory.dmp

Download

memory/3904-1651-0x00007FFD7D420000-0x00007FFD7D42B000-memory.dmp

Download

memory/3904-1617-0x00007FFD7F510000-0x00007FFD7F540000-memory.dmp

Download

memory/3904-1638-0x00007FFD7E2D0000-0x00007FFD7E2E0000-memory.dmp

Download

memory/3904-1639-0x00007FFD7E2D0000-0x00007FFD7E2E0000-memory.dmp

Download

memory/3904-1618-0x00007FFD7F510000-0x00007FFD7F540000-memory.dmp

Download

memory/3904-1619-0x00007FFD7F5A0000-0x00007FFD7F5A5000-memory.dmp

Download

memory/3904-1616-0x00007FFD7F510000-0x00007FFD7F540000-memory.dmp

Download

memory/3904-1615-0x00007FFD7F510000-0x00007FFD7F540000-memory.dmp

Download

memory/3904-1657-0x00007FFD7D2A0000-0x00007FFD7D2C6000-memory.dmp

Download

memory/3904-1636-0x00007FFD7CE30000-0x00007FFD7CE60000-memory.dmp

Download

memory/3904-1640-0x00007FFD7E380000-0x00007FFD7E38E000-memory.dmp

Download

memory/3904-1635-0x00007FFD7CE30000-0x00007FFD7CE60000-memory.dmp

Download

memory/3904-1634-0x00007FFD7CE30000-0x00007FFD7CE60000-memory.dmp

Download

memory/3904-1641-0x00007FFD7E380000-0x00007FFD7E38E000-memory.dmp

Download

memory/3904-1645-0x00007FFD7D400000-0x00007FFD7D410000-memory.dmp

Download

memory/3904-1628-0x00007FFD7F1A0000-0x00007FFD7F1B0000-memory.dmp

Download

memory/3904-1637-0x00007FFD7CE30000-0x00007FFD7CE60000-memory.dmp

Download

memory/3904-1643-0x00007FFD7E380000-0x00007FFD7E38E000-memory.dmp

Download

memory/3904-1644-0x00007FFD7E380000-0x00007FFD7E38E000-memory.dmp

Download

memory/3904-1627-0x00007FFD7F1A0000-0x00007FFD7F1B0000-memory.dmp

Download

memory/3904-1620-0x00007FFD7F0F0000-0x00007FFD7F100000-memory.dmp

Download

memory/3904-1621-0x00007FFD7F0F0000-0x00007FFD7F100000-memory.dmp

Download

memory/3904-1652-0x00007FFD7D170000-0x00007FFD7D180000-memory.dmp

Download

memory/3904-1658-0x00007FFD7D2A0000-0x00007FFD7D2C6000-memory.dmp

Download

memory/3904-1623-0x00007FFD7F180000-0x00007FFD7F190000-memory.dmp

Download

memory/3904-1625-0x00007FFD7F1A0000-0x00007FFD7F1B0000-memory.dmp

Download

memory/3904-1626-0x00007FFD7F1A0000-0x00007FFD7F1B0000-memory.dmp

Download

memory/3904-1629-0x00007FFD7CBB0000-0x00007FFD7CBC0000-memory.dmp

Download

memory/3904-1653-0x00007FFD7D170000-0x00007FFD7D180000-memory.dmp

Download

memory/3904-1630-0x00007FFD7CBB0000-0x00007FFD7CBC0000-memory.dmp

Download

memory/3904-1631-0x00007FFD7CCC0000-0x00007FFD7CCD0000-memory.dmp

Download

memory/3904-1632-0x00007FFD7CCC0000-0x00007FFD7CCD0000-memory.dmp

Download

memory/3904-1654-0x00007FFD7D270000-0x00007FFD7D280000-memory.dmp

Download

memory/3904-1655-0x00007FFD7D270000-0x00007FFD7D280000-memory.dmp

Download

memory/3904-1656-0x00007FFD7D2A0000-0x00007FFD7D2C6000-memory.dmp

Download

memory/3904-1633-0x00007FFD7CE30000-0x00007FFD7CE60000-memory.dmp

Download

memory/4060-1476-0x0000000000840000-0x0000000000875000-memory.dmp

Download

memory/4060-1477-0x0000000073B00000-0x0000000073D10000-memory.dmp

Download

memory/4060-1508-0x0000000073B00000-0x0000000073D10000-memory.dmp

Download

memory/4060-1596-0x0000000000840000-0x0000000000875000-memory.dmp

Download