Overview

overview

8

Static

static

1

RobloxPlay...er.exe

windows7-x64

8

RobloxPlay...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    591s
  • max time network
    555s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerInstaller.exe
  • Size 5.3MB
  • Sample240527-qtacdsfc98
  • SHA256 c89eda2b48317bd4da398d59213d86afa0c06034cab5e3ea5df5865e369d2a0f
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 35 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 24 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:244
    • C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        3⤵
        • Sets file execution options in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3612
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:5016
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:1860
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:3792
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk0QUFDRUYtRDY2OC00MjcwLThBQzItRDI3RDQwMkUzMzMxfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NTMxRDE1Ni05MEVDLTRDQkYtQUVCQS05RkIzQkU5OEMwMzh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NDM3NjM2MzMiIGluc3RhbGxfdGltZV9tcz0iNzE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          PID:5048
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A94AACEF-D668-4270-8AC2-D27D402E3331}" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3432
    • C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\RobloxPlayerBeta.exe" -app -isInstallerLaunch
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1056
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk0QUFDRUYtRDY2OC00MjcwLThBQzItRDI3RDQwMkUzMzMxfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RDJFMDZCNi1ERUQ4LTQzOTktQTg4MC00MEJFNURENEIyQzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NDg1NzM3NDUiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:3232
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\MicrosoftEdge_X64_125.0.2535.67.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\EDGEMITMP_F16E0.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\EDGEMITMP_F16E0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\EDGEMITMP_F16E0.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\EDGEMITMP_F16E0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89009F87-E5D3-432B-ACBA-39FA0CDBABD0}\EDGEMITMP_F16E0.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6d1cc4b18,0x7ff6d1cc4b24,0x7ff6d1cc4b30
          4⤵
          • Executes dropped EXE
          PID:3944
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk0QUFDRUYtRDY2OC00MjcwLThBQzItRDI3RDQwMkUzMzMxfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MkQ5NERFNS1GQUQ5LTQ5MEYtQTM3OS0wOTU3OUVFQjA3OUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg3MDMxMzc0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NzA0MzM3NzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTQzODkzNzk3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzA4ZTc3MC01MWEwLTRkMDAtYTJmMy1kNzM2ZGI4NTg2ZTc_UDE9MTcxNzQzNTg3MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1YJTJiaXN4NnhRSmJvc3BtSTBIRWRBQXg5VzQ1SmZjREglMmZTZkRtejFjSktpSzh1aGRDSEdOMXV0bEhXcUE5ZVQ1ajNWZE1nd1J6NFZGSnFBczZ4RVZaemclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM4MDg1OTIiIHRvdGFsPSIxNzM4MDg1OTIiIGRvd25sb2FkX3RpbWVfbXM9IjIwODE5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE0NDAzMzkxNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNTg0NDQzNjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2MTE4MzM3MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxNzg0IiBkb3dubG9hZF90aW1lX21zPSIyNzM0MCIgZG93bmxvYWRlZD0iMTczODA4NTkyIiB0b3RhbD0iMTczODA4NTkyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NTMzNCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:3020
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5036
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{430D5C03-57E8-42BE-81E4-3B150CDADAD1}\BGAUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{430D5C03-57E8-42BE-81E4-3B150CDADAD1}\BGAUpdate.exe" --edgeupdate-client --system-level
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:432
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTA1QzYxQzMtRTIzMC00Qzg5LTk4RTUtM0VDNDc1NkM0QUJEfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4NzJBMjcxNi1EN0FDLTRBMEEtOTcxQy1CQUFDQzk4ODI1NDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODQxMDU0ODQ3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg0MTA1NDg0NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTgzMDg1NjgwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTc0MzYxNjkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VVcyanJDN3U5JTJiQ2JQSGFGQ05QZXBpWWlmTjVTNktKV2tObUFSeSUyYllCakclMmJONXRoY3RLJTJmS1JXN0twcnlhUGdqSjU4b2Z5cVpqdHQ4OWJMdnhpd1dWZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxNSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5ODMwODU2ODAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzVmMTk1NjEyLTM4NGEtNDhlYS04NDA4LWI0ZWRlOWRjNTZiYj9QMT0xNzE3NDM2MTY5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVVXMmpyQzd1OSUyYkNiUEhhRkNOUGVwaVlpZk41UzZLSldrTm1BUnklMmJZQmpHJTJiTjV0aGN0SyUyZktSVzdLcHJ5YVBnako1OG9meXFaanR0ODliTHZ4aXdXVmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBkb3dubG9hZF90aW1lX21zPSIxMDk3ODEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTgzMDg1NjgwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODk4OTMzNjQ4MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5OTI3NzMwNzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNzUiIGRvd25sb2FkX3RpbWVfbXM9IjExNDE4NyIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:1832
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3CE4D2E-8D71-4600-AA15-DC31B9EEEF7E}\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3CE4D2E-8D71-4600-AA15-DC31B9EEEF7E}\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe" /update /sessionid "{BCA8B19B-45FA-45AE-89D0-2F884887456F}"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Program Files (x86)\Microsoft\Temp\EU707B.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EU707B.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{BCA8B19B-45FA-45AE-89D0-2F884887456F}"
        3⤵
        • Sets file execution options in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4016
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:4924
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:3120
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:1484
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkNBOEIxOUItNDVGQS00NUFFLTg5RDAtMkY4ODQ4ODc0NTZGfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7ODVCM0IwNEItRDVBRi00Qzg2LUFCRjItRDg5MjcyNzJEMTRBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzEiIGluc3RhbGxkYXRldGltZT0iMTcxNDEzNDk4MCI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTI3MDc0MTcxOSIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          PID:1276
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkNBOEIxOUItNDVGQS00NUFFLTg5RDAtMkY4ODQ4ODc0NTZGfSIgdXNlcmlkPSJ7NzA1MzFGNDItQTRDMS00MDhFLTkwMDctQzYxOTlENzgwNjk1fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsyNEQ2OTBBQS1BMEUxLTRCNUYtQTg2Ni0wOTVGMjQ3NDkzNzR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2O1Byb2R1Y3RzVG9SZWdpc3Rlcj0lN0IxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDAlN0QiIGluc3RhbGxhZ2U9IjMxIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MDczODY3MDQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkwNzQwMjMwNTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkyNDU3NDE3MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yMjE2NjdkYy1iYjBhLTRhY2ItODMzZC01YTExZGM4OGE4YmY_UDE9MTcxNzQzNjI5MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1tQ2QlMmZtM0clMmJqUEFFJTJmYVhZdU9CQmtLSUt2cHRrb2xkdnUxczNaNXZtZzRDJTJiSlF5eFEwbFhVZTAycWNQWklmMjFUV3pMZkQlMmYwJTJmakt0YXFCaWZ6Z1pWUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkyNDU3NDE3MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzIyMTY2N2RjLWJiMGEtNGFjYi04MzNkLTVhMTFkYzg4YThiZj9QMT0xNzE3NDM2MjkzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW1DZCUyZm0zRyUyYmpQQUUlMmZhWFl1T0JCa0tJS3ZwdGtvbGR2dTFzM1o1dm1nNEMlMmJKUXl4UTBsWFVlMDJxY1BaSWYyMVRXekxmRCUyZjAlMmZqS3RhcUJpZnpnWlZRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYyMTA0OCIgdG90YWw9IjE2MjEwNDgiIGRvd25sb2FkX3RpbWVfbXM9IjE3MDYyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkyNDU3NDE3MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTI1MDg5ODUyMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjMxIiByZD0iNjMyNSIgcGluZ19mcmVzaG5lc3M9IntFNzUxMTQxOC03OEY4LTRBMDctQTRBNC1EMjM5RDM0QkY1Q0F9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjMxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1ODYxMjM1ODI3MjM3MDAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIzMSIgcj0iMzEiIGFkPSI2MzI1IiByZD0iNjMyNSIgcGluZ19mcmVzaG5lc3M9IntEMTEzNDg1RS0xMEUwLTQ2RTQtOUQxMS1FQjBCNTc1MzczQ0Z9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNS4wLjI1MzUuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjM1NiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0U3RjM1MDgwLTlDNEQtNDlCRS05QjA4LUE3NjVEODg1NURFMH0iLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:2452

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Installer\setup.exe
        • Size 6.9MB
        • SHA256 adbd1a10981cccd00918d924ec93a9d6f29d16190691f6984b199f9a42cc0cb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BGAUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
        • Size 17.2MB
        • SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.39\MicrosoftEdgeUpdateSetup_X86_1.3.187.39.exe
        • Size 1.5MB
        • SHA256 fa7d8a8cae60ab620d2aa887de62039d2647e4f5c1c649d75f0f52e14ec11a99
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EdgeUpdate.dat
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\EdgeUpdate.dat
        • Size 12KB
        • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeComRegisterShellARM64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 179KB
        • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeUpdate.exe
        • Size 201KB
        • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 212KB
        • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateCore.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\MicrosoftEdgeUpdateCore.exe
        • Size 257KB
        • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTICE.TXT
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\NOTICE.TXT
        • Size 4KB
        • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdate.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdate.dll
        • Size 2.0MB
        • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_af.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_af.dll
        • Size 28KB
        • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_am.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_am.dll
        • Size 24KB
        • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ar.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ar.dll
        • Size 26KB
        • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_as.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_as.dll
        • Size 28KB
        • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_az.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_az.dll
        • Size 29KB
        • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bg.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_bg.dll
        • Size 29KB
        • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn-IN.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_bn-IN.dll
        • Size 29KB
        • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_bn.dll
        • Size 29KB
        • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_bs.dll
        • Size 28KB
        • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca-Es-VALENCIA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        • Size 29KB
        • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ca.dll
        • Size 30KB
        • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_cs.dll
        • Size 28KB
        • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cy.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_cy.dll
        • Size 28KB
        • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_da.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_da.dll
        • Size 28KB
        • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_de.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_de.dll
        • Size 30KB
        • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_el.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_el.dll
        • Size 30KB
        • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en-GB.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_en-GB.dll
        • Size 27KB
        • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_en.dll
        • Size 27KB
        • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_es-419.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_es-419.dll
        • Size 29KB
        • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_es.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_es.dll
        • Size 28KB
        • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_et.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_et.dll
        • Size 28KB
        • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_eu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_eu.dll
        • Size 28KB
        • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fa.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_fa.dll
        • Size 27KB
        • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_fi.dll
        • Size 28KB
        • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fil.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_fil.dll
        • Size 29KB
        • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fr-CA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_fr-CA.dll
        • Size 30KB
        • SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_fr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_fr.dll
        • Size 30KB
        • SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ga.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ga.dll
        • Size 28KB
        • SHA256 abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_gd.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_gd.dll
        • Size 30KB
        • SHA256 e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_gl.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_gl.dll
        • Size 28KB
        • SHA256 e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_gu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_gu.dll
        • Size 28KB
        • SHA256 838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_hi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_hi.dll
        • Size 28KB
        • SHA256 024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_hr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_hr.dll
        • Size 29KB
        • SHA256 65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_hu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_hu.dll
        • Size 29KB
        • SHA256 b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_id.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_id.dll
        • Size 27KB
        • SHA256 192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_is.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_is.dll
        • Size 28KB
        • SHA256 a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_it.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_it.dll
        • Size 30KB
        • SHA256 abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_iw.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_iw.dll
        • Size 25KB
        • SHA256 fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ja.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ja.dll
        • Size 24KB
        • SHA256 5f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ka.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ka.dll
        • Size 29KB
        • SHA256 4449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_kk.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_kk.dll
        • Size 28KB
        • SHA256 fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_km.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_km.dll
        • Size 27KB
        • SHA256 6fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_kn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_kn.dll
        • Size 29KB
        • SHA256 ef749f70e71424d7f548d5c12283be70a6d6c59cffb1c8101b74f37ecacb64af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ko.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ko.dll
        • Size 23KB
        • SHA256 baa9fae4fb8939e0b5fe0c7f393ab1ca40b52534f37bf2158a9a36331a221e75
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_kok.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_kok.dll
        • Size 28KB
        • SHA256 5b9509a1ae34d89c89c8e657742495037d28cd03e1cd48aef4dfaa7aeebe29f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_lb.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_lb.dll
        • Size 30KB
        • SHA256 c3fb0cae3dc5cdd86518d60f998c3adec1c0c5804a74ffbb9a346a73d598af07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_lo.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_lo.dll
        • Size 27KB
        • SHA256 aecab1eb46075d1a1432b3e14537f860a2ded49a13ca82f17fac44b40ad2da51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_lt.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_lt.dll
        • Size 27KB
        • SHA256 9c75ef5c3f53c643d7bb8c5907a0cba6ca2d1d64e6bea39ce06b4ad5a20454b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_lv.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_lv.dll
        • Size 28KB
        • SHA256 b8075c09d33cc6b6ff22fdb29ccc3dd319ce867f4b77a1d165f6f8d8cb4977e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_mi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_mi.dll
        • Size 28KB
        • SHA256 9b4bb2ca3366a1935b4869796efc0601f94356b45e8613d28e023dd516f48d17
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_mk.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_mk.dll
        • Size 29KB
        • SHA256 4850260d2cbb4b4ff3490eb90ce55a412268ad699f946b1cd686ddf9f0403bd6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ml.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ml.dll
        • Size 30KB
        • SHA256 8ebe88477b1493733140f1fced91903276ec69c7302deed3281054b49573eb3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_mr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_mr.dll
        • Size 28KB
        • SHA256 24b304bd40f8e63848f8d2a1ca6ac8bc032b7a700161efad61ad445787650c87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ms.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB0C2.tmp\msedgeupdateres_ms.dll
        • Size 28KB
        • SHA256 a47fc6a9a75875e75f3415f068c357dd499e533849381b875272d5994c163670
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxStudioInstaller.exe
        • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
        • Size 5.3MB
        • SHA256 00314da401908da37ebfe9b642506cab81a4467c092719fcf007be045bc4a9e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeWebview2Setup.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-0a57b2f24afe434b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        • Size 1.5MB
        • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Program Files\MsEdgeCrashpad\settings.dat
        • Size 280B
        • SHA256 e11dcf47f188e5fbc3e933889fb78fe6366d7a98bee360659745005f9df79227
        • MD5 SHA1 SHA512
        Submit Download

        MicrosoftEdgeUpdate.log
        • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        • Size 101KB
        • SHA256 faf6d715aa63d069dadad028f736c6db3598f86f2ec47753e050c361510a6fcb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        938199ca646378b696716037afc964ba
        • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\938199ca646378b696716037afc964ba
        • Size 5.7MB
        • SHA256 2acc3e0879e4a71a6b08e2d6af7b238198d2eda73518b9394d82d00b010c9d7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1056-343-0x00007FFBB8AC0000-0x00007FFBB8AF0000-memory.dmp
        Download

        memory/1056-359-0x00007FFBB9B00000-0x00007FFBB9B0B000-memory.dmp
        Download

        memory/1056-325-0x00007FFBBB030000-0x00007FFBBB060000-memory.dmp
        Download

        memory/1056-324-0x00007FFBBB030000-0x00007FFBBB060000-memory.dmp
        Download

        memory/1056-323-0x00007FFBBB030000-0x00007FFBBB060000-memory.dmp
        Download

        memory/1056-322-0x00007FFBBAFE0000-0x00007FFBBAFF0000-memory.dmp
        Download

        memory/1056-321-0x00007FFBBAFE0000-0x00007FFBBAFF0000-memory.dmp
        Download

        memory/1056-320-0x00007FFBBAED0000-0x00007FFBBAEE0000-memory.dmp
        Download

        memory/1056-327-0x00007FFBBB030000-0x00007FFBBB060000-memory.dmp
        Download

        memory/1056-319-0x00007FFBBAED0000-0x00007FFBBAEE0000-memory.dmp
        Download

        memory/1056-331-0x00007FFBB8FB0000-0x00007FFBB8FC0000-memory.dmp
        Download

        memory/1056-334-0x00007FFBB8FD0000-0x00007FFBB8FE0000-memory.dmp
        Download

        memory/1056-333-0x00007FFBB8FD0000-0x00007FFBB8FE0000-memory.dmp
        Download

        memory/1056-332-0x00007FFBB8FB0000-0x00007FFBB8FC0000-memory.dmp
        Download

        memory/1056-336-0x00007FFBB8FD0000-0x00007FFBB8FE0000-memory.dmp
        Download

        memory/1056-330-0x00007FFBB8F20000-0x00007FFBB8F30000-memory.dmp
        Download

        memory/1056-329-0x00007FFBB8F20000-0x00007FFBB8F30000-memory.dmp
        Download

        memory/1056-337-0x00007FFBB8FD0000-0x00007FFBB8FE0000-memory.dmp
        Download

        memory/1056-335-0x00007FFBB8FD0000-0x00007FFBB8FE0000-memory.dmp
        Download

        memory/1056-341-0x00007FFBB8950000-0x00007FFBB8960000-memory.dmp
        Download

        memory/1056-340-0x00007FFBB8950000-0x00007FFBB8960000-memory.dmp
        Download

        memory/1056-339-0x00007FFBB8840000-0x00007FFBB8850000-memory.dmp
        Download

        memory/1056-338-0x00007FFBB8840000-0x00007FFBB8850000-memory.dmp
        Download

        memory/1056-326-0x00007FFBBB030000-0x00007FFBBB060000-memory.dmp
        Download

        memory/1056-346-0x00007FFBB8AC0000-0x00007FFBB8AF0000-memory.dmp
        Download

        memory/1056-345-0x00007FFBB8AC0000-0x00007FFBB8AF0000-memory.dmp
        Download

        memory/1056-360-0x00007FFBB9B00000-0x00007FFBB9B0B000-memory.dmp
        Download

        memory/1056-328-0x00007FFBBB0C0000-0x00007FFBBB0C5000-memory.dmp
        Download

        memory/1056-358-0x00007FFBB9B00000-0x00007FFBB9B0B000-memory.dmp
        Download

        memory/1056-357-0x00007FFBB9B00000-0x00007FFBB9B0B000-memory.dmp
        Download

        memory/1056-356-0x00007FFBB9B00000-0x00007FFBB9B0B000-memory.dmp
        Download

        memory/1056-355-0x00007FFBB9AE0000-0x00007FFBB9AF0000-memory.dmp
        Download

        memory/1056-354-0x00007FFBB9AE0000-0x00007FFBB9AF0000-memory.dmp
        Download

        memory/1056-353-0x00007FFBB9F20000-0x00007FFBB9F2E000-memory.dmp
        Download

        memory/1056-352-0x00007FFBB9F20000-0x00007FFBB9F2E000-memory.dmp
        Download

        memory/1056-351-0x00007FFBB9F20000-0x00007FFBB9F2E000-memory.dmp
        Download

        memory/1056-350-0x00007FFBB9F20000-0x00007FFBB9F2E000-memory.dmp
        Download

        memory/1056-349-0x00007FFBB9F20000-0x00007FFBB9F2E000-memory.dmp
        Download

        memory/1056-348-0x00007FFBB9E70000-0x00007FFBB9E80000-memory.dmp
        Download

        memory/1056-347-0x00007FFBB9E70000-0x00007FFBB9E80000-memory.dmp
        Download

        memory/1056-344-0x00007FFBB8AC0000-0x00007FFBB8AF0000-memory.dmp
        Download

        memory/1056-342-0x00007FFBB8AC0000-0x00007FFBB8AF0000-memory.dmp
        Download

        memory/1056-362-0x00007FFBB8B10000-0x00007FFBB8B20000-memory.dmp
        Download

        memory/1056-365-0x00007FFBB8C40000-0x00007FFBB8C66000-memory.dmp
        Download

        memory/1056-367-0x00007FFBB8C40000-0x00007FFBB8C66000-memory.dmp
        Download

        memory/1056-366-0x00007FFBB8C40000-0x00007FFBB8C66000-memory.dmp
        Download

        memory/1056-364-0x00007FFBB8C10000-0x00007FFBB8C20000-memory.dmp
        Download

        memory/1056-363-0x00007FFBB8C10000-0x00007FFBB8C20000-memory.dmp
        Download

        memory/1056-361-0x00007FFBB8B10000-0x00007FFBB8B20000-memory.dmp
        Download

        memory/1620-258-0x00000000741E0000-0x00000000743F0000-memory.dmp
        Download

        memory/1620-257-0x0000000000730000-0x0000000000765000-memory.dmp
        Download

        memory/1620-266-0x00000000741E0000-0x00000000743F0000-memory.dmp
        Download

        memory/1620-314-0x0000000000730000-0x0000000000765000-memory.dmp
        Download