Analysis
-
max time kernel
482s -
max time network
482s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
iron5decompiler.exe
Resource
win10v2004-20240611-en
General
-
Target
iron5decompiler.exe
-
Size
154KB
-
MD5
2701aef8b0ac8a3e2eaf4f149be596c3
-
SHA1
2b6f95b404a58a23655f9101b7289a1cefcf164b
-
SHA256
e02ab02e92eeffa04c08b59e8d0f419a83e880f550abd09e4c98f51eb25556f3
-
SHA512
537e59b3e3dc87b587c81ed433fef95b3dc52f58584b3fd6fdd86d8b7dd0af5c2ba0fd6dc740c52a71a8e51e4f9441e100aac0d3214be7a1e29d08ba47f0b1e9
-
SSDEEP
3072:MahKyd2n31z5GWp1icKAArDZz4N9GhbkrNEk1kT:MahObp0yN90QE7
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 51 IoCs
pid Process 5344 RobloxPlayerInstaller.exe 6056 MicrosoftEdgeWebview2Setup.exe 4896 MicrosoftEdgeUpdate.exe 4028 MicrosoftEdgeUpdate.exe 532 MicrosoftEdgeUpdate.exe 5216 MicrosoftEdgeUpdateComRegisterShell64.exe 5124 MicrosoftEdgeUpdateComRegisterShell64.exe 5192 MicrosoftEdgeUpdateComRegisterShell64.exe 5224 MicrosoftEdgeUpdate.exe 5384 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 5488 MicrosoftEdgeUpdate.exe 5576 MicrosoftEdge_X64_126.0.2592.61.exe 708 setup.exe 5140 setup.exe 376 RobloxStudioInstaller.exe 2320 RobloxStudioInstaller.exe 4648 MicrosoftEdgeUpdate.exe 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 5648 RobloxStudioBeta.exe 1472 RobloxCrashHandler.exe 3232 msedgewebview2.exe 3628 msedgewebview2.exe 5632 msedgewebview2.exe 1176 msedgewebview2.exe 5444 msedgewebview2.exe 6072 msedgewebview2.exe 2384 msedgewebview2.exe 4316 msedgewebview2.exe 2204 RobloxPlayerBeta.exe 6312 msedgewebview2.exe 5852 msedgewebview2.exe 1276 msedgewebview2.exe 7012 msedgewebview2.exe 5224 msedgewebview2.exe 5424 MicrosoftEdgeUpdate.exe 2308 MicrosoftEdgeUpdate.exe 332 MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe 6784 MicrosoftEdgeUpdate.exe 4412 MicrosoftEdgeUpdate.exe 4616 MicrosoftEdgeUpdate.exe 5312 MicrosoftEdgeUpdate.exe 1776 MicrosoftEdgeUpdateComRegisterShell64.exe 3500 MicrosoftEdgeUpdateComRegisterShell64.exe 5636 MicrosoftEdgeUpdateComRegisterShell64.exe 6976 MicrosoftEdgeUpdate.exe 7064 msedgewebview2.exe 5224 msedgewebview2.exe 5976 msedgewebview2.exe 6636 msedgewebview2.exe -
Loads dropped DLL 64 IoCs
pid Process 4896 MicrosoftEdgeUpdate.exe 4028 MicrosoftEdgeUpdate.exe 532 MicrosoftEdgeUpdate.exe 5216 MicrosoftEdgeUpdateComRegisterShell64.exe 532 MicrosoftEdgeUpdate.exe 5124 MicrosoftEdgeUpdateComRegisterShell64.exe 532 MicrosoftEdgeUpdate.exe 5192 MicrosoftEdgeUpdateComRegisterShell64.exe 532 MicrosoftEdgeUpdate.exe 5224 MicrosoftEdgeUpdate.exe 5384 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 5384 MicrosoftEdgeUpdate.exe 5488 MicrosoftEdgeUpdate.exe 4648 MicrosoftEdgeUpdate.exe 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 1472 RobloxCrashHandler.exe 1472 RobloxCrashHandler.exe 1472 RobloxCrashHandler.exe 1472 RobloxCrashHandler.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 3232 msedgewebview2.exe 3232 msedgewebview2.exe 3628 msedgewebview2.exe 3232 msedgewebview2.exe 3232 msedgewebview2.exe 5632 msedgewebview2.exe 5632 msedgewebview2.exe 5632 msedgewebview2.exe 5632 msedgewebview2.exe 5632 msedgewebview2.exe 5632 msedgewebview2.exe 1176 msedgewebview2.exe 5444 msedgewebview2.exe 5444 msedgewebview2.exe 1176 msedgewebview2.exe 6072 msedgewebview2.exe 6072 msedgewebview2.exe 6072 msedgewebview2.exe 2384 msedgewebview2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" iron5decompiler.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks system information in the registry 2 TTPs 22 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs
pid Process 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 54 IoCs
pid Process 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AbuseReporting\Dev\JestConfigs.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FocusNavigationUtils\Dev\TestUtils.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR3.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\GameSettings\ToolbarIcon.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\StudioSharedUI\alert_error_withbg.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\TagEditor\Compose.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\Alerts\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-0.3.4\LuauPolyfill\Array\join.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameTile\Cryo.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\AssetImport\btn_dark_resetcam_28x28.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\Qml\QtQuick\Controls.2\Fusion\ToolButton.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\ui\scrollbar.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\Clipboard\Dark\Large\Redo.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\BodyForce.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Localization\Locales\fil-ph.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Actions\OpenReportMenu.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserAgreements\Http.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\DeveloperFramework\checkbox_unchecked_hover_light.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\DPadSheet.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\AnimationEditor\image_keyframe_cubic_unselected.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\DeveloperFramework\slider_knob.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\TerrainTools\button_default.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\textures\ui\LuaApp\graphic\Auth\qqlogo.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\RobloxApolloClient.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\DevConsole\Close.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\icon_friends_16.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\Qml\QtQuick\Controls.2\designer\images\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\ui\VoiceChat\SpeakerDark\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\AccessoryFittingTool.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Thunks\DeleteFavoriteForBundle.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\cache\inmemory\writeToStore.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\SelectionImage\useSelectionCursor.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ShareLinkInvalidModal\ShareLinkInvalidModal\default.rbxp RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\Dev\JestConfigs.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\CompositorDebugger\clip.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\InGameMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\ui\Chat\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Lua\StyleEditor\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence-fc5b9ccb-dc416d59\RoduxPresence\Selectors\getUserPresenceByUserId.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VideoProtocol\VideoProtocol\default.rbxp RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiEngagementScreen\Dev\JestGlobals.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\StudioToolbox\Voting\thumbs-up-filled.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Thunks\TryOnItem.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\scripts\CoreScripts\Modules\Stats\BaseMemoryAnalyzer.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_3x_13.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Lua\TerrainEditor\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\StudioFonts\FiraMono-Bold.ttf RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppChat\NavigationRodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Dash.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaApp\icons\ic-more-friends.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\Locales\ar.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\Qml\QtQuick\Controls.2\Material\GroupBox.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\ui\Controls\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\studio_svg_textures\Lua\Localization\Dark\Large\ExportCSV.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Workspace\Packages\Rodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaApp\graphic\Auth\DoraemonSquare.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\content\textures\ui\Emotes\Editor\TenFoot\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared\React.lua RobloxStudioInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 17 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-STUDIO RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdateComRegisterShell64.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5648 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 5344 RobloxPlayerInstaller.exe 5344 RobloxPlayerInstaller.exe 4896 MicrosoftEdgeUpdate.exe 4896 MicrosoftEdgeUpdate.exe 8 chrome.exe 8 chrome.exe 2320 RobloxStudioInstaller.exe 2320 RobloxStudioInstaller.exe 4896 MicrosoftEdgeUpdate.exe 4896 MicrosoftEdgeUpdate.exe 4896 MicrosoftEdgeUpdate.exe 4896 MicrosoftEdgeUpdate.exe 2284 RobloxPlayerBeta.exe 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe 5648 RobloxStudioBeta.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5648 RobloxStudioBeta.exe 4568 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 3232 msedgewebview2.exe 3232 msedgewebview2.exe 3232 msedgewebview2.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5648 RobloxStudioBeta.exe 4568 OpenWith.exe -
Suspicious use of UnmapMainImage 3 IoCs
pid Process 2284 RobloxPlayerBeta.exe 2920 RobloxPlayerBeta.exe 2204 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 3376 116 iron5decompiler.exe 83 PID 116 wrote to memory of 3376 116 iron5decompiler.exe 83 PID 3376 wrote to memory of 2148 3376 cmd.exe 85 PID 3376 wrote to memory of 2148 3376 cmd.exe 85 PID 2148 wrote to memory of 2324 2148 cmd.exe 86 PID 2148 wrote to memory of 2324 2148 cmd.exe 86 PID 4324 wrote to memory of 3632 4324 chrome.exe 97 PID 4324 wrote to memory of 3632 4324 chrome.exe 97 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 1156 4324 chrome.exe 98 PID 4324 wrote to memory of 444 4324 chrome.exe 99 PID 4324 wrote to memory of 444 4324 chrome.exe 99 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 PID 4324 wrote to memory of 1448 4324 chrome.exe 100 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\iron5decompiler.exe"C:\Users\Admin\AppData\Local\Temp\iron5decompiler.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SYSTEM32\cmd.execmd /c "iron5decompiler.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iron5decompiler.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\findstr.exefindstr /b ::: "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iron5decompiler.bat"4⤵PID:2324
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc50f2ab58,0x7ffc50f2ab68,0x7ffc50f2ab782⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:22⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4852 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3184 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3196 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4932 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4616 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4852 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:6112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2700 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2424 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:5148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5448 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:5208
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5344 -
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:6056 -
C:\Program Files (x86)\Microsoft\Temp\EUB1A7.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUB1A7.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:4896 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4028
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:532 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5216
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5124
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5192
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTdFNEVBMDQtNzkyQS00MTVFLUFFQzEtQ0FFNDA2MUEyOUVEfSIgdXNlcmlkPSJ7NDIwRTQ2QUYtRkNENy00NUI4LUI2MjItMUFGREEwNTU5MDFBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QTZEODI3NS01Q0Y4LTRDMzMtOTZFRi0xRUY4NjBGQzRBN0N9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny40MSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MDM0MDc5MDkiIGluc3RhbGxfdGltZV9tcz0iNzU1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5224
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A7E4EA04-792A-415E-AEC1-CAE4061A29ED}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5384
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2284
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5464 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5472 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3216 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5360 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5780 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:6076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5468 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=1628 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=4312 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:aIBNCttAoP7eJ_XZ8dhYpKTPSb1mO70AEN4sFdY6i3nGOnFFmNpqdl25fEmear39xdwkGkC9XrQ_le2P7ckJVf98yTc-WM5NYAEu-63yYOPjbs4HFsppDgPsj8_eHEQFLYTpVhE7NscutnSS-t3KxCReDIVczSv_wCXjlEVcPHY3H5zYGMPjkr_nFPZGkMW-enC_ReweYnTMzBao0BNyHRQp2x-5VdPzHiF18WId8E4+launchtime:1718832055745+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1718831849203015%26placeId%3D8737602449%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3De0161d05-e98c-4bdd-a1d9-6d2e377a291f%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1718831849203015+robloxLocale:en_us+gameLocale:en_us+channel:zliveforbeta+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=1892,i,7785754011383531409,13494208377760190802,131072 /prefetch:82⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2760
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:3972 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTdFNEVBMDQtNzkyQS00MTVFLUFFQzEtQ0FFNDA2MUEyOUVEfSIgdXNlcmlkPSJ7NDIwRTQ2QUYtRkNENy00NUI4LUI2MjItMUFGREEwNTU5MDFBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGODhFQkMzNy0yRTJELTQ4QjMtQjdFQi1BNkEyNzQ1NjNEODh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MDg1NDgyMDEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5488
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\MicrosoftEdge_X64_126.0.2592.61.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\MicrosoftEdge_X64_126.0.2592.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:5576 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\EDGEMITMP_37D9C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\EDGEMITMP_37D9C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\MicrosoftEdge_X64_126.0.2592.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:708 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\EDGEMITMP_37D9C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\EDGEMITMP_37D9C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.62 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7181073D-C88A-41FE-ADB7-B4F4B1F56C11}\EDGEMITMP_37D9C.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.61 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff67f3aaa40,0x7ff67f3aaa4c,0x7ff67f3aaa584⤵
- Executes dropped EXE
PID:5140
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTdFNEVBMDQtNzkyQS00MTVFLUFFQzEtQ0FFNDA2MUEyOUVEfSIgdXNlcmlkPSJ7NDIwRTQ2QUYtRkNENy00NUI4LUI2MjItMUFGREEwNTU5MDFBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFQkU4QTBGQy02REU4LTQ5QUMtQkUyMS05MjE1NENFODkwQUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI2LjAuMjU5Mi42MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTUyNjk5ODMwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MjcwNDc5MDciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDgyMTI3NzIzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83MTM2OWRmNC05ZTlmLTRhMWItOWFmOC05YThiNWFhNDU0OGQ_UDE9MTcxOTQzNjczMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1kOHMyNG80bVJpZ2hBJTJmclpDcDE1RlQlMmJORHN5azlKUHBRQ1VjQUVjNWF2QnFsazk2VTBzUyUyYmZiRFp1cjBTRWt4QzVqN0Z5JTJiZ2dISVBJeDc5QjhydGtnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyOTA3NDgwIiB0b3RhbD0iMTcyOTA3NDgwIiBkb3dubG9hZF90aW1lX21zPSI0ODgwMiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwODIzMzc5MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDk3MTI4MTQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NTY1NTg3OTEzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTM4MiIgZG93bmxvYWRfdGltZV9tcz0iNTU1MDAiIGRvd25sb2FkZWQ9IjE3MjkwNzQ4MCIgdG90YWw9IjE3MjkwNzQ4MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDY4NDQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4648
-
-
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:376 -
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_69A6B\RobloxStudioInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_69A6B\RobloxStudioInstaller.exe -relaunch2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2320 -
C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5648 -
C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-6fd80b49a9674f97\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.629.0.6290609_20240619T212108Z_Studio_DC524_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.629.0.6290609_20240619T212108Z_Studio_DC524_last.log --attachment=attachment_log_0.629.0.6290609_20240619T212108Z_Studio_DC524_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.629.0.6290609_20240619T212108Z_Studio_DC524_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.629.0.6290609 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=77fd10a5666de7b3dc8645f83badf8f3caf91a16 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.629.0.6290609 --annotation=UniqueId=922953488073188009 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.629.0.6290609 --annotation=host_arch=x86_64 --initial-client-data=0x5c0,0x5c4,0x5c8,0x59c,0x5d0,0x7ff7f9af27b0,0x7ff7f9af27c8,0x7ff7f9af27e04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5648.1680.89174482071062101354⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:3232 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.62 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.61 --initial-client-data=0x17c,0x180,0x184,0x158,0x40,0x7ffc48300148,0x7ffc48300154,0x7ffc483001605⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3628
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5632
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2052,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2304,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5444
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3752,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6072
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3680,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2384
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4380,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:4316
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2252,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:85⤵
- Executes dropped EXE
PID:6312
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4992,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:85⤵
- Executes dropped EXE
PID:5852
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4796,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:85⤵
- Executes dropped EXE
PID:1276
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5116,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:85⤵
- Executes dropped EXE
PID:7012
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4676,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:85⤵
- Executes dropped EXE
PID:5224
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5080,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:85⤵
- Executes dropped EXE
PID:7064
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4996,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:85⤵
- Executes dropped EXE
PID:5224
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5044,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:85⤵
- Executes dropped EXE
PID:5976
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 629, 0, 6290609" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5032,i,15734795974392273629,14355238415753109936,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:85⤵
- Executes dropped EXE
PID:6636
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/account/signupredir?ReturnUrl=https%3A%2F%2Fapis.roblox.com%2Foauth%2Fv1%2Fauthorize%3Fclient_id%3D7968549422692352298%26response_type%3Dcode%26redirect_uri%3Droblox-studio-auth%253a%252f%26scope%3Dopenid%2Bcredentials%2Bprofile%2Bage%2Broles%2Bpremium%26state%3DeyJyYW5kb21fc3RyaW5nIjoiaC1FLVN4N2ZqZ18xVjZZWlpURDc0dFJQa0xGWGZaVloyYmxwWV9FVGRuayIsInBpZCI6IjU2NDgifQ%253d%253d%26nonce%3Did-roblox%26code_challenge%3D5qValdA-m0FkoSrUq9kSL8LTLA49YboC5pcg44xa9kQ%26code_challenge_method%3DS256%26rlt%3DXLD113ac0SvS5AeFNMLnjQSh7RkZlcO-LssH9F0CJetjVVUt47upDaasUnJhrowU7v-BMWmcfazZPUp2dV3Pse-2A8w0zU0iYtDlOlSAyN1MF_2ipyoYqTlbyoYEAYI0-65AvLFfH03MKz4RuO62wg4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffc49a346f8,0x7ffc49a34708,0x7ffc49a347185⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:25⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:35⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:85⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:15⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:15⤵PID:5300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:15⤵PID:6400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:25⤵PID:6604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:85⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:85⤵PID:6840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10100248987706028349,11552625160839677432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:15⤵PID:6900
-
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:2204
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:1816
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:636
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4292
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:5424
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:2308 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B377245E-EEA5-4A0A-8D6C-1BDBE7357D2B}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B377245E-EEA5-4A0A-8D6C-1BDBE7357D2B}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe" /update /sessionid "{DB95155B-E99C-4422-81D9-98EFBD5BC790}"2⤵
- Executes dropped EXE
PID:332 -
C:\Program Files (x86)\Microsoft\Temp\EU68CF.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU68CF.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{DB95155B-E99C-4422-81D9-98EFBD5BC790}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks system information in the registry
PID:4412 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Modifies registry class
PID:4616
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
PID:5312 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:1776
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:3500
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:5636
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI5NTE1NUItRTk5Qy00NDIyLTgxRDktOThFRkJENUJDNzkwfSIgdXNlcmlkPSJ7NDIwRTQ2QUYtRkNENy00NUI4LUI2MjItMUFGREEwNTU5MDFBfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OTFBOEQ1OTktMDMyNi00MkUwLUE2REQtMzI5Mjc0RkFDRjEzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iOCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE4MTMxMTIyIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTkwODA3OTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Executes dropped EXE
- Checks system information in the registry
PID:6976
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI5NTE1NUItRTk5Qy00NDIyLTgxRDktOThFRkJENUJDNzkwfSIgdXNlcmlkPSJ7NDIwRTQ2QUYtRkNENy00NUI4LUI2MjItMUFGREEwNTU5MDFBfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxQjYyNDU5Mi01NjEwLTRGRDItQUY2QS03REUyQjUwQzcyQzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuNDEiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2O1Byb2R1Y3RzVG9SZWdpc3Rlcj0lN0IxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDAlN0QiIGluc3RhbGxhZ2U9IjgiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NTIyNTgwMDYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU1MjM3Nzk4MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU2OTgyODM2MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRhZDljYjZlLTgyNDUtNGU0Ny1iMjk4LTFmZjRiMDQyNTZlMT9QMT0xNzE5NDM3MDM0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUZ5RHNETldxRE1kV0JjVEdTYmlUUjJBS2c4TDZvWjJFTGpUNzh5bGZmd2pzamk1b0VoQXkxZkJQMlZQOEw3dm5tNmNBMk04Vk9TalFqckR0aUl4bVZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU2OTk0Nzc2NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNGFkOWNiNmUtODI0NS00ZTQ3LWIyOTgtMWZmNGIwNDI1NmUxP1AxPTE3MTk0MzcwMzQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RnlEc0ROV3FETWRXQmNUR1NiaVRSMkFLZzhMNm9aMkVMalQ3OHlsZmZ3anNqaTVvRWhBeTFmQlAyVlA4TDd2bm02Y0EyTThWT1NqUWpyRHRpSXhtVnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjM0Mzc2IiB0b3RhbD0iMTYzNDM3NiIgZG93bmxvYWRfdGltZV9tcz0iMTYwMSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTY5OTg3ODk4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NzUxNjc5NjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSI4IiByZD0iNjM3MSIgcGluZ19mcmVzaG5lc3M9Ins0MzlCNzA0NC04RUIzLTQxQTYtOERGRS04RTcyMzU3REVDRkZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjgiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzYzMzA1NzA5MTYzNTk4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9IjgiIHI9IjgiIGFkPSI2MzcxIiByZD0iNjM3MSIgcGluZ19mcmVzaG5lc3M9InsxNUExOTg2Mi05NTFELTQyNjAtOEE0My1DMzk2QjNCQTk2RTh9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNi4wLjI1OTIuNjEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzNzciIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzYzMzA1Njc1NTYxNjI4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7OThDNTg5NDktREZCNy00Nzk3LUEwMjgtQzQ0QjkzQkNDMjFGfSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Checks system information in the registry
PID:6784
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD5f9e45fe262a291c37f52e1baf1cbb75c
SHA12c3a47de71610e3ad80e34fa7d0af9690d56d8ea
SHA25676974a5e0e00af7c5d759a30b04ec614e819a4fcbe418fb1312b0426b87d0b26
SHA512a7ea36dc3c2322f5bdc97ed4c2cf4d1a6d8261f80ad774155e557127b0b3491aa6fa9bab14bc2f65d483bb9a3680ff0c8f8920b0920b3058e0aa5f992b22f94c
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe
Filesize1.6MB
MD5a9ad77a4111f44c157a1a37bb29fd2b9
SHA1f1348bcbc950532ac2b48b18acd91533f3ac0be2
SHA256200a59abdeb32cc4d2cec4079be205f18b5f45bae42acb7940151f9780569889
SHA51268f58a15ef5ba5d49d8476bee4a488e9a721f703a645ddd29148915d555ca2eb451635c3b762e5a0f786d69bb5cba9bffac3eeee196f1ec7ad669e2d729fe898
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
Filesize
27KB
MD5d749e093f263244d276b6ffcf4ef4b42
SHA169f024c769632cdbb019943552bac5281d4cbe05
SHA256fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
SHA51248d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
29KB
MD528fefc59008ef0325682a0611f8dba70
SHA1f528803c731c11d8d92c5660cb4125c26bb75265
SHA25655a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
SHA5122ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
-
Filesize
28KB
MD59db7f66f9dc417ebba021bc45af5d34b
SHA16815318b05019f521d65f6046cf340ad88e40971
SHA256e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
SHA512943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
-
Filesize
28KB
MD5b78cba3088ecdc571412955742ea560b
SHA1bc04cf9014cec5b9f240235b5ff0f29dbdb22926
SHA256f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
SHA51204c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
-
Filesize
28KB
MD5a7e1f4f482522a647311735699bec186
SHA13b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
SHA256e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
SHA51222131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
-
Filesize
27KB
MD5cbe3454843ce2f36201460e316af1404
SHA10883394c28cb60be8276cb690496318fcabea424
SHA256c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
SHA512f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
-
Filesize
28KB
MD5d45f2d476ed78fa3e30f16e11c1c61ea
SHA18c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
SHA256acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
SHA5122a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
-
Filesize
29KB
MD57c66526dc65de144f3444556c3dba7b8
SHA16721a1f45ac779e82eecc9a584bcf4bcee365940
SHA256e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
SHA512dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
-
Filesize
30KB
MD5b534e068001e8729faf212ad3c0da16c
SHA1999fa33c5ea856d305cc359c18ea8e994a83f7a9
SHA256445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
SHA512e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb
-
Filesize
30KB
MD564c47a66830992f0bdfd05036a290498
SHA188b1b8faa511ee9f4a0e944a0289db48a8680640
SHA256a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
SHA512426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
-
Filesize
28KB
MD53b8a5301c4cf21b439953c97bd3c441c
SHA18a7b48bb3d75279de5f5eb88b5a83437c9a2014a
SHA256abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
SHA512068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a
-
Filesize
5.4MB
MD5f899ed8284f9df71e4dd43b152dd60e9
SHA1715796f8e8c83699dc2672f5acee91dce08715cf
SHA2568d886a250762d21047a8a579251909225f5adab2e372a7f03e2c1c8c3d294152
SHA51249b6ec6cc9b7256a19ec18ae5045fb01118b5ae1b2aa5b6e4d9b66daca8b7b3dcbfdde84c20a416378ece260fbb06addaed2c3d6af7eaff4958934fbb81dd796
-
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
280B
MD526f288a21b25a7ee55258bbe7e6b2a7c
SHA188837759b1ddefa03e868b6c1d5b6ade4212a8ec
SHA256e5cab9711cd1d0ef15d8acc6153e25b747f64f8640c9679633f5c0ee15bdd342
SHA51206476783cfd1c7b8012301a9a87481cef68aa927ba5eec497c419d1da89249a3623750f7daf5d41a71583343682feaa2d57b43091a5c58a7311867db05187e55
-
Filesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7
-
Filesize
132B
MD5e2e0e30a5061d2e813d389d776cd8ffd
SHA190913c06260b62534b42c0e28bac3082cdacd19c
SHA2567f8c92b4e9da2afa5a089e37797036d18e61e4f02a4885b7887c0b98d464259f
SHA512000727f5052c846e39c62ae90032db500708e5fec5af24b8cc1f3a9d4102bc7b9be025176f01722a7c72b5e8bf85b0084cab0ebeb00fde03928c4e22869c98cd
-
Filesize
21KB
MD5d246e8dc614619ad838c649e09969503
SHA170b7cf937136e17d8cf325b7212f58cba5975b53
SHA2569dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1
SHA512736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb
-
Filesize
113B
MD5b6911958067e8d96526537faed1bb9ef
SHA1a47b5be4fe5bc13948f891d8f92917e3a11ebb6e
SHA256341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648
SHA51262802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062
-
Filesize
79B
MD59f334804d984c140e3eb9644171ce6de
SHA13f24cca85f25517e9ee9cc6bfcee4f10169f5376
SHA2564fe9e95540546ad31adbe93bc4780aeb381acc9c769422a8f8aec9a1a5376c79
SHA512dec0efd18a63abf3368ccd0122d4d461b68c92c20961416c22f28c5b9d85d8f06779436b1b992e315fe649557f65e51512a74e7642a5a5dcbba9a69c6317ef8d
-
Filesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
Filesize
102B
MD58062e1b9705b274fd46fcd2dd53efc81
SHA161912082d21780e22403555a43408c9a6cafc59a
SHA2562f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35
SHA51298609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a
-
Filesize
198KB
MD5af3ad9bb747271ed257c71d1f85cc3d9
SHA129c8ba2d4d89f3d44e434d311d232239f794548b
SHA25671ce44ebfa64579e3d649ad21111ea8b2c980564aaa172e3e1578d886519d8f2
SHA512e5ee3e2fdb92127128b874d7cf6f46c6504b9afccfaac975df98b30e4a3708d16e29f3d37bc1320d286c11ea0b9033412582deb0d3117be7b3f9ef47c3742005
-
Filesize
40B
MD5efdf336c3d3a1adb92b2ad84b9e0ddf8
SHA1d12684bf46d8efdc7fe65d72974a64f8cfc83aae
SHA256a3b64fe67ea4be6fd1cad4f43ab347f08f3c05afd11552101ddc5f80fd3e31cc
SHA512d47956132f95e0f8c31b0d8e8b23a7748b4fd39b6acf746e65600499bb6dac8bf3ba64843a090e41066de86eadd02aeb9c1ebd3ab9cdee4bd9d7867febbb696e
-
Filesize
98KB
MD53020c417c60d75bab45eb5bbbc8692ba
SHA19cbf1c694914b66e445ab9dccd9787fc39e464cf
SHA256e051b84978d4d8421e774833fa27ca6e3ffb06e677766898cd3350e16c4afd11
SHA512f02977e465ce26a0935ce893a5f85e00c225bcfac181ec190c3c73722329eac6257d3d4f32599f3c917d0e708d4231bf7877d029a58e6383fc090fd78cf05243
-
Filesize
4KB
MD5f5a4d5bbdfb473f02097e03ffca59b6e
SHA175cfc1ee47be729d6c7b9c2ef619247ec7e7022c
SHA2560b1f5ff7cddb23933f264dfd46249a87cff52e0190d2c48fc8971f5ebf1721d5
SHA512e9564bf98ced55827dc6b5b95877137fdf4ef86a725007f789cc9f5dd087699a498f40ed42611120fadb77dc5272b6a2274f6e0533a2e0afa605f17f227373af
-
Filesize
2KB
MD531354a52954a1d151d959fc48a205b22
SHA1d11d308a5c9d8742579df9723a20d123af1c1e7b
SHA256fd4ee57edc4d9ca4bec7f39556871a6d27368c6c7161bc9fab76226b32863913
SHA5127e0bbeabd6f7ea92d00cb7ea8e27b2d2afd6e9544e45ca44cc72fffc6a5990d87f5492ffc69c7f923dcbb1dcc4cf847dff46103b1e183d816432ab83ed85f769
-
Filesize
4KB
MD5633df94fb2417245ddf5206df188ae4f
SHA18d5b47d9eb13040673e493feccfef708242fdc8b
SHA256b1aeddd6760acb4de22cea7283c560f2a98dc559dbd4c81b3f2bc11a65ef4a24
SHA512ab67516e1d12091c2cb30eea9e9ef0f5ec8e5d746911654c1485fd3927ab2efdeee03b4494b39e5b54e49fb28218ce2382147c67983864ca905c6c9df18c2e97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD57c771b8c5b498636011f1466d489d7c4
SHA130857ce75dbf066e360309387d0ad538f5093e50
SHA2564d9d85b040ede0bf31dd88618ad59edf45b7f9cec8bd694b0a1bf210b28b859d
SHA512c96c22271d657b042b311a828e20bde1bce7585a07cf0980a3186b96ec08da831460a33ad499f9538d5a53fbd5d622256329aa00c673f732e9838188f68d2fc2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe581be0.TMP
Filesize347B
MD55e83622f8e3e42bf87baf74f905b11dd
SHA18b2d7bb2a8e0455ecde9136485f7dbd3fd814c9e
SHA256326ac4c3fc1d1e4db3b10041f2117016587eb516f995be32e8ee0c03caf3cd5b
SHA5129f175fe6ad654e697ae9fd5d518eafe946250b376961dfe96ffe9f65e4040e1d9a453df0b5f975307b895be2182cdb5e6b512b758b06600fbfd7adef8d5ce2ca
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
8KB
MD5ead0807c28a4bcf076d373943a915767
SHA1c3ac38c5822d825ddd56c999b2f676303b79fc0d
SHA2566667655190763f13beedefa92289ad3a3edeb1a631fa42f0e2eedeb5215e7d08
SHA51273c22318ef4056afc75f5159cdafbdf8d4f1134af282f496abf3b3a0387109e5efbcd97e8d34b2191c2f21e2735ef2ae1ba036734d439b108a017fddbbda2a0f
-
Filesize
7KB
MD5031317a434e5f9b7fbf6ef68e7dcaedc
SHA1e38fd2fa2e48830d18036de8ab4243a8905f8a66
SHA2562aacd95da68f8a4c397f4c64a38599e06904bbe7966554ec9967f1edc7968eb7
SHA51210f18ac91006e36810e065f8dd609f4b14b12c5d92738b6c93d1dd81a3dd29217e84bd6a2fdd7ca9dc198b96f96e75af834f315a97ef71d47fee5daf71caf673
-
Filesize
8KB
MD55477616a192d7805d15e6388145c94ca
SHA13100fbc6baba7a71d950c9157a7e202409a68750
SHA25692e8f3615f2cdebdbf50f6d5eadfb6341171146b402e6224c0f2708424e99b17
SHA51253c383d3bab072d5220ae59e71e03cda331ca957bdb5f462167eed3b2381091a50cdfba316ab4fd5308875fd2932f86d01ad2bead0814f9f315d2b77908b70ee
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
4KB
MD5963f8a5031a4108288249f25cdc4962a
SHA198549461dec295c23bd0d25c28ed3285cd6de529
SHA2564177d99f0d60962d8245193e7630bdc0a6f376d0b168e4ec6397c952bd35a78d
SHA512d72f71fa7f6d1694d9c947bb96ba55f1bff02edd295d2d9119610282def98daa0144c0eea25d3ab3a601e3710ae4b7f6bc33eb61a5bc7cd7d5e403952ff9cbd4
-
Filesize
4KB
MD515eefd6d4b4b815a8893ce4449fe41a2
SHA1a150f93e47e9c7d6c7072d1c1261132de6cf8369
SHA256c2d6bb382becbdce3bf125847b0a309862106b04e70fd8b262295de31cd1f219
SHA512b5397ebc5ca3bc3d24903479fc9b6503e5329ff409f08181fce4702d3772579cb4f9cdfaabd7b5c7f5f5c1a7b0bc375ac055c0a788897e5839c49b8e523c7314
-
Filesize
4KB
MD52688d2efc04b797a463f5d13ed89a3e8
SHA1cebb125a80258028fd62bc3b25cdcb29408b1eb7
SHA256bd10860beb2ed3e6568d568e41ba9620415eb8e66d83e454f59b41090bd5819a
SHA5129716568cb97de00a31658d77e1b09087520854ce57c7998998f77b2dd24eb8b8630524e42cb739e4d4a1308f4e5470deb9efbc22951e4761b916b16cc2e2a842
-
Filesize
4KB
MD5239d9f9daf87b6ab37fbd825e1293fc8
SHA1288794e27baac45144cb2a437fb964e2977c8a96
SHA256ed2d4be2e6baec7ad5dfd6c349211d951124d88cdbc67a43b9705ad06faa9111
SHA512e9decc9ed8deab6292c7442ef36ff0b50fa36c1849c18252bfc7f5763d31afbbe8a5e9a1d702901922cf354bd34c229be790ba9fcb2126d41bd26b3e893ee7ad
-
Filesize
4KB
MD5bf6cef40da7a6d0cb3dda70f9cc54dea
SHA14ee90454b09a29a4cfe09f876fadbb0b796c8d93
SHA2565ebab4c8dd58de135a59c11de9811c3d6d14a6d644b04ef166c575e18ce41a89
SHA5123d62c6b1804e15b3b568877b18dfd963b8d24f3e95769289030a3709ce10920ef199c4efc1ac730fbb9bfcfba71412f4c8f91edb4dcc2b4952dfa0c2a49df2f8
-
Filesize
4KB
MD55d3d3331236f5075b26aec1c23b6d97b
SHA1701ab7ecafe52d55d9fd207f8ea9a4419b53fbf3
SHA25609a833288fb67f47858f83860ee3d08ccbec562eda125355cc6b837b21653c86
SHA512757d0bcebfa6b0b55211528dddb1153ba896a59c738e6ce26147e4a314bba3df277217ed37d3c8b464c34604f48ed1e7dd5f3ab7c512b766cb60aec28bd4ead7
-
Filesize
4KB
MD536105e985560f6a03a3d25db3b1584f4
SHA16c801cfe96a4758260a9807d32cae474fea824e8
SHA2567aaa0be19b16c0cb99b7e59f2c4998fc6efb9d5718ae2295f842ef1186d7241b
SHA512af9e1fca94037ba2cdbc48e14e2d170016aaed605b9b55e9fe860fa8342a1314a8c0135ed3e8215b7a4ce3ceb755eae88f8ca22641b6051287cda351242b717d
-
Filesize
4KB
MD52be2f204e8b784e98b39db12d1c468d3
SHA1f53f71c78353903886c0a82f1503ae04877a45e4
SHA2564f396b29f71a4f766f277241e659e83091600274e8039a7e122fc34c5a32f5f4
SHA512bcb05235268b438eacf16b2485bce5e9671ca9969da6932b2953178615919555513381945314386b5005fcb94583561a8de3969da880474ca3118474f4524675
-
Filesize
4KB
MD51e6ddbfaafc81a004ff567cef1ab1244
SHA147b49fe0de21fd4ef6ea78778e530b0a3473f545
SHA25624a835bbe0c97f38df4e004e23aef9c0248ce956fd3465d82484d75fa2d67698
SHA512355dde44a8f3caa86c5653e35f0b4eafe5ad46671afbbd965fd131f635b15869ff9b4f27ff60780f559f0b84b2bc32b0e919a29ba5c65d19d7791bdcf4a3c062
-
Filesize
4KB
MD58d84d801ec2d7a5edc2e13a74dea17d9
SHA12bb64cd8ade60b5608805fbc8e6ce783e00bfa7f
SHA2561a0e4fe440a1a7460a70d1da0bc754cbc817d50e143fd70d34354b1f33a0d3b1
SHA51263bb44cba80b6e7ab61b65b263a82bca07e9c967c5f1dffa530219ab4e77df70d7a11305765e17eb5944bf294a74a0a58dcafb2c55380195d3d826878fb55bbe
-
Filesize
2KB
MD533e9399268d0d2b1c5db4cb96c7e3b09
SHA11606dc0918fc699f5d77e6491c040461e38f95a8
SHA2563012d877f3abf2addcc03903c6355b9864442829d2aace88638327a5446a8144
SHA512599cec88729574f96570b68fae1ca7ad16937474d07a122ca2972ff86394bc81cb73526250af518688cb170881b1228683e4324b3cef4061dfa20a9de7bb2af4
-
Filesize
4KB
MD5fbcdf4c42e9b9a33b9c49e35f5240f0f
SHA10a13d826a5824b5e763d2c3dd81e2f6542593c5b
SHA256d7f1bf2fc332b04702e45acb266bc60ef738603496c404fec9a71838d6154a07
SHA51228266b785e9d34acd1353795aa3d25177c968c2f6dfb78d5fa38866d6f8738b53e3d2991c72942c5e2f59545fbee80e3c9a5e2abfe9648db6ae0ce921e897b6f
-
Filesize
4KB
MD5b080f21266497369bb4670389d1db0d4
SHA1f6e6f098573c1d837709b31a807ed7eb819663e7
SHA2562ba8d340c83bcd34bab2ce5efb03a4f69c7fd172564bb921b75f48808ff913fc
SHA5123c1e67208ee9f90c3343e44577f2c6d6ae18bfc95238a7d4eaf689f6228944f486b4e49a8d2617aa06d600923b7a1ea19bd241a5ff47be481d864bcb5f3d01ca
-
Filesize
4KB
MD54b10d22a83f31cfe469383a1769fba00
SHA1dd05188d7fb8bfdfd2951aadd4b5fedb975e6ccd
SHA256619d02a909e56f4d07587d84abc9425d326c071cb831b607c94813e821be12a8
SHA51287461a59bb51ef9c2a1485a23157b494cfbfcd02a2fd08468f686c80ebd6cbc26f4885df2ae13cbe1e42bc84c08008a2aec1a2a73b061db00508af80baf15c4c
-
Filesize
4KB
MD5143f0dfd34971737c0cd98fbed7a8c60
SHA14002447645bcf8a9959edc197ec87c9af1838cb4
SHA256ff78b4c3bb87f42ad88a778dad84a15c74fa3ef462993c460f74c83658dc9737
SHA5124704ef815b43ed2e1df5f799b544b74ea8cdb45d951d45782166c3184b0143b0a8eede38b7ed82e5189ca0441279482f4764567e693bf1644ecc443884d60424
-
Filesize
4KB
MD50530f48609f2b0dacdd54b89d7268cd0
SHA1b778e3d0cd842875e6324f82a76c1347face0fa4
SHA256f3b9fbd13d3e48292e686876d68340d6a1158d5578d7b9f886db9bdc5abd96d1
SHA5127a1b273000af6f0e3e24ec6f5935b30e4c7a85a8f34499044ea98e82afee984b6aa31a3dec23ed771f3000b070816ff9b0728a2d1496159f2499715c424bd9f0
-
Filesize
1KB
MD553c8c3423944cf58fe44dd1806a7708f
SHA16d0758596a3fc6c4ba9d9c6d3b7099d9ddfc9b6f
SHA2568eab2080c9db32fbc2d0734213e4dfd04ab099eb2f0fe0f2c91e8749c74378b0
SHA5125a220d6d38596d79ddccd72520c3a844a89f8e3250e56305aced43e3df5976e2a84835a50ad0c63d020332e58bdbbc36f77b19dce5935b418873c4dbbd65a36e
-
Filesize
3KB
MD51183f710ee9c6c30afe2c4596b5061a3
SHA1888c221735590301252f3a8f12619c531042931c
SHA256bac33dca5ee55ab3dcd32d0b695459f126fe02a92d94d0f6cd1fb93c8e30e789
SHA5125f0808ae7382da326b91db78f91e87a307631196721c9694b8d85acab999bbbf0ac1415c942cc757e931c1bede4116cbb3f5dc6739fd5f26970ebbaa59a2e826
-
Filesize
4KB
MD5ba05d15313ab4f2dfabf427f2b684b24
SHA18580d39530d88b0c54f3f87ee53101059862cd94
SHA25667093be75507791110898e4d63501b660a7b27d23beeb60eca1f2f882224b1b9
SHA512cfed6c2bae8c317edf7d911bbad456df161f61b981812c65806376630b14a5c02ab96e5d6229c79aca23a652f40f9bf9a69b2083cc8bcc6eb399c7277591b225
-
Filesize
4KB
MD50a6e855102150b714048eed1911e7f57
SHA19277dbfd57bb9f94653151efbf62afee590ad346
SHA256c50f70c90b10f71f65822d31da82c5bfa4cf629ae80becf46664b1eb614a7160
SHA512d0471554e42542248b259e5105b1dbc9d030ab661c1af93a972973ce3ae1b3ee7fc130e9fbb1a05cbd66d0a42b84dbf929d8215a026850a33d6459065ae61438
-
Filesize
4KB
MD5d03d198ebdd11f72d3c7ade6ee1f81e9
SHA1bb1c6daf22ce8eed1456cc0c662b643f039c29d1
SHA2569aeabdba2630ece7046b23fcfa48fb00831d9a430f3ff17a715ca41315d33f56
SHA512bc77f83cbcf9c6ac127b69b963f6738fc1cb29dcfd450b000e2a50a005c5180aaa390a18ec26533b247c89f6eddc8f082a2229d1cd692b7bf8cb5fe1a58732ee
-
Filesize
4KB
MD51afeb3b4d7775ab954428c2dce7702a1
SHA10fd4074ee8051c7276509bf9d554a681da1324b7
SHA256608f0dcfb433f00784dbaac59f43e9c763b87fd1dfe12b0d4a959e0f79c4be84
SHA512639e31bd799fbc3b83409ef858b5f454406e012c1b4ab75cf87f19759d126ce8cddc34304e2a3f28927a51cce780420be0a060b3ee7150e063cda250f681e806
-
Filesize
4KB
MD5fd2d46f444ecc5c0d641b49b6e760038
SHA14c281b21beed599d306d2567e6ff42a3c0e0ec18
SHA2568b65aeae0c2e604cba93e898fd32d6ae61a0c509f7cab63249de0f25ee5a8cfd
SHA512acd9f3f6c4c2ad781dcc2659a700d641499bcaefc29c104f6852ae0fcb81c56cb3cae8c3e1f9a2781c342762b4843e8de5c8d20fe0dc12c6957b2b43756b319c
-
Filesize
4KB
MD503242b31c857f3f7933ffc78e13ea225
SHA1a1d04d6b035c4dfaecd00be5259d405074097f20
SHA2568f2b6c5da808c3b6a9701ad8cf748666e0ece577cfbc60add1c5191298081347
SHA512e632ccc6d88bb5eb740f5599155bcf0f986021a33cb9e959b5b0c8e8d2d85d0700e0d918531b405828e7ffd306b5f1e46433c088637375b7501786f3786c7328
-
Filesize
4KB
MD5a41adf5abe22e63985a113d30fdd3373
SHA14b27b0981305a233902a8c7eb3ea30a7bb8b8b6e
SHA256605e90644aabc54fc7b72522b9a7da8c6ad170c7206a9c1179d785d81decba02
SHA512736da5c6f1bd30b732889c8d847809356c5e2da024e2d4262236c10c4030dc2b89369d7f8de4ac02b5e023679ad549679d22e049e749e96562392f1dca151748
-
Filesize
4KB
MD5bcaadce058426a4da25ca2469996e677
SHA17eefbe82a51a644122f7df91f643ad0f80eb16aa
SHA25611408dcdf073e385635310b477c8853cf6eb2b140e7702fbd0d0258cd170dcdc
SHA5122e879cb88cf5b0691f66258c735966e34fb8b0ffa851ae02697309fcf4cd30a47f2933ec47737eb7014e7e47c81800d7b65f5e0550154953d1bbb326b39674ba
-
Filesize
4KB
MD566443e64f78c1fb0bbae4a682afbe9f6
SHA1c4f6801cdb17934f3a8fa1f5d07df49901feb1a2
SHA2563fc35c6c6cdb38d7208817690ef06a07a85301d4b99b09a2a985d86034bdf7ec
SHA512535fe4b64381891880601d44d99a2eb05c3d128cfa1fb0cc621f173faeeaed1292ac34430b9921a269d780fc8eb12a3086b8c6de42989803280efeb2364a2176
-
Filesize
4KB
MD5e4a21c390e005293af2dcc69d7e26ac4
SHA1fc352cb30139f2c6656a33e0ccdd4ab4a6226f87
SHA25602cd36eb7506b97a1cb37b50b79640e8993275073d07eff5541a98555d7f8d74
SHA51240c69d8046885582c59fb057ff93d9aabb20d996b240b7bc59af55728c1034c30f4b172acb23b38469db433ecdff20457fd9e8149a38b1adfaabae88baf345e3
-
Filesize
4KB
MD55aff4eedf063b5706afddb85d0b30509
SHA1882c75950f516d69e363df04c197e441e3aa3397
SHA2560f6773b004b04693c7c51cec636d7462efee5a0f7d1251957583a653ed9db70d
SHA512dd2fa4dd40269a50b0b94faceb2b83023475ec6c7d54906f4d51c7769a26fe41094344a309200d7068bda42c283f808c9c3f60ac0f68ac0c382174724951e042
-
Filesize
4KB
MD5e795b1291b004ef6f91d01a6303b76c9
SHA11c4834dd54fb4c5f3a1bf3489f0ba3e714bdae6d
SHA2563327356218fd13ce082dd3b26cffef2d2a5534a7fa093ebf7a4024618df74545
SHA512d6f8bacb6a3c829d694e7410ed48d3d9b48cf296297e63671c52b5501516b15fd22a7ff4d4c60045be5fc73bb00c92409d62e6c0e72cdc1ba17427167fe85101
-
Filesize
4KB
MD54d4d6caa0aa129207945ebd79b572960
SHA1eaa839ddbb5f7a17de1bfd4d6630f3127b014c82
SHA2563ac7bdc5d1b2656bb95f51fd05f6b87380e339f4b80b4b827871a27ce7a5d7bf
SHA512e0e58e4010c7d3edea2bc14dc6da42fbd82f8dcd96746ae9555d5490148897ad351ea140754add9accff3c871303b4a9cccfbfe1eb73117320daba6c127a675e
-
Filesize
4KB
MD556bc3f74f0c6cb082168d7182a19b304
SHA13e40d78762225e6d6b87a722292413e356766624
SHA25644ba44f1d30a7e3e724241c6f74a12b0400d6ec9fef5cd3cb4a11e803d2a0563
SHA51229c37604ed07066cd5ca113806d9b334ee84243793bcbee67ff88d75ed6d71cfb7d5f62d2626d06be2bcee008a2cc3ac68082993de477021567376495ee56586
-
Filesize
4KB
MD546fc6807e1d01a34fded905c16e5d5f6
SHA1ca210e9562d635e3961c386d002c642632c48eb0
SHA256389caa148a0538871a22cd6b5ebf48db9eb1ce9e9d2f28e3394c5db92fcd071f
SHA5124732c093c548e45b1acd70586ed981df077992bf9faf4d444f8095aedb91937c5daa5775ba932501fa23afd7b5940c931dee967c2a1ece1ea567fee7ecaaed64
-
Filesize
4KB
MD5c00f4441bb9bc1bd88e6a71f590e04bf
SHA1e7110d433c2616c7aea484c6f4eb79b2540dffa7
SHA25646ab55ee9cca77094195253410a9930f1407d7d1b21b34633c0975bde9576924
SHA512d6e44ac3480b772bbc691ce430c6a9b37c065759c0d10f19be2bbf7ac132ef71c720fbf854c99550420cfb2413e807ade39c84aae9e3ee0ab24cfb52dc9addf1
-
Filesize
4KB
MD5cea008660a0e16a3418ccdfe2cd651c5
SHA1ee87c1a9022f2c1bb61d3961648370f1243d4ef4
SHA256a82bfa446560a7f24edb7fe11e7d3450e390fe9c602eafeee8d56855d0528484
SHA5120dc076d0ac429a302751905ac54efd8ad66a14afd3a007c30836b7f3089477b6f85ba297b36941ed621b1eaac3b328106e92e0e6fef03eb67c365eb3764bd88a
-
Filesize
4KB
MD5d08147f5958f1d45eb0c5f117f246e90
SHA18f3e74b34913bceae81d382ee59da8c88b8daaa2
SHA256a1d782d22be596764d9acf0a44121728264248b067951195e1247e80078cf179
SHA512cf642e1eefc96c5cf5e402bb261a8b8be13e84fec6a20da5c6b952e55936d7530bc0001cc01d2a5ac143298eb86d69629a7fc08c9a35c074402a04a0f42efced
-
Filesize
4KB
MD53154e86c8d39562c01d1921e87c4664d
SHA132b86de2db93210d4fbb6f03eb9d90fdee26959f
SHA2567ce790f530d335a45813f72bc7eae98d0e8ea3fd07597f965caceab60f0fdc65
SHA5123bed33069d1e48657f161948c5c766bc18d03da89b0623d93afeb6750789a3e748eb0b42a7b3435b5a29b99f0c3e38500838a16ef1ebae65bd8c8585d59c99d0
-
Filesize
4KB
MD5c33fafe78f39f4effde3c7fe7bc46ce1
SHA1897a9967a27a0607337390806ff04e4cf1284412
SHA2568443d62b3fe4018fcf50c45b8cdf2f3e0be205dc54f1c0ef11942a0acd7019f6
SHA512f9f3a291bdd21051ebdcf23bceccd77339591e2ee749d44ee5b9ea4fde9c825cbc7c427029d1847234502e1f0b45f704b8fb9f842dc30d7ae43b161a7bdd899c
-
Filesize
4KB
MD5208345ba38ebe8cb333c6be1ef29f30b
SHA1233c759f748296ba72087440710dee3aa26d5697
SHA2563214a7e3e61e64f99e1df680a4296788f558264b2ff90004c1056a1533938279
SHA512909aaacf0b8ebb395eed4687b0c97808afdb422b3d78c721949bb0ef271c88762cc6442893df29b4b47e214f8f0e024c16ea8f62337c5cf4a55aded250f2c96c
-
Filesize
4KB
MD56937abc607af69761fb543974956aa26
SHA1e8e85a6d103c6fc3c5605d36f490d4db4483de55
SHA2560cdd6250d2ddc1516ec081e80020f503b741e2e8a6eeea8441e13de13149b63a
SHA512f19855678997482bcfa939624c07a3637ae9b738e07d588fde64a4eee64f4a3b2d185bef181a7acb1e2064115f69a28d6f9c4e89c758056434355bd9d7468dbf
-
Filesize
1KB
MD520425c23c9d06d77e3f276b39c5b0ec5
SHA142460c737877d321b31913b0914c2aa6a3375c40
SHA256b2dad53cbd21e29d592e5bab9a3a44ff1315803142b8d7daaba98fb72b5629a6
SHA51289ce526fc3a74ef2b42ff5fee4dfefab3596c2fce0f4061cdeeb5bb3714ea911789961692156840f44bea771e7e32aa7c6d052a131ad6fc26bcd84faaef8c798
-
Filesize
7KB
MD502af760f8d766492465d453c9d0e8b97
SHA173ccddf867c6f520d18ff2fa188be7d31c752b0f
SHA256261b92ec6268236cf2d4bc5d32e527570924705c53b7a6ed804eb992da1e878f
SHA5128f0cdf41df0af4be115b98833529bec103371d9307a08a58af8f1c973e6c42b0de262857235bc081e2305867a68d7555af6a05925b90df37362d626dc0ba8242
-
Filesize
7KB
MD52d7192f954b14cc4b783f69a8dc626f1
SHA1c97894a1a3d7f95bf9cc69717a251dcf47cfc174
SHA256d80659bf794c9b37509cfb8fc3f598225c672961ff836847c0162ff370c8f5a0
SHA512adfcc76fada204d1b9ae22544948edb43249510235d6eb5c76aaf37fec2c098be55d770108b7990b50c93758d5a28af79d3cd295cce3c70c7ace3ae7f8b032e8
-
Filesize
7KB
MD5390a34a01a4293d706a75355118490c9
SHA168e806a24b8c65f2c06b68bb29733bb441650edd
SHA256369eb46de0ee755f7608c9e74d6a92850070c32093cb743a0ef6c0f1fe05a876
SHA5124d4d92cd309b65cd71c0f6cbd84d14732707e4cc26e521110859e815960d7d23a19068e74cf8a91967288dd3bf7852a662860b428f3009404da42676f299e3e2
-
Filesize
8KB
MD5bb5cf788a7963cd2437167f4223cc28a
SHA1fb90b2d839837f4664bc9ccd6a55c53f3c2ac37c
SHA2568d8602285f472cfadd952d8f5db91d5dc9ef747a9781321556c8f47a1070df73
SHA5121d86e6c6329f2ca818b281f2cc6abb0c8375df4dae1638ace63abce34775e8ba10de8fd38ce09ba03f85fd831e87529e24e819f9e89fec9766dda2ed4109b6e2
-
Filesize
16KB
MD5860de99e8323200df4f42e110503705d
SHA1c61e3972631139d67bc1dd72004a718bee6eff09
SHA25644af8fe20283014b81cac82d16db6e04a30316ed6c3009041b29f907b74889d4
SHA5121d74350a01b3bd0bfee3055ee4cb589b8b799b7d077cbde735af1dfc3052aa4c1451ff8b3bdd1cc356e0690b964bd9c6b429023fdb9d0e9c5da5027f5fe49b1a
-
Filesize
277KB
MD58f838313214170d88094bf70aadb2fdd
SHA17725a5124ca41f93a7c13b5a80314d4125c02fb0
SHA25699f1465d7b4df3ec3e9e3c2e812adb534864bf11851e2090ea7c088d49025e3a
SHA51296ed1d918c9c542b1bda78d34f8907866400ea1c0da9337f48cd5ff71c3bfa7c6798f8de5f567ef4bf3ef1b5c9d691427c9214e7000342565492db6f51c2cb66
-
Filesize
277KB
MD59a05012d67828ed96692bf8f82c75bf3
SHA15f1722605e542003561c6d9e9be40f18dbe53b38
SHA2568ecf0a3d2e67e6c1a1f87313afdfe16e66f8d30a6fb22d0a4dbcbe0dacccd7c1
SHA512f9eec4058bd8b9cdb6b2761ffda1f179fea6ec10cab2950c2142be8fea573e6b372a52bca40140cc35465e18df6461bc62ebc8dedf6c56c1433cca28fc0a69b7
-
Filesize
107KB
MD567c4424c5d2fbbb941ae6838d669f796
SHA1743de23f768d1a2b0e7a9263647c541441db666f
SHA2568c100377e178de39042cbcde192025c0f62e53b860291ec5e3e22899747c89c2
SHA512a24a7a20ee398a74e689a827e12e60df9efded38bd8c0a1f5503330eab48bf18258b4e0431f576b13b7ffdc33fa8d54e82292567278042c31c0daededf3c2c42
-
Filesize
89KB
MD5b2af86a50a2b262e93df3286875ed512
SHA16af752918da6d3b594174c3c08c22b54884501f1
SHA256fc2218de2a5b0e9a9d0801e3fcf988df8db0dd9c60652045d59a15e7f271540f
SHA5122d2aab216ccded4f944f67ac680275c3261162fdf019e59a13a4b65021afdfd3fdfc79bbc67eeaf108423743cb454f5e9dcacc087abbefa4cda8cd1293e559db
-
Filesize
92KB
MD55bfd4a1885778e508f6b45e2dc62329e
SHA108d8795cfde334ab0873fb18829dfca3e90a4846
SHA2564559941e3f932da1ded9920b0df87e3f62bdd7e0601de05a631c746dc628f2ae
SHA51230a3d5b3b3c96b62adab415dcd9eb140d7545d3a13605935137f69250484de0a8178b60bfc23f4634ac35e740efb381b485dfbccec9c140339b44cec395aa457
-
Filesize
104KB
MD5b33d9e3010ff2efc59e67266aaad6c01
SHA112ed0ab3874ed2662b479a8f880b58880cd0281e
SHA256aa756fe09c50cc6b8b75e02045334ba708e3e352be42010ff35935e1bcd89502
SHA51274da9222a567f3075cdb4eb0d6673d5fd4f81e998f0e4bdc52feda1f37233b9f9fca90c71ebfa8934eafc543970db7acf9ddd40409ee29808131c4f3f33bb059
-
Filesize
88KB
MD5cd93420191b15ddc5a0904320e9742d6
SHA1abcfa0e1e4d82daa49884928651918df3059a897
SHA2567d98559add7dc9d5814c1077ccf3d6a8aa75814d1b1e769be5217467da99cb33
SHA5127febc789ec30f531b699d3329a0139d8639e7be2a7038a657f8b381da6a83f15e48b69cc5d7d09674b792e2e48b8344553862d9454aa0b0e70551625b7284d07
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
20KB
MD5740d5efbbe21e49b08e78a63a4f47b00
SHA1b28bf093b8030c9f37c94f7b2c17e4451312a031
SHA25665c20a747dc3cd63e7f2fc629aeb1258e4b2828e9b85eb85f70ce500c8f137b4
SHA512005b8fa6cca8720bbbfd67b176f031d7dde7475503eaa9017a72d234724e146257ae16b7f9ba73a43a7bfd51f09b43fcd0e08db9654027686109689502840073
-
Filesize
23KB
MD5e4b0d20f483b4c24ecffd4678479e3ae
SHA1f0f3175f2c92922d123eac1e3a4c5bc8f6091b49
SHA256ab25f94f51f31d69f3a7ff1959eafe9ddf3fad8e983fa216c91795bae573e13a
SHA51254dda1d96956961788768dd0d5cb0ef9f660898b3b4fd1f6c02d5b092fe3629cb38f478e5e2fa5b074963616e63a235593a2de9e3fb420b502b40ded7430a715
-
Filesize
44KB
MD528d6deba0823880f8331bd4695469645
SHA1a9fb38e13eddaed233b777f4db8efb4762c215a2
SHA2562897ce935bf259f030e1c67dc25840da8793d4b58bc5fc8d5450525490d62590
SHA51205261445ce6c11d1cf49716c0a2c6c2abbc930af4b7c817d36afa7819446f7e40f740a31b8e9734a5f68a0b140f2424db8779f27bae349a429002bdb30c79e7e
-
Filesize
29KB
MD50184869286788eacac1ba69396519d49
SHA10c5f414d628c549f94ad3a74b0afcb60e5dbedd1
SHA256f696dbf8cecfefca50ea3fa5cf29f5ba98c37e723bbcd5c6381269e08be54e0f
SHA512b6bb6bec302cb11e978fb40be6ed3ad6ec18afbf3bc4e81aa5aa078c841bc323542b7a4c83037c7eeef8245c29e27d0143528f071d33acf5346ccef4fd5f38df
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5634f2c6c74dd1ae9b383ecc82d9c4859
SHA1703d285d77d16e4cb4f69fe1342fad23a93003bf
SHA25631e15f556e121c770ac2c5e7111d146c325b898926844c6b0fec21f8297f4b8b
SHA512919d6766abd2080a5299b73afc4211b328fa743aa431b71b0fa8af598aa7adf305d0cc96f48173d99fa42a695a3b769b6a703681a83c504642c9f5ee2c82a246
-
Filesize
6KB
MD5931427bc2a178a728d5935ee4d382eae
SHA1e8a3db09ded7ca71ccd04c4a44a315c6a1ded029
SHA25619287c44ea08227b449434be1a89773fdaae595fe5425f64309aa811383952b4
SHA5125c64b0720cea31bf5f10a73536adb9ed1717680c02d2756312d57d3e0674cd90ff1ac6f35e7a8e442cb0292552a9124758ecf8ae85c9a2ac243b14de638bc2d7
-
Filesize
6KB
MD578ad30439917f102281d9f5b1c060bbd
SHA1cf7eeb5323342efbba99cebd73f6b76c850b9da9
SHA25681f189659ec85b32b995c5a71eb6e528ba577895913623362d69f293e2000f35
SHA51272b1b81070bff6cfa7bbb8e78570983b7c0dec3e43e32cd42100126056acd4ec5ec90f0140a5ecbf95dfd6b54a3c3c054c382befaa185f18fdf6c9b33026188c
-
Filesize
6KB
MD55b6f02a7269277670bd40ac509efcd02
SHA183700bea08564c4826865ad929521084a54cbe09
SHA25650b78f244b2d00adb2eac77ca6f6b98e8f64465b2ae6d1f6fd088d65586c9c52
SHA51265a71ec6c82fb085ff8923d1baaccc312c0d3f84cd8288a6cd3b41676147355e99f72173fcb9f4214f375ca7bda73af1f25002f4e4827dffa348d3a3be7b15d0
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5406ccc07ff03f37b4454bbccec4f7629
SHA1a645ac304f3be03c4187d81edf8b713c9bc7f1a0
SHA256fd452115041b62e22b75c64faf8cf2265020ff67d63c2f0a685bb2ea9b11b543
SHA51240ffb2a98283ccbf76a338bdf9d221083c944891f6a9f5e6dff092eea2defb1832fc48fbfa282e3aceac8af84c0fb609c23b9f1dab2b55cea485c18d99328fae
-
Filesize
5.8MB
MD5e602387055ae7b12c23fbeefeb417682
SHA14efa866cca9693eafb65a6babfebd64bf99037da
SHA2568df68686863894e7f47069b854d07d6eb449269f527c09433495efb130f33dde
SHA51287ee31aaf7929c3ef6ddad322727185efe0702f239d81eeda85ff0bc5c873316a660129aecc3bde5809de1449efd5de0f458db27610d126a69dddf35d38c27f3
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
Filesize
280B
MD52478a7b0a65b58329c8ce55bdbe81579
SHA1b070ade1985aec4d1915e7cdc48203d3dcd77870
SHA256d0d4087f33a6cf0917ae7b1180befbb379a380596e7e15d26af2301c1c801acb
SHA512a76153d897a99d6fefc163ad1c96b645f1c0e43d36e2d7ba61eb4e15ac48fa82019dbc47db9743548917402fbb48bab50aacf0c2c102affd456eb129ecf91636
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Cache\Cache_Data\f_000019
Filesize147KB
MD5759ab24cf5846f06c5cdb324ee4887ea
SHA141969c5b737bc40bbb54817da755e3aa7d02f3c6
SHA2567037e6c967c38477a5fcd583c74892e16b7a9066cd60287c7035bf0760d05471
SHA5123470ae07eb7c54feee1e791e63a365cfb0da42f570a66e6c84faf5db6bf8395173c6cb60e8c5cf28eae409f26ea5433c3c5d6ea32eb07e5997c979c6e3ccf4be
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD50c39c7a3bc85d5b68b942b3bd452ca6e
SHA1c4a62ef9f27633d6231832a115e1f20d671dcf9f
SHA2564c99be1f3b9da4111c8b1ea63d72af90b3e69add5d8a64704c0d0bbe7c0249bc
SHA5121d333f576287da4b13bdfea41b3c9a5fba1e7b50897dae510b66e4d9e32cad31b5234baf4529838f5ad9223bf2e1e2193bb5aaa26336e2ccfb39a217f6e91fa0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b50eb.TMP
Filesize48B
MD54c139b5bf4e790b89bbf3d9a25372c87
SHA115e69c548b9ba52c2288a0e5b87198f414e379ab
SHA256c7d17bc7607653c26f1d4b1d3eba0eddce56230f058c6e68aea8b3bf37199517
SHA512e9826be5dc66340b67780b32b9619b003bbc2492c24c508920aef8d69e2edfb0fc816cc87994bdffd896c6a54c4aa0d34f0a60cf424c08cd4a209be89cf4cacd
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD5517afbed6bd7a739dc280f7536f53909
SHA1929e6174928d0612988f625b38ebb88683e23fd2
SHA256dd09c573350b56d96aeb11c3449ab68bee274090f2b73b5726b0314b895749f1
SHA5120cbecb33cf54915cbdcab8dd3a5e3d32ac100fb8999672b357cf496b6a05c7a655a44772463cdb06dfbe2323414bcb5d3e7e7d00229a93cb6d0a53142127c809
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD597252fd67d55aef069596c82fa09da32
SHA1c5c8ccf0d6507f67f8275f8ede396be977585b8e
SHA256f846dbc343eae9c198da869a74ba7d633b0c2077375ed98ca9d51cb28c6c7c7c
SHA51285fdbd279fe9c1643204d0ec13571b6f6184f1f6faed1f1bed6bb3dc954ea34753560f7837804bf6d8f634347f328b901ad952e10530e2dbd9c582bf576c8bec
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD5e8ecbcbe918906a13ca3c9345fdd9504
SHA17055bb7208f623cec089c653a55359ae369906ad
SHA2569853bc260f4ee4ee36c4fc2105bba2b53ea957ea5ec6413546f91286dbc32385
SHA5122c55dae16cec0cabbad15e430a30e86a441f5b017ef3696fd6ec7883c46cc863f1ca03afaecad82a7c8d916edcef9aadc903790732ee39db3fea0f67bb1d5b7c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5c0d17.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5705612433e43c3c29b2e765b7b3c3186
SHA182c73f9af41805e34d423a229fbefc765fee3e6d
SHA256ebba95d648561d3b5c77a232108f8b14370ab8db956282eeafab1eb7c43ce291
SHA51294bd9f332ba89564f90504d202f384014ff8c5e905e647093be0d58cce698fe155250fcf0b2a7d364db771369774ef377ae2b5699db60d16cf7764cfe0cdec2f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD50fd2bf77722bdec1f3c2ba2c6561a69f
SHA1b9f61951f692c8e9fbb7096c1bcc0af50ff8864a
SHA256d8a179da3ac5ffd5a3a317901e38d26269f738d8fd9a6416c3ca10e758616946
SHA512ccc06a3dcbe8c43bf700694217ae5846d45836801fb050600ce5ad6af2df2c9c2fec54127cb9cbb82e030c0257893c59eeccf8287af3bc8936c72c3572622366
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5d9b6b9d5575ca68574f43e76713f88df
SHA1bfd448f7d437cbe686658dbd193565d51453cd7e
SHA2565b6f9cb649eaee94524fce8d81c7b6cc02fd50bfd835575b646fc4e0b200f4b2
SHA5129a29d492e664aea70b349730a16c7d2a0d9d5a84d7ebd598324590b09ea593631cc308a54ac39957d20b65ecc8c5bb70e7a822b476fd9545040bcf75ee869840
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5b4e99.TMP
Filesize1KB
MD5365259559144f04c38b195b9d545f59e
SHA1a5faa5d7ee964f1e8176c15eb8b086ff6753c6a7
SHA2564b89f93bdba2749522c91b34133570313081ccad18975208e01babd87c232299
SHA5125860f73c878d192f935958582e1913c28ba3641ccd723a26ceae68c03bdba51dac8beea92ab787c7a679b4181c457383c5312dc5829f6c5a43bef42f98ff3fdd
-
Filesize
6KB
MD5bd51005813802f07b6e63c347fdb7033
SHA1f568c0369acd8a259203302e68d80f4113d0003f
SHA256709e4b99ab93c44c72d209f68fed93e28e626be78fb762047210a54391bf6b55
SHA5124a94e280fb4579838de313091941360bfdcae85f289c6ff9acfd3f08346b30fe1fa0116719530cc45233370a052638f2a2627fbbf601427658a310b1dff53816
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\afbc8eea-1a0f-483e-921c-ca83a71ffc2c.tmp
Filesize6KB
MD5bc47e2fa0ec26eec3ed5e9b083563430
SHA146d0fe9160951fc98aa263163c49813ef2675ba8
SHA25609dc4d79b4eca6aed15bfb5d51dabfa1b1ca5e2126984f1a6f9a7b037889a235
SHA51207d115aa7d0918b3ee56218fe01e13cfd41c11aad6605867bb814d3adaecbe3590c6bfe85015cbdd9213dc144d4b6a91d95215035884c889b2d76cbb7d073b98
-
Filesize
1KB
MD5cb7a2ed28560e88365dfcbae1f52f044
SHA1e53535a058af7d3272d7c2b546c61c3e976550cf
SHA25623e09b5e0b3bc41bbedfcbf44a517a7a9c8452a0f273fb2419f39a8596450674
SHA5127ca471c857aa4bc224fd1fc1ff8365c71accccda539891aa0f2205c251e372ee7fe0f51a4eea50c7f4cfc1ce2d1e02e948b23611b16d7f263c59c9eec19fb246
-
Filesize
2KB
MD554675d84fab358ec546a879bc73d0983
SHA1edb66ffd88c97b255466232191f25592d09eb240
SHA256a31d651973a93182dac575a13c77f0d5609700e425e95590c1534171ab2034f2
SHA512563ded250decbdd463c97381847cbfae5e3119323e3cd3dc1e785fc483da2c734ad69236b0c011357dc3867f68091e5060053baeb200148ec64da116edd58598
-
Filesize
3KB
MD5b84b6ad7dc6134a4d07b7b6316041a58
SHA193993c72ef70fd516322179fc417660d4d3486d0
SHA256da0604d1672cd4ed824fe5f2e35001b1b830ae2743890b26c15ab3f271adffd0
SHA512220ec3aff5932538bf4abfa9aee0acc3c423f9d08ebc981bc51605acb62e17853ac727af2c097acae41a44d93717d7ca909d78047f9ecc13b776c886d9a2c104
-
Filesize
16KB
MD5d521981ecdce8ec3ca95c9dee0181762
SHA1e0020cac798f0fbf3f6cfa17a3b9acaf8ab4e3dd
SHA25677891ba178eafe23ec55e7df8af50f8f68686278d30eb6d368ea95da2573cfbd
SHA5121e7c14eb1d79dcd9814f45bb3ac16c2bf7907e43d0379061a127b798aaecc1058d6620fb335d207281fafe9175e76eb2e079515bc7cddf696da3f5e5a9632e46
-
Filesize
17KB
MD5110911445c88b198cbef64e74a6f76fa
SHA10d727f329e98a26869d3bac302ea93952740ede5
SHA256d84091a1029f6a8dfab6819ced64babd28edf1c252021f27274c4bc3e1aedd5c
SHA51227b28762260b0b8ee80c16bfd80dcdf84b8aeccb59f050a9e5cc4c7b289872280e7a771ccaca09c73b199f2276e9c59a26b25bab7e999c52feaa239a0c901550
-
Filesize
16KB
MD5b2662b1dff2ed1e278f02b719cd44c6a
SHA187e10e827ab5e15e78f4eb8864e723408bac18c6
SHA2566d3e6252f191cac646e72b57ae98750fe5b66679b3cda46b8a3c26ce1d8fa11a
SHA512d17f4ed44802fac1988b909a393768f02e254d7e4503ab83bc7a3fd1d297250ea4c2e1a6661f9b492b0d705a275995cddaa7944f7e7765abb82cc3a0b6972457
-
Filesize
1KB
MD5b01d49e1877e43d03dc9a04e3ddbae6a
SHA104e28120e250e018f282b779c225b261abdd47f8
SHA256617f68d193661c30fadf2e6ea8eb3c888fb37dabcfcb006686957db0a6bb267a
SHA512701aa155a389af0ee31f808c50f371a62464b460ab166b7db4857079854d0e90771a162b9f934c5df642522ff7dabd901cde7da4ba2a34a2a412817a31df2028
-
Filesize
278KB
MD5981a9155cad975103b6a26acef33a866
SHA11965290a94d172c4def1ac7199736c26dccca33e
SHA256971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d
SHA5122d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb
Filesize7KB
MD5df3d937079b894c891f9b0b741874928
SHA1ed93fc386807b3a28fcc7988a88ae4741bfe1b15
SHA256c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4
SHA5125728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb
Filesize11KB
MD5d43d041e531dc757a69a90cb657ef437
SHA109138b427565bc276cfd3ba9f59b0c8bad78e91d
SHA2569431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb
SHA512476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Advertising
Filesize24KB
MD5131857baba78228374284295fcab3d66
SHA1180e53e0f9f08745f28207d1f7b394455cf41543
SHA256b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49
SHA512c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Analytics
Filesize4KB
MD5da298eacf42b8fd3bf54b5030976159b
SHA1a976f4f5e2d81f80dc0e8a10595190f35e9d324b
SHA2563abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec
SHA5125bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptions
Filesize689B
MD5108de320dc5348d3b6af1f06a4374407
SHA190aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA2565b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
SHA51270f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Content
Filesize6KB
MD597ea4c3bfaadcb4b176e18f536d8b925
SHA161f2eae05bf91d437da7a46a85cbaa13d5a7c7af
SHA25672ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554
SHA5125a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Cryptomining
Filesize1KB
MD516779f9f388a6dbefdcaa33c25db08f6
SHA1d0bfd4788f04251f4f2ac42be198fb717e0046ae
SHA25675ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639
SHA512abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Entities
Filesize68KB
MD5571c13809cc4efaff6e0b650858b9744
SHA183e82a841f1565ad3c395cbc83cb5b0a1e83e132
SHA256ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b
SHA51293ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Fingerprinting
Filesize1KB
MD5b46196ad79c9ef6ddacc36b790350ca9
SHA13df9069231c232fe8571a4772eb832fbbe376c23
SHA256a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3
SHA51261d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\LICENSE
Filesize34KB
MD5d32239bcb673463ab874e80d47fae504
SHA18624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA2568ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA5127633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Other
Filesize34B
MD5cd0395742b85e2b669eaec1d5f15b65b
SHA143c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA2562b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
SHA5124df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Social
Filesize355B
MD54c817c4cb035841975c6738aa05742d9
SHA11d89da38b339cd9a1aadfc824ed8667018817d4e
SHA2564358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6
SHA512fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\TransparentAdvertisers
Filesize105B
MD557d5a3548911886de2f3bd3172e808ed
SHA1ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA256d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
SHA512933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Advertising
Filesize2KB
MD5326ddffc1f869b14073a979c0a34d34d
SHA1df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63
SHA256d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb
SHA5123822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Analytics
Filesize432B
MD501f1f3c305218510ccd9aaa42aee9850
SHA1fbf3e681409d9fb4d36cba1f865b5995de79118c
SHA25662d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620
SHA512e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Content
Filesize48B
MD57b0b4a9aafc18cf64f4d4daf365d2d8d
SHA1e9ed1ecbec6cccfefe00f9718c93db3d66851494
SHA2560b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43
SHA512a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Cryptomining
Filesize32B
MD54ec1eda0e8a06238ff5bf88569964d59
SHA1a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA256696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
SHA512c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Entities
Filesize42KB
MD5f446eb7054a356d9e803420c8ec41256
SHA198a1606a2ba882106177307ae11ec76cfb1a07ee
SHA2564dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640
SHA5123cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Fingerprinting
Filesize172B
MD53852430540e0356d1ba68f31be011533
SHA1d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff
SHA256f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054
SHA5127a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\LICENSE
Filesize66B
MD55b7baf861a48c045d997992424b5877b
SHA12b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA25644071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
SHA5124820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Other
Filesize91B
MD509cedaa60eab8c7d7644d81cf792fe76
SHA1e68e199c88ea96fcb94b720f300f7098b65d1858
SHA256c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975
SHA512564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Social
Filesize3KB
MD5318801ce3611c0d25c65b809dd9b5b3c
SHA1b9d07f2aa9da1d83180dc24459093e20fe9cf1d8
SHA2562458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03
SHA5127daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Staging
Filesize16KB
MD539bdf35ac4557a2d2a4efdeeb038723e
SHA19703ca8af3432b851cb5054036de32f8ba7b083f
SHA25604441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae
SHA512732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Trust Protection Lists\1.0.0.26\manifest.fingerprint
Filesize66B
MD5fc8af1e27127535b4eea55c8c2285865
SHA1dc9fb2a8fe358f84f4f2749460ef15507e7ecb07
SHA256c76f988dee6149c0c21f7f657688a7fcaa20b0dc83881efe14d58d9be3f5236b
SHA512ec847bd27383c37cd67d9204e5dc55256ca0303c0d7696558de650b569ef8f9eb747603180ae6561f884bbe6eb519a23c18fa4a646c43d58799f01744c2b9de3
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\TrustTokenKeyCommitments\2024.6.12.1\keys.json
Filesize6KB
MD52d4de461500a8828a8f9f788973c891b
SHA1044b9052a3e463dde9d8d8a3fdb56085fcc4c6f6
SHA25653a6e5dc368a54486f7580bdefeef06cd8c940f4e697343d774a59f679422320
SHA5124a21c8baa20d899f45a0b6e545bf3d6d07b2421c5e5ccb547a8554734b8a51457a953c67afb9897a0baaf3e6d3c69d05e9f698b590b0f522d1a6d8e6109c2011
-
Filesize
1KB
MD52df2237a99f9a6581bff130175e775e9
SHA1bbca645ce2870c603ef55f3c05e18b38cfd20b48
SHA2562f4cdf7ae69b523da388f2e8bd2cd9fc8d62d36ad9e1f9bf18b49af83229b8c2
SHA512404fe89854335ca03efd360ed80ad196654723edf6b81af7e0f205dc078449359023027ee47e0e8bad46ccf60b061db4eedfc7083e78f6501c04dc9635c5f115
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
5.4MB
MD5a0396f9bb5e0144808cc7c7fda47e682
SHA176bef1c55c6f288ca5988d344c4e92ee8f3a6329
SHA256b5d35eaf2ca4befb5ac6de8680609c9a86fdc257b49d21ce4c8d17eddaa1b51a
SHA512dd49140d4661d813501d67c44d5fedd6bdc7ce731242fb33973b0b7a5b603344682fe1bc393fcf9fe3f5ad10ed9f1de7dbc42c66ec16b84063fe535f288ab7e0
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c