Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
770s -
max time network
771s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
download.jpg
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
download.jpg
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
download.jpg
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
download.jpg
Resource
android-x64-20240624-en
Behavioral task
behavioral5
Sample
download.jpg
Resource
macos-20240611-en
Errors
General
-
Target
download.jpg
-
Size
6KB
-
MD5
575f99dd2f4455ab67eac43906bcc963
-
SHA1
2a68146dde2898208eb74bfb50c90a2b5994c921
-
SHA256
950a0e8ce3cc72fa0c9974a0fd6759b5b9efd1a7e33d37f5b6ec8b8fa1b27eb3
-
SHA512
7d782e2223b85a3e9ff2df3b8d00583f90b8e139ef9fc0e36c60b6fd790c36590ebb53e2f8c04849977036f70f2e03bb723f4a97d83246e7a40b103e6a0dbd8e
-
SSDEEP
96:pnqZvyduuJ9ztAlzYi1fra0bRXSkGjmOTax0eucql3TwSn+STAoxRAmbuqwTrP9g:pqZruJ9eZbQj342L+APrvKqw6OJtHYFX
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 53 IoCs
pid Process 3040 RobloxPlayerInstaller.exe 1672 MicrosoftEdgeWebview2Setup.exe 1740 MicrosoftEdgeUpdate.exe 4544 MicrosoftEdgeUpdate.exe 116 MicrosoftEdgeUpdate.exe 4364 MicrosoftEdgeUpdateComRegisterShell64.exe 2248 MicrosoftEdgeUpdateComRegisterShell64.exe 4504 MicrosoftEdgeUpdateComRegisterShell64.exe 1852 MicrosoftEdgeUpdate.exe 2292 MicrosoftEdgeUpdate.exe 2472 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 184 MicrosoftEdge_X64_126.0.2592.68.exe 1464 setup.exe 1080 setup.exe 5028 RobloxStudioInstaller.exe 3204 RobloxStudioInstaller.exe 3000 MicrosoftEdgeUpdate.exe 1432 RobloxPlayerBeta.exe 1408 RobloxStudioBeta.exe 3480 RobloxCrashHandler.exe 2856 msedgewebview2.exe 4624 msedgewebview2.exe 2788 msedgewebview2.exe 2648 msedgewebview2.exe 1812 msedgewebview2.exe 5384 msedgewebview2.exe 5520 msedgewebview2.exe 5784 msedgewebview2.exe 3268 msedgewebview2.exe 4208 msedgewebview2.exe 2292 msedgewebview2.exe 5192 msedgewebview2.exe 5704 msedgewebview2.exe 4908 msedgewebview2.exe 5356 msedgewebview2.exe 5568 MicrosoftEdgeUpdate.exe 3172 MicrosoftEdgeUpdate.exe 880 MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe 6076 MicrosoftEdgeUpdate.exe 2188 MicrosoftEdgeUpdate.exe 4780 MicrosoftEdgeUpdate.exe 5288 MicrosoftEdgeUpdate.exe 6136 MicrosoftEdgeUpdateComRegisterShell64.exe 5300 MicrosoftEdgeUpdateComRegisterShell64.exe 1972 MicrosoftEdgeUpdateComRegisterShell64.exe 3632 MicrosoftEdgeUpdate.exe 1984 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe 464 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe -
Loads dropped DLL 64 IoCs
pid Process 1740 MicrosoftEdgeUpdate.exe 4544 MicrosoftEdgeUpdate.exe 116 MicrosoftEdgeUpdate.exe 4364 MicrosoftEdgeUpdateComRegisterShell64.exe 116 MicrosoftEdgeUpdate.exe 2248 MicrosoftEdgeUpdateComRegisterShell64.exe 116 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdateComRegisterShell64.exe 116 MicrosoftEdgeUpdate.exe 1852 MicrosoftEdgeUpdate.exe 2292 MicrosoftEdgeUpdate.exe 2472 MicrosoftEdgeUpdate.exe 2472 MicrosoftEdgeUpdate.exe 2292 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 3000 MicrosoftEdgeUpdate.exe 1432 RobloxPlayerBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 3480 RobloxCrashHandler.exe 3480 RobloxCrashHandler.exe 3480 RobloxCrashHandler.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 2856 msedgewebview2.exe 2856 msedgewebview2.exe 4624 msedgewebview2.exe 2856 msedgewebview2.exe 2856 msedgewebview2.exe 2788 msedgewebview2.exe 2788 msedgewebview2.exe 2648 msedgewebview2.exe 2788 msedgewebview2.exe 2788 msedgewebview2.exe 2788 msedgewebview2.exe 2648 msedgewebview2.exe 2788 msedgewebview2.exe 1812 msedgewebview2.exe 1812 msedgewebview2.exe 5384 msedgewebview2.exe 5384 msedgewebview2.exe 5384 msedgewebview2.exe 5520 msedgewebview2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks system information in the registry 2 TTPs 22 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs
pid Process 1432 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\scrollbuttonUp_ds.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\SelectionCursor\CursorProvider.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\DevConsole\Error.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\fonts\Sarpanch-Regular.ttf RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\CoreScriptsRhodiumTest\init.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\AssetImport\btn_dark_filepicker_28x28.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\MaterialGenerator\Materials\CrackedLava.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\InspectMenu\selection_rounded.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Thunks\initiateBundlePurchase.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GetHumanoidDescription\Dev\JestGlobals.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Settings\Help\LeaveIcon.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\TagEditor\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Navigation\Light\Large\Back.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\RoactCompat\RoactCompat\createFragment.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\fonts\Ubuntu-Italic.ttf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\ExtraContent\textures\ui\LuaApp\graphic\Auth\vn_agebadge.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\GameSettingsPage\GraphicsQualityEntry.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\avatar\scripts\humanoidAnimateR15Moods2.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxStudioBeta.exe RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\TextBoxService.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\type\definition.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA74B.tmp\msedgeupdateres_pa.dll MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\ChorusSoundEffect.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\Connection\MouseOverrideManager.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Settings\Help\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Controls\XboxController\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\MaterialManager\Filter.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends\RoduxFriends\Reducers\Friends\utils\setFriendshipsInStore.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\Chat\VRChatBackground.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\DeveloperFramework\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\PathEditor\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Components\CloseButton.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble2.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\DraggerTools\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\RobloxAppHooks.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\fonts\RobotoMono-Regular.ttf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\Connection\FocusHandler.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\Qml\QtQuick\Extras\designer\DelayButtonSpecifics.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\StudioToolbox\ArrowExpanded.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppBlox\SharedFlags.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\ScriptProfiler\MobileSettingsView.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\rotriever.lock RobloxStudioInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\Edge.dat setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiShell\Dev\JestGlobals.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\ClientReplicator.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\TerrainTools\mtrl_rock_2022.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\VR\Panel3D.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Localization\Locales\hu-hu.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\Controls\PlayStationController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\StyleEditor\Light\Standard\GridPattern.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Actions\DebugVisualizationsUpdateSearchFilter.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\AssetManager\explorer.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\flags\getEngineFeatureEngineUGCValidateCalculateUniqueUV.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UniversalAppPolicy\AppSystemBar.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence-50d7e209-c2fcb3b0\t.lua RobloxStudioInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe -
Enumerates system info in registry 2 TTPs 16 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-STUDIO RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638076022781947" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 845436.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 819087.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 663699.crdownload:SmartScreen msedge.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1408 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4748 msedge.exe 4748 msedge.exe 3944 msedge.exe 3944 msedge.exe 4156 identity_helper.exe 4156 identity_helper.exe 2692 msedge.exe 2692 msedge.exe 3272 msedge.exe 2312 msedge.exe 2312 msedge.exe 3040 RobloxPlayerInstaller.exe 3040 RobloxPlayerInstaller.exe 1740 MicrosoftEdgeUpdate.exe 1740 MicrosoftEdgeUpdate.exe 3204 RobloxStudioInstaller.exe 3204 RobloxStudioInstaller.exe 1740 MicrosoftEdgeUpdate.exe 1740 MicrosoftEdgeUpdate.exe 1740 MicrosoftEdgeUpdate.exe 1740 MicrosoftEdgeUpdate.exe 1432 RobloxPlayerBeta.exe 1432 RobloxPlayerBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe 1408 RobloxStudioBeta.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1408 RobloxStudioBeta.exe 5732 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 2856 msedgewebview2.exe 2856 msedgewebview2.exe 2856 msedgewebview2.exe 2856 msedgewebview2.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1740 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1740 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 5568 MicrosoftEdgeUpdate.exe Token: 33 5324 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5324 AUDIODG.EXE Token: SeDebugPrivilege 3172 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 2188 MicrosoftEdgeUpdate.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1408 RobloxStudioBeta.exe 5732 OpenWith.exe 3268 LogonUI.exe -
Suspicious use of UnmapMainImage 5 IoCs
pid Process 1432 RobloxPlayerBeta.exe 1984 RobloxPlayerBeta.exe 5092 RobloxPlayerBeta.exe 5204 RobloxPlayerBeta.exe 5812 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 1844 3944 msedge.exe 91 PID 3944 wrote to memory of 1844 3944 msedge.exe 91 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4636 3944 msedge.exe 92 PID 3944 wrote to memory of 4748 3944 msedge.exe 93 PID 3944 wrote to memory of 4748 3944 msedge.exe 93 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 PID 3944 wrote to memory of 2980 3944 msedge.exe 94 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg1⤵PID:560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff917a046f8,0x7ff917a04708,0x7ff917a047182⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 /prefetch:22⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6860 /prefetch:82⤵PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7496 /prefetch:82⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:12⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:12⤵PID:2508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:12⤵PID:1316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4140 /prefetch:82⤵PID:2860
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3040 -
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:1672 -
C:\Program Files (x86)\Microsoft\Temp\EU42AE.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU42AE.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4544
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:116 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4364
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2248
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4504
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDJBRkYyNjMtMzA0Ri00NzFELTgzRTUtNUZDMzgzMjAxRTYyfSIgdXNlcmlkPSJ7RTQwNDBFNTItQTc0Qy00MjIxLUI5MUQtNDFGNDg2MzE3MjBCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxREEyRThGQy0wRDYzLTQ0QUItQjRGNy1DN0UyRDcxOUJBQUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4MzQ2MTM2NTYiIGluc3RhbGxfdGltZV9tcz0iNTcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1852
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{02AFF263-304F-471D-83E5-5FC383201E62}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1432
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:12⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:12⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:8rDMJ_-5nNDRwTE9YIU3pCIGykei9kfWf_0FLzwDc4HJmvCsvN55dnrz76zqFt08DyyMeJ5sj2LIN4aBI4LEi7w2klLeUBMkpOq9KGi2npYgTKAJCX3Hnw2no-0eau0QzaeeN5-Cjj_gzOT71gA8yb6HSMlRXXapNszIHUnl2Ci9IDRVDfBrYOrBO8Hhx6xjBzfYnaRnya1Io2wlk7g2Xfx_t7O_svyLhMzht8UsW5I+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:YQjjGJqSW1PDwOgMdsf3VudvLAXmgxez9V0kltOihGA3jlqM2ZwM_j0b2mRaO31Kq5Xq3qt99miWdNLtoSTtAG9Zhv-gojXegIS9KDk7aPYP-n9Woyna59qh_WgnlzhVQ3EGJY4sGqQC2kimyij_xhRr-V_56y8YoPlKj7T5lYDzxX4g8vM5FfL0COgGqkMAYL0v0OmfXqsWNxLHZweIDbYt9qR6HUoP2zwUQB3EuC0+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1064 /prefetch:12⤵PID:2492
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:oWOLfgWJ8j69PT4_D2ZRHPdIm37gDb2bu8OWMH0rDrA4EklwgjGDY7poV5PxzcCDxirAe8yGrpTU9iJ-4jiKcY8VANNl4Rx6ND5LVfKz7i0C7CFbQrydqRH4qKGYjesYMS7lGCBvRQ7Zu2XkMJaxnlDV4QYUUOr4IAAk8SUo9s5WcSEXtlqEjG8mZnlHwnbNB2tS7G8ewxxraZTIRJhkz2AqwwBSQRkoQl68cfOYIP8+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:12⤵PID:4004
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:QmAx3QQZ3RZ4qDvow_dUszbcswlDnAYFlbD9mVecsjJnnT17D4bviKdggzE06wG7NFJ9NhXFqTRQgP2wwzLkCw-1PcuAOQzpqheODoCuNpSNZrwg6fh_SoGok56voX3PJMhjKHO-Qr4b0wEUAoQ3F5eWYfWelCd0fKkF8KXTjPcrHB1mJOUp3_2n6kIj8pTeanjU0_IAkIeyrV-vHJhXqyKs4ZdquMh2aY5VkECCYPA+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:1SKI_phMuTPAdFoTVNWv_K6kmtW1Veg5Z106TMqB-OisTTqXABoM0eU2u3R_lWjP7YL7L5fd66Yg4UoRKtQORZI2dEX3uha9LgQyYTEvuXIYvScSE5rv6BAQ6uDl0L7rAUS7zbOXJ_lUinhpJw3BzjGl3ezOETqgaTBdmkBmtQGp-GUu7v5tDiv_MGl0DS66ChnJAtnbdZ4QZBm6SMnfUQdNssjpuHJFgMiUGM7Su0Q+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:5256
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:25vQ0gDECNs6gCRedwltLoB-RMTXbOHA_sB192q4TWyPajZppd3rbkoBWUMzo8q_lnV9uhek34yjl3uGSsE69hBTUSmuzMgeGSoL4sEzQqfnHFqOdHTVcyWOOHBq_Mm3O5zdJg0mGdKvcitwKiKVlWM6Y1S2QYKAmoC0mGJX-XtdLVr4uZjiZtDiwdE0v3QOKlfzUztNXNg9CTEa9sOstpZWHiUgEM2_Q_z5tbQmv5A+launchtime:1719333839108+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719333587655010%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2741b840-9bd7-405e-ac18-b20d7509f24e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719333587655010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7132 /prefetch:82⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=qrcode_generator.mojom.QRCodeGeneratorService --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7104 /prefetch:82⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:12⤵PID:5828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:12⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8168697167002195800,4821129810427203840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:12⤵PID:5868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1600
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:2472 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDJBRkYyNjMtMzA0Ri00NzFELTgzRTUtNUZDMzgzMjAxRTYyfSIgdXNlcmlkPSJ7RTQwNDBFNTItQTc0Qy00MjIxLUI5MUQtNDFGNDg2MzE3MjBCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEODNFNkFBRC0yRUZFLTQ5MjEtOUYxMi1DODFGMjgyOUMxNTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NDA2NjM4OTQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4840
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\MicrosoftEdge_X64_126.0.2592.68.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\MicrosoftEdge_X64_126.0.2592.68.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:184 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\EDGEMITMP_5B981.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\EDGEMITMP_5B981.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\MicrosoftEdge_X64_126.0.2592.68.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1464 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\EDGEMITMP_5B981.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\EDGEMITMP_5B981.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4EAA9847-F094-43B9-A0FC-326FD8C1DA10}\EDGEMITMP_5B981.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.68 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7b24aaa40,0x7ff7b24aaa4c,0x7ff7b24aaa584⤵
- Executes dropped EXE
PID:1080
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDJBRkYyNjMtMzA0Ri00NzFELTgzRTUtNUZDMzgzMjAxRTYyfSIgdXNlcmlkPSJ7RTQwNDBFNTItQTc0Qy00MjIxLUI5MUQtNDFGNDg2MzE3MjBCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRkQ5QzkxOS0yRTQ5LTRCMkItOTA1My1ERjgwOEMzMkVDMTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI2LjAuMjU5Mi42OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg1MzE3Mzc3MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NTMzNzM4MTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDk2MDEzNzYyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hYzZmNjExYi1lZWI3LTRhNDItYTZkNC04Y2Q3MTQyOTZhMTE_UDE9MTcxOTkzODY4OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1KMkY3QSUyYk5hNjhVY21TbTBYdUlIdjZjaHM4WDVUZ29xZSUyYkEzUDRMRnQ4VW9QZEVjWlp4MkI4R21IcTVTclZpN0lIeGQxUUg3ZHRmRXU4VGlJQk85REElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI5NTcyNDAiIHRvdGFsPSIxNzI5NTcyNDAiIGRvd25sb2FkX3RpbWVfbXM9IjE3ODIxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODA5NjExMzY1MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMTE0ODM3MTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NTUzMjQ1ODAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NDgiIGRvd25sb2FkX3RpbWVfbXM9IjI0MjY5IiBkb3dubG9hZGVkPSIxNzI5NTcyNDAiIHRvdGFsPSIxNzI5NTcyNDAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MzgxIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3000
-
-
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_745FD\RobloxStudioInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_745FD\RobloxStudioInstaller.exe -relaunch2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3204 -
C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1408 -
C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.630.0.6300556_20240625T164632Z_Studio_5C8A8_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.630.0.6300556_20240625T164632Z_Studio_5C8A8_last.log --attachment=attachment_log_0.630.0.6300556_20240625T164632Z_Studio_5C8A8_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.630.0.6300556_20240625T164632Z_Studio_5C8A8_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.630.0.6300556 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=ad847d7f5168ecfb2a8f42c2d912f9c436294a66 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.630.0.6300556 --annotation=UniqueId=7609300966048174725 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.630.0.6300556 --annotation=host_arch=x86_64 --initial-client-data=0x5bc,0x5c0,0x5c4,0x598,0x5d4,0x7ff67c843720,0x7ff67c843738,0x7ff67c8437504⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1408.3720.137907643507752192394⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:2856 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.68 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff90e2d0148,0x7ff90e2d0154,0x7ff90e2d01605⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4624
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1868,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2036,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3612,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5384
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3988,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5520
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3788,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:5784
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5184,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:3268
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5388,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:85⤵
- Executes dropped EXE
PID:4208
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5444,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:85⤵
- Executes dropped EXE
PID:2292
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4912,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:85⤵
- Executes dropped EXE
PID:5192
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5752,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:85⤵
- Executes dropped EXE
PID:5704
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5092,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:85⤵
- Executes dropped EXE
PID:4908
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4332,i,14176861025765028342,7369427462684076524,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:85⤵
- Executes dropped EXE
PID:5356
-
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:5768
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:5996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
PID:6032
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of AdjustPrivilegeToken
PID:5568
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3041⤵
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
PID:2636
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3172 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{463439F5-44CE-4EE4-B69E-233CD27FF6A9}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{463439F5-44CE-4EE4-B69E-233CD27FF6A9}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe" /update /sessionid "{56B9B3D6-A0EA-41A3-9B68-ED1047537FCA}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:880 -
C:\Program Files (x86)\Microsoft\Temp\EUA74B.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUA74B.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{56B9B3D6-A0EA-41A3-9B68-ED1047537FCA}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
PID:4780
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
PID:5288 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:6136
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:5300
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:1972
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTZCOUIzRDYtQTBFQS00MUEzLTlCNjgtRUQxMDQ3NTM3RkNBfSIgdXNlcmlkPSJ7RTQwNDBFNTItQTc0Qy00MjIxLUI5MUQtNDFGNDg2MzE3MjBCfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QkFCQzEyNEQtNzg2OS00NUI3LTgwRDEtOUE2M0Q5QzFCNjQzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDciIGluc3RhbGxkYXRldGltZT0iMTcxNTE5NTM0NCI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEzNjczOTQ4NzIiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Checks system information in the registry
PID:3632
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTZCOUIzRDYtQTBFQS00MUEzLTlCNjgtRUQxMDQ3NTM3RkNBfSIgdXNlcmlkPSJ7RTQwNDBFNTItQTc0Qy00MjIxLUI5MUQtNDFGNDg2MzE3MjBCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins3MjQyQjkzNy0yMjg1LTQ2ODctOTJGOC1CQjc1QkVDRTAzNEF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuNDEiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2IiBpbnN0YWxsYWdlPSI0NyI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEzMjMxNzQ3NDYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEzMjM0OTQ3NDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMzUwNDU0ODE2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNGFkOWNiNmUtODI0NS00ZTQ3LWIyOTgtMWZmNGIwNDI1NmUxP1AxPTE3MTk5MzkwMzUmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ajlYRVlDQUhFQkxxcDRGbzR1TkcxVVJMckdHVGVpS2VHVTNYcEhmN3h0QjBuV3RIb0JjNk54N1h4QUh5RG9mb0YyWmxtJTJmdyUyYnc1UTR6eVZwdFBRdGF3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEzNTA0NjQ4MTIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRhZDljYjZlLTgyNDUtNGU0Ny1iMjk4LTFmZjRiMDQyNTZlMT9QMT0xNzE5OTM5MDM1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWo5WEVZQ0FIRUJMcXA0Rm80dU5HMVVSTHJHR1RlaUtlR1UzWHBIZjd4dEIwbld0SG9CYzZOeDdYeEFIeURvZm9GMlpsbSUyZnclMmJ3NVE0enlWcHRQUXRhdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MzQzNzYiIHRvdGFsPSIxNjM0Mzc2IiBkb3dubG9hZF90aW1lX21zPSIyNTEzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMzUwNDg0ODc3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMzU1Njc0ODQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iNDgiIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0iezJGODkzMTRCLTA1RUUtNEI1QS04RjVFLTIwRjREMDIyQzAxRH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNDciIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzYzODA3MTcyNzU3NTg3MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9IjQ4IiByPSI0OCIgYWQ9IjYzMzciIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0iezY3Q0UwQzYxLTUwOTAtNDYwMy1BMDgzLTFFOUFGQkRBMUUyMn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI2LjAuMjU5Mi42OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjM4NCIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjM4MDc1OTc5NjExODMwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins3M0VDOTY3RC1BQzE1LTRFNjYtQkUyRi1DNjZBNEMwOUI3OTV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
PID:6076
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38cd055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD505e320ae544022adea3f8c441646765d
SHA13c6266b8a8c0132a97b2785bcb9ae7546ac02cc9
SHA256e1618f31f476932871871ebc6e63d57aad643b74ea892d3d305e4125df1e6f10
SHA512c1cf5c001ddd6b3b3c68b697f8ec9f1cbd48b5881f9fc805d74eb14a13eedcdf71e958ca1b790353a4edc64008558295741cfb785e0a3824a8f3a62bc985d387
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe
Filesize1.6MB
MD5a9ad77a4111f44c157a1a37bb29fd2b9
SHA1f1348bcbc950532ac2b48b18acd91533f3ac0be2
SHA256200a59abdeb32cc4d2cec4079be205f18b5f45bae42acb7940151f9780569889
SHA51268f58a15ef5ba5d49d8476bee4a488e9a721f703a645ddd29148915d555ca2eb451635c3b762e5a0f786d69bb5cba9bffac3eeee196f1ec7ad669e2d729fe898
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
5.4MB
MD5087672ef1f8a03c6fcea3dc8ffdd2a24
SHA12b01ce0e333d858c24b785584d52ade38cf679a3
SHA256595b1052c954a7e68abcfc53df39db3ec77ac8ec66d187cb39150cd70e3cf601
SHA51254ec51d1e50b0e39a14099da13f1adda591719b58bc6f17a727c6a47461505c4d122fa2100b59029b17a755362f9c435966ad75f5a1df62c6703ab8dd5a2de90
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
280B
MD59ab6c6dd04b37de13da8e6697ffb24ff
SHA1d9cded8756aa80e92372e24f277416a9f64d629f
SHA25651f420bda8ab8a7057a82a8110c9709178fe1e61a523e51d84e5d5ac3cfad266
SHA512f7e405f3f385c68304306d1efa2096e953694055e2d7f6f0041079eac42fd22d1cbd9a16607ad4d4316e6f7e36c6a308062b0e4074084734f4f6fd07382b96ca
-
Filesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
Filesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
179B
MD5273755bb7d5cc315c91f47cab6d88db9
SHA1c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA2560e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
SHA5120e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
-
Filesize
105KB
MD57e398ade3a58ca869ebbb723d3d17ed4
SHA12491c1eaa5b6fd27b6862f2364903e8ddab97641
SHA256d151142569237be765b73c6249ae786f7c47cad2f0e9e4b2f93cfd153a4448c6
SHA51245187de975c5ceb421eb2356ba62f5ed441662cabab56820e7fc9479543c1f98b5d32a29422f029689a9dafa6a0fa46ac78c6e61307f682d0836c4d4bbd6c266
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\54fe32bb-63e2-49ae-8627-726b740bbede.dmp
Filesize338KB
MD5c811dcbb1620b97a38ce7443e2b18501
SHA1f47ef82c5c69114378ab46ed08aba17a8407a8ea
SHA2567fe5a3f2a6e4a07d0ffbce337b801602882b3ae8d6839380418ee620da09e75e
SHA512acf23d201aa1c91aba921e25016cd9703c9073a64a9bbb1d4ca1389ffa0ddc620e11e574abd1af5d30d94f1d51fefa608d06c9b5749527ecc1f31c595ca1384e
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
87KB
MD5d2895d96341b1d0c1eefec5fb110bbbd
SHA13e8cfcf221da48d743936a5acce94851d0a3a3b2
SHA256d389e6eb3728840e524e4aa67ea2e0cda842ba753df9390539fb3768651d27bd
SHA51215623935d525a08f663296543a43483551b4d888367147d7def69d5752b88a169ebfd96ef425a5cde9c1263a35c8059390ace0f94c79c390a936bf52e1e84c38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5410d6f3f8e99ba57db6506697557f5a1
SHA15166cdccea9018166592f72bfce48ee9830c2586
SHA25646802d40d6954fee7bf4a45f6ad2ab78e0827626106fff651601ad677fec32fb
SHA51243d2d5119cc6f24a4ff2e9be3b9448649cfcbd863fc31d1a1299b4299cb3c587ea034718675f21357b37068cb9066edd725e4e2779d5b78d81192b76c063f7d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5d6b4d489c48c193bed147cc880cd0b65
SHA181151cfd6784f355d95ff1f9723319c8c76dc7fc
SHA256615c99d9d449f04f216eeec11e035c15188dee4ec545fb7db1cc4d2da84a434f
SHA5120bb909a5200bd333b8932c41e2eb955a55dd89512570a0a2a033413165e8ec318b01607f0553ee283af493fd262dfd90eb9bc39313e02c65f4c0e40d627e5720
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD525c8a32c6b1ace10618336ccc5586d83
SHA108f6d3c21b23941a41e5b22eef620f059c6ffcab
SHA2568a9ddc179072ced6156b111c7cf1964833060410bfc4cfb41ef915b8e3bf92a2
SHA512c9b8d9474a2d62427446257a5788c9f073cb6335a16d83e92553e8263508d76f21063c8f7111ac6542272f50c8547e2cb85478382172cab9d51d3561a90b25b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize389B
MD508fe0155e2761986eeb27f478e8506c6
SHA1bf146bb5a226b6704cd7bf3e4e1edf247e92d51c
SHA2566cea6f52c3f6355fc43cde119a945c74bbeb503382f470c2a0239035d50c6f97
SHA5128399c7248c70dca237fa7f422248b33feac9e4fcd8575fcd14d55da91b62b9676482185af17e4dd40fdf3ec506a13acd29cdcec23dca93888cf375d4daaf0724
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe62d4bf.TMP
Filesize349B
MD5f825a8c6ee6ea8cc7627c877d37dc7e5
SHA11aebfd54b623161988d7cde7d24ac201f1d4c9ff
SHA256fe9f85e0113b950952e480f0bf893af42f5a2d21d1005a193840272e3efa4bea
SHA512d56068da9b6edbab81f98f2cd362c56f25e2042eec9ea9cc16c26fe1a9f81a0e76462a1f6bd2a75b1c7bb0cb461f840dcdffe6a2733dd1b6f248de133fab88bb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
9KB
MD5e0d932931cb2e6972db6e96176aead17
SHA114e4b816599b6b1c7e3a964196cadd54b2517250
SHA25656bd601718b321ec6336fe923c90aed09069544610b1be1b40a4a6aa0175f42a
SHA512df6fd4a78646fedda723efb6453e3270582a16c10ea365b29550467c3951f1527d12f0d588daa7bd2ac66c0379397512cf425f6c483636b64e4bc3aece57d756
-
Filesize
9KB
MD53ceeb106a268ed5cc4ac9d90aedfc41e
SHA10cf00f4fcb657197821604ccfcf24d92f21a35a6
SHA25611e1f58d7af45fbe20befd5b060dc4c6fa756e8cf05c1f96d270f2e94257d9e4
SHA51249f5ac3b404da5b2839b4d053e643678ffe05df687e5ba9781e752b4ec1e5cf092b0f1a0e36227e08dc7b84f4400a9986051de6601c7e0d7c5548052a13cea08
-
Filesize
9KB
MD5ec300f89aa6da6afc9e0fbb94bb12a09
SHA1e4b9ceec60afabd954d8e23ff7def5269874f4c9
SHA2568c39efba2cbb05c3e4fe23a5f80959458cb288d68ceb2177e84f392bd8889992
SHA512b099854b075e6f493cc2867b18938e1885e86a21b1b24638a5858366ce916e7f0a880950a53b039ac765067c8ef48b73f29b3c0692fe1e242a02d2969d97cb50
-
Filesize
6KB
MD5d92ba5866ef316bf352edda3bec468de
SHA19799b8eafb92190369cd137866e3c8654b5d886e
SHA256e5ff208776d8483a8b75fc8f0a3964057628634f52815addddd86cc1725c4323
SHA512a966b4050268953c448eef144c141066a4b579c501e7bbc875c5c7f454f88d743dd86d2307bfbbef534b1d557996f245b1c6ddd7657434a8c0e621363c6608cb
-
Filesize
2KB
MD58c331dac4f05e0a4f4a1f7abb332ea69
SHA1cf5716b52ffd91ef884a32ba6ea282d0815f0b70
SHA2560a7fad5fa4783cc1b3a63c492a40664cfc92e3db22895df3db8807d142b05ce4
SHA51202f3d5eda93144efc53b3e594d7478d838f538c81fc363a1bae55833ba73648b5347d4a45ae359311ecce12de35bfd9554339ab0bc41988cee04d6c8c78242fc
-
Filesize
6KB
MD5f4a2a4e9a4201ab2bf281120fe56f9b6
SHA1056eee17583c05f002674e60ca455bf1239d22a7
SHA2565621fde75410218b89b8981f31d111e9c581dcaf1f8fbadeb61b5d54f01134d0
SHA5125c8c580b981946f46a54dd7131d23f623ec21e1d464eb678a00508a3ed8ee0a1d2c25b2d18aaf5d03901389e078a40643522ce20b4ba23084a340d1fbaef14cb
-
Filesize
6KB
MD51e0afcb8ab9b4a0408a6de6c97bc1bfd
SHA17c2311624646c40f88c124895cc34dc8e7db1368
SHA256106e10637506468bba25b4e4315a690df83b943cc9f54c850be91b2a9b1a73f5
SHA512444f3cb47395240a5fcc7d8a5aa6dfc849b520c105c079df9a5e95434bec167a495bc593acbdef212a4b59d1f5828a12c5b6e31a16bcd15e381456910fc2c010
-
Filesize
5KB
MD567b376ffccb5c34f852a872c2b5cc180
SHA105f5d97b226858cc8c4e4d5183ee200d65364eb1
SHA2568e5874f9d040c668e87bac34665996fd2196569eef3d1c097fb6bb238d6f3c93
SHA512c342d08b36ba99246b9e5e3c6c04a649c41c298a95a9b14fd06bc1aa3c162f03d4e62b88a232ba64cc4ba1a06fa4e43ca00c6a3bf197a9b4ad0631f698988495
-
Filesize
6KB
MD56a4e18dba950155bea62bdd9e66aeaca
SHA192ed595f5211024ccb893088750146828ebbc9cd
SHA25614bf7293117fa5ca5237f2cb5291d537e4e3707be3e8ab55bea7e9d0ccf6f5ed
SHA5121fe6f5d74829089636ded8e401cc6bf124dd7c654d52577bd64129ed08e5e3c71aaa9ea9b8b54d2ffca52e2e01c6a55cb86d81aa2655f910b9f1ea73aa442a43
-
Filesize
6KB
MD53569e8915d94a7821072855c423693ed
SHA100fa574b5c72693e6dd8aa6f7bc72944c1e12e80
SHA2568db8634e73a2baf47c758d332f5d50ceba4f6382a4063f37051ec88317930310
SHA512cd790e54fd24814a64f153fd88cf2c1b6285c988cd7625b26102410e06f104e37496c79524d89a459c1a3b85dc6741b91802c9505b15242456be1f5f996712a8
-
Filesize
7KB
MD54f25aa6ab88f3f58341b46601250f177
SHA1aa2475057c748683becc856e3cfd6defba227766
SHA25656c80c808a6969844cb192cebc4f4869833aeb78bd3119eabc07f4a6079617b5
SHA51283290f56d3bdec3c747993fca3f784f026dfcac1bf079a3e41decb8f75bb6e4a1e43aabe4a5b6026758d10e899810da3f2d1ef3c2075dc8fb664c1d76c2b2bd1
-
Filesize
7KB
MD52fd9b6a208267811dc3cd194a9cd40a6
SHA10a52cc354acc1d17e9be79159bfd7bcef3c36a01
SHA256cd13385b9368bb9d9eb17fe26e0dcc72bc30a3fcb310d896e1ee704b8fe49733
SHA51284c808261f5bdef5e825dbf3d214cffbe58c958a64edbf1c3174d606c2161ec3236b4b1cbb98a1366461c758ad0e721a99a11ecd3a6858163596fa5c73f6f248
-
Filesize
7KB
MD5ba8f93d025ebe872d8430543fb9e7ab3
SHA1d8320b70cb886d96ef3f80835a5f73a863b63849
SHA256466067634478c20b86ba0b3f9dbda28310ee115d4b6735742fbd5469c8af7f85
SHA512c69f85ec0aa802dbf47df06a370b0223adf82ca4cb7be7f166393c32336ae6704587222baf3d433014f07c7b258754741637bb62ee4f9f7c889a8c5cbf3560e7
-
Filesize
5KB
MD5f659151b34c3fe7d412e3ceebce3780c
SHA1ef7503ada48b550cd90a0fcfa86d14bb04abf2a8
SHA2561b6122aa76a4ca4f99ceba8da0165f9dad20c9730a8b18bd673687051306a915
SHA5127aecb5a88b9b9d5dedd35cd2387c0d85a02afdf2c7a60c669aa8c53a2cd035ab4ef1527bf51e36c1d602946138081085d85ca607d7cb6cc549c2e27669f81978
-
Filesize
5KB
MD565125f9920ed1846f5f724bf0084726c
SHA184ad3f761a855ef27afecd58e76ba7a42d6fff4a
SHA256e74753c513a3bae669d2eee5838154bc41de271c9aa2ea5fe9ce40b72b652335
SHA51251720b3f9ac118f91751beb89efa5df93f5bdf3cf2797e71c53d466b5c532487c7da04997ed8cc01b50a2e03ae22e5cbbf10ae78fc12a8d2807433bb1febfccc
-
Filesize
5KB
MD550b49321ba88cc28efb7d12e4042554b
SHA105af406465827890e68cc47451929797ef9682e4
SHA25682cbe3b9253ea6b8cd8d5cdd51ba98e2bb4539ced0cc36bd49998294f3de52b1
SHA512b8868eeeab8cbb002290faaba422e7402d1de002fae34e580b5eadeae6fdef6ba2d7db4d2e54751c3b76a23377192578af1b2400d5ff724b0ef5d0d7f29cfd91
-
Filesize
5KB
MD5f4a1244291cd57189e44a5ff7eda4114
SHA1499b27b756c2234ded3b4a4055caae1534cfddea
SHA2566408307971ffc54ba81d0a9922d4edea552d123a52130250bcf52bc5cbadcb55
SHA512ad1b23fedc61df0245334094018f3740f2dfc60d9ff6c7549f7df81983b437315cb463e311d3ec01f1753b4385994f490cf2ee1a50193f8b0d86a36e63cf206b
-
Filesize
5KB
MD50d70cca29beff199396c40c5eb1ddc7f
SHA1321e6d4e3ecf438655603fecadb75f22fb2dc008
SHA256eefde2771692af0fbcdb92951182abc432268c7feb57da8fd83b596713ab2f08
SHA512d0802ee9a720f92a795503726acb9d2f0e47e13afc6091b84dec216f6f10ae3989edea5ec8985aac0a06f8de95ab502c9a8533fd2b0af9d290234ed714e6fc83
-
Filesize
5KB
MD5d0bdb9df7b81289377c8b246dd1c1752
SHA19c3651ef9930ed39fba7f015e77c837f8080e855
SHA256b1eb5e9a0c888d8969b8a8163d72549e36f70b1f38c44f70f5dc4ff5113a8e0d
SHA5129648861bbfbe0e43aa8288541b099ce2ef0e14bf0cd19d2a08074adbd05124ced5ebfc2c888449c97f55f6d7c1ae1c2dcc1e87863f46df7d7232d167561f2acc
-
Filesize
5KB
MD5632cad16b318f699cbdd81e8fcc62d18
SHA13f845102ec70c8d5537e2b058c114085bf9659f6
SHA2566cca90076d30febdcd28b7c1427087b0be01314909451dcb387d4ea96feaffe5
SHA512f41a3af6eb0f437372b5ae0119de80f7f25532eb8340cdfba96628ade660654bd164c6447a26cc393f325ae002e8e274c0b9ae8d99432b1cc9399ce345bb2c83
-
Filesize
5KB
MD51e6a709e6d67696021f2e8cbfc88a293
SHA177bd5998511e747dbed61fc45f10b16a8ed783c3
SHA256f6b36ee9794ac84c3b56e458da10280f29ce313fe97bdfaf2f45e7ec9a458517
SHA512b462f43762e446824e639c008936dbc7e1960bc1d489b35c879ffc4ffa0dbed675a64040acdd7541083fbacd653a94822b88e25523e031120e80d910175e56ab
-
Filesize
5KB
MD5ac6afb6b378c6046184fa8e4b93973c3
SHA1507c2ffca3be344ba08276d3f50508c417b3600a
SHA256657df984894d80395edb18c54e82dd4e365d59d3173dde0399a3db7e4916a1d8
SHA5129dc0b7d7ed6e191848fd17d38ff845a0c6d31510d6990deba2869cbbee958621456dd6ebd9536f1600e4d7f7d483c4a73d5113c3c1f6c667d08baae4f488321e
-
Filesize
5KB
MD53f92f821236a2101e9e531558db35af4
SHA1c5c2058e8f862882e51540d2b25843ebce4b10d3
SHA2563598b75bd47b1a5241525fb69e428fe85c1e0af8d9039aa26dd363860c5b06b1
SHA51214e0c923b7b62f9472b2ef01c72592140df94a28360292db6bb0d998a6aa1e7a1eb0a26cf8c4cca2376f9980046eee97f292a315b8dbbde0cf2e4631c5776d5b
-
Filesize
3KB
MD57e4f79c58524d782f30c039bf04b3283
SHA1ea04999b4b6451809b74d6b3b283f93b729ea56e
SHA256999394b37014fadd818f0ff397972d42f9eb210517ef81c2bb2471d3f9120184
SHA51226bdd282ecdf4ec73b3301f90ec7a63e97eceb2b82b02d520642d77242932550599d571869e048deee0f6e5ec7d478fbc38c253bdfbeb99d18fdce55a951ee6d
-
Filesize
2KB
MD5454c340e7218f3f95a138f3bda21d2b6
SHA10868cde0abdd08e356d2eb5502fd8496e303e231
SHA256ba3ddb11da16541a58016ea4cacc4a36722f639435352c73918c99cf66834497
SHA5124b83ebc832c81d0a0c729d8da188b0fd3bc16c834ae57f351ec9ce947777a05c15538aad77598740602142b43ef9aa6a65beda8f7540b28970419d2fe4224f1d
-
Filesize
2KB
MD5dda2ad342fda7d10b00cedd81abb6bba
SHA1c12c049df53c6be7de2f6d7e0042fefc01a0c393
SHA2568a648e1ba1e47db8112a2c43093dafedb29fae37a8477bea6a6dccdd3b595b65
SHA5129156af34301c54a859979b0a543cd36430679e82008635c42f3c25bfe94a0a94a55102194b367fd11e75760828e985e76136b60d3335e24e7eacad9a11cb198d
-
Filesize
5KB
MD5c93454a3ed21fd1595c934951cadb8f6
SHA11e1ff68b3e4e25d3a63200025acba2d27f2146bf
SHA2566b416aebc50d4d89e427f325fd0752486c6cab64aa73af73435dab52868c6e4d
SHA512d671ea2227a43e975c3bde137b2c7da644be8c24c3643cd2cd369c02ce47cc65ea8c23aa56ccef7a884efd4017742ada54b16a2bc79fa4fa57feb7b62cd76e50
-
Filesize
5KB
MD530aad16600923426b60448168cb962c8
SHA13492760709a29086c4e30637672ed8dad9e6425d
SHA256f9a96615501be62d82d0bb3ad09102b89533dc90e9091e8f7f336645830b70c3
SHA512388d2dc5794df8a147188a0ade2f142767f9edadd7466c05203696a3ae1c2694cdd0a69354f884aa38587d779e30fc7f3514cce79efe097d7c4460e59631cd88
-
Filesize
5KB
MD500d9d4db18424037602141f6cdf2e9b1
SHA1d973a30390e4fe3b9c0c90a06d316e82c78c3358
SHA256aeaffd9624f75358ff05973589c642037d075340203bb55d32242afb7100a82d
SHA51235f0bff2cba34102f46aef2354a9889a3e31ff03832255f8167902512a7a184548e1ccce109ed6abd106762b928cbfb68632e5d0ccf4b6beb4f6800ddad07fcf
-
Filesize
5KB
MD52e90f5e971d02046d9bc646fd9ac5391
SHA1195c2e579ea445a1fbda242cca800f4560617951
SHA256e35ac04cdddd3aee2b22f2279542daf7b192498870f624391e6826c9210cafaf
SHA51219785ecee82f1715294a6589c3d77de49bd7ed2023afd86f91a1e5eabf22b60503831362a30e68a481fb5cb13744b409ac64b0b242386191c5fbb64667d9bd46
-
Filesize
2KB
MD5441be4bc26242734e215b664f8f65c3d
SHA1690acb6631fddb8f15dc5bfbc19a534d668f9a35
SHA2560d38a18b382a1c7531a99cc3f65cbd042a137c518838782d1f45a3149f1ed3b7
SHA51242d73f365c57ceb782dc1969aa04a6381f354481a70985c7dfd7372bea4eb53227f3b5efac9c1eb6d32dc6892a93e8a7fcfab01e6639dbae779b932261027458
-
Filesize
5KB
MD54dc1fd2bddb2ecfba43c7a15b2f2ee57
SHA1e195791f1f3558457077b3d6177ce0c0f1b6e1cf
SHA25663b5663f47aa6b73ff9225c3330403e635e73dffeb93a3162813d8c8f0087dcb
SHA512a88ea357fcf989490973aaf77419b4f160101b08068dcd550bd69aa50440184f63a6fa377b9f094221c253c37308c94714fcce8f90f2544497d7051bea30a686
-
Filesize
5KB
MD544f4b111f1a2e56cafcd1cac7da60087
SHA1db6267cbd29a8a331ebcda3ac7cca7fa04897fcb
SHA256cda330193a1503de5a928cdda2de3a38dabe5118d6ca77d663dab9d04d65af2d
SHA5129cb6bec689ee820f6d143b873f45d70995fe87bfee0ba605b1af3f006364ce888d1ba19c7953dc97457266e991cdc17ed47dd3c2daeebb8881e64c18e2a297f5
-
Filesize
5KB
MD54adc0aef6bd9126074c1ddd1ddc777ee
SHA1da17a85de018662f3862c569d0311a775372084a
SHA256bb1ff9e668a623c9873bf1a3b17b40ec9b51510c86d88e0a4ce1d68f8a4af955
SHA5123e7c2f6871e5af470e623229eecf6b813e94bab9f3ec75439684b5f36addadb153ce1f05a12e35fbd55236985c0921bb5559f0e2cf3329c8249887de5fdb74b2
-
Filesize
5KB
MD5ca710eed545dbd856bc9583d3088c31b
SHA110dbf810dc0b64d2f76e79fc49791473a0199c9f
SHA256603b2dfcef6b1a2d7d112b08e85487760e0d94bfce194cf40749cfe27d967f5a
SHA5127eb65811686cc9505b6f5ff5970571b7c1a0875a3d854e67c0e4c39b0ae2015abae7d9a318cb22f3db6139c2f3a2c991995381f6f6cae5d4ee38f21f5eb69747
-
Filesize
5KB
MD56c1ad7c2a8f59c403cb71a3e1df2e258
SHA1663b8892d104c0842b6f3a2d24d1bfa7d192f0d3
SHA256f3c30300788a648333a03dddce5f2c5415c9d3a50af89c028fad6b381283d18b
SHA512e5b243df8a610c7ef5869df0f2ed7c0bfc92fbe9216be4b918db1ff1c9e47974bf9e28a4e94f95f521b8ed26abd9c3a65481deb3434a15f8ee2a3a29534fb4c2
-
Filesize
5KB
MD5ef300d732e939a3ad0e6ba8ff0ef70bd
SHA1e1660b4a9e22b7f156659862cac5f9a00dd401bf
SHA2569cc87df5aee12c084c7e1bb0ab39964d9972e06f56363a7737b39c18069bd5a9
SHA512883bb7f2f89c3966d528466a4a6786104962259521d2410e235d8dbdb4d5ffeb17df33ccd0780f889ad74ea9abc7512d81c8c0c013a4518fb921599a4dd814c2
-
Filesize
5KB
MD5666f6f66e13440f5fcc1efef739979b2
SHA12f91a423a7ee6d19ce98d632095212db7756870e
SHA25602968cd0e84161976bf4daa664d79894bf9844efc548ebfd99b11c1543d2e7b5
SHA512654de0cb4d4d01a369851793944e530e8288ad2e4135ae7e1630279ab58ad270baedf8496e97d33ca13e76d7ae2dfa9458bdda239cf189d3e2058ac804d084ef
-
Filesize
5KB
MD5950853dfed57b87c55fe343ec6bd036a
SHA1627b0cbfcd1241817565bfcfc6fefecafbb2be75
SHA2567dc464931cc92ab579ff2dac50acd60a483b374b2fe27b262b1ddd3ddd8b92ac
SHA512cc48735485241e0cc911342c603288931da4795e5754152af67c07beac0295a863e821362861d90f391114908a01cf9a41da24f4463def36b806bec4ff63b7f6
-
Filesize
2KB
MD5b0c99ca804c7582082056f910f03424d
SHA12d281bad574fe59b1b391fa25c46c617dd51b238
SHA2561481b963b33cd28201064c09b487cf3df1def64e3aa7799ef65ba82dc57a06b4
SHA5124fa219899021ac8582dda8116f06cdfd8d8dda033bb1623139d70f4357a3319476baa8949f38cf8f7a1d8d941a43fadc73bbbefc11acf832477afa4765923b5d
-
Filesize
5KB
MD5407cd7b5983c3ac4815bf879942a80e7
SHA1dc99564a196e3f47c0aca42dc892a39ab4d66bdb
SHA256dfbd720ea7860dbc55910b98e50dc8c429858752f026b675ce9f956c5f82e476
SHA5125991cb3a494ec8f88813523eed463ce4ca5f0e487b0815c155a3909bca84e848b98ac316ccf89fc2c48dacaa0df4092b4efb4d50ce9f25eb78275aae5aa1f28f
-
Filesize
5KB
MD5d4c4d311c1bcb84ca4372ef230caf4fd
SHA1f705b89a832fcff59316f81bb197282d3ece8baa
SHA256e90e2ecfb62c18c255f8c85c6de6ad94d6a9e0c7d30f1aa3df24d87cff93206b
SHA51223151f077fb2f1ed6e8429f1124aa6957b670f118aaf128df079ba73277786958b35c4bd1d13d739e94c35a52ea4ef53931e75a1dae031debef517113898a98b
-
Filesize
5KB
MD51c2e18d9b3c0ce4e90df519f3739aee8
SHA1242dd9d28b2db697d951e92767aada408d624140
SHA2568be7a749fe78be8791d1e38bb406b3eece95c43132d162fa513297fd20fe571d
SHA5124529b50e0ab02a4280101591b221c833ddf58728ad01f08dafaf1c516ffc425da5244945cc1d2efec8a1cd080332f5bdfe5b0caeff4ea9f1090a5957c207e894
-
Filesize
5KB
MD524d772e4862d95f566b54fe872bad91b
SHA1a8a7f36e4060cb2341853200a5d225913e4e77af
SHA2562de0cb8dc316e41220b65bc8b28d0cfdfc93386afa9a8b42eeb0de359b8f6a34
SHA512d18eb5ca0e3bb3b971f4568ece3e77c6ac1f17b869a0883f9f2801c70cfa701f3a6328a4e68209402d7bddb7587a0a47b3b4e7a494bb0016003a8d678e5a29ad
-
Filesize
5KB
MD53b80d69f7e51671b84c04d30b49b3976
SHA1153a4e37f4ae6e5c35f8a969a0a1187464027527
SHA256d703040144b2a5bb0e0daab46fcd017c2db56149668c7ddcb2b1fbc259a3eb5b
SHA5128bccf1b54b27a069ee91cee2c7af18f31f9ec4eed91357e89f164fdece7ab404512a01ad15d1c92bc71a28d2391a1c43085097bd4d010f7b5f93507104a782d9
-
Filesize
5KB
MD52d4fc21c9659c9fd6e7410e124c3375b
SHA10ed404cee4fe0dc4b86a85ef5949b6eceb7a3733
SHA25612b178a91a7b1ca23c06ed295c475283b843ecbc89a78ab6027db2be5dfb84bf
SHA51227db701b4abf3b03aa5fa6b1fa63d00a873809aa05d1cb6bd0580b98dd5149bf0b3e8b2df7d8be958f1436961969ae875a2bb829c852c0a836a80b3542006e77
-
Filesize
5KB
MD57ff532dd8ce963af5fa980758cf23268
SHA1906a4a5e9780ea3df5dec423be2e9d4359e014e5
SHA256688240b80bb0a586de126e08cce37f17bc813fb563c406f2e7ae56c18c316d24
SHA5127b807b975fb71241398a70a70b529795095e5bbd29e605059c18851edbb0538d0299837d5791b155fd376c0dad39b9ac6b82347b094986e5b1d807adfbcd53e9
-
Filesize
5KB
MD5cad228579aeff97e110a2141344d221c
SHA16960f6ca1f4213a2a20be9c19e4b083a7dbf19a4
SHA2569b0124c846b6897696ac007529a2c54c70003d08818708e374ca84b5ca235c7d
SHA51204df9e63ad0caa7f384adfb27c0286840345e5cdd6163cbf464894d032faae761f9db47efc5bf935bf327f5ae142bae1d77e4ce4070311fd641b62e8d053e25b
-
Filesize
5KB
MD5abc7666867ef0b1792a62e70233d6e1f
SHA190ef10448da45bc32adc5e19fb66ba80d20d9217
SHA25615a6ddcb94fac2d0cd55c3454ef2ab46accc8c8275819228462fb48349bce70c
SHA512ff65db5f51881869da47bea1f79fd05a4a637efea9eb33b477c65f19ddab421fd7546f7c1182c2c9222bb33509df56b10330698f3eaf49591feb931bd3009ab4
-
Filesize
5KB
MD59e05ae8f92b046fa9d63abcc9a94de40
SHA140bc3a038c59b640f257e84729e17637b9f1197f
SHA256b84262af3e5d6a67ee2f279941fea297d5f859b06de4c3cae6226413f5ae234c
SHA512f6237f0cef3654fc7e3b5d888e10f957c97ab1d0dee1892262828ae41f95e2dd04b0b435f20c763a61a0d3c3ba8dbe983dd214b228d5a0d4598cc7a4377cd69a
-
Filesize
5KB
MD503452bf4c98dfa7ba128d88cbf44710b
SHA141edc3760ba7483e94e7a250a25b4f92427e47bc
SHA256cc5517980131ea86327d5bb3b0e76f3f0b64c29f4f15801f46809028fd38ab8a
SHA512b005b7438df764997fcb50aaaa573faed93bbeb2a9868a214b2d710f6ef8cde3b2f1cc4480fee5491abe40cb1b3d569d412206fddb3ff00f905d204d91999e73
-
Filesize
5KB
MD5c0dc9dc902ff90a976566b86cae5e961
SHA18ddc455cdaa46261f4203dd48909115c80d0a8b0
SHA2563ee8f37f7ef9196ff3eeece85ab46a17e25cdb0dcbb6cb078c0c174c62288afa
SHA512357318cceb6f8d203a80afc7b7b97ee0b0163d35dcfefd6af429250d4a71905b6f0bd6c7d3428da75ba2065338c656b64af7ab6830267df8ffb72d87be3475e1
-
Filesize
5KB
MD5f080b22872e92bdac2e99da6072dc65b
SHA1595df041bbefd89a8e6e6332409980abca64ed92
SHA25686b56945f9df3228629a03cc760205fddc1474b9ac65bf045d9e64b1c2abb436
SHA512631b95ca3ccb65885c71c3a8f112030fce061c45d2e71aa94aaa3c845603f9107b72929648a3a683bb23a12ee9a586d6c19eaf7650f9b39ebf5e2016b4f5e25f
-
Filesize
2KB
MD5e7280e53fdf90b20a2a637632f26409f
SHA1fa8af1e5e6acc0fcdf07f2ceb1593a9270c6f8e0
SHA2566488c23b17077b41fadfc4e7d17748683962acf0de472d104964636de3ee48db
SHA51275fb72f29fb4e23968745eefca216466b9575779a9e9c96213382ffe81e4950361c8373af7d69678f14cf7fba0ee719246344d14476769227daf16b0ab9eb0a3
-
Filesize
5KB
MD57e8573aab803aa277e662afbace2c714
SHA1c860addb0665ec6a1a0ed4f714c8c157cf95baa0
SHA256d3455df25574ab489a4cc1af9436ed18adec6ec74c93230e5a982d667917349d
SHA51254703f7ab14af3b834601cd8989eef8e129d9e72099424a6faaeac95ec996831dea1b3b634866a28dd7aab090642f32ad19b9e97de26fcae5c826d5b64bf24a6
-
Filesize
5KB
MD53f5ad3140bb06f7a4dba5c1f97196a47
SHA14dce772eeade43dfb426b1ff001a03c1322a924d
SHA256cc5d0dd2952f5bf30c5be51faebfa558aca2dae5c38402342609be3842984d6c
SHA512f8ed1342d7e5521647bdc648f5203a0dfeb9322fde37def5761235108bf9646f9ce7563b2d329f900762722e02e9d9d01997c90dfcae11282490cba3e5d9c0a9
-
Filesize
5KB
MD59b5f84cc9bae4dd024f2652c416f2367
SHA1157f67d7fb502e776dde85ef77d9a1157edaf28d
SHA256bb7fee9e3c8f6ac803a53569852158c5f2b04b71ae8f8c4cc621f129e79a40fa
SHA512f59589dee0d9a211bac0a2f5de29144f24e4d9f3daaad9e3f27b5923d77352c38d0f32b0c9bc52616a3f10d673185bf83eab0b7cc9b3cb597359d34f0ef96a08
-
Filesize
5KB
MD516f8ed07f7ba783d4107ed877f74e98c
SHA1c0cc07ade24fa38447cba2e408f6cc9e5b44444b
SHA256cf40ee5d694dc4e68120101d5c45bcee143492accd0784e7bfbc0c7e863df49a
SHA512d281233e0f8a5fe8622c54560bda1943b051c5422c7881165019702824f70986ed95cb72a3415a922647ea0eaf3bd38610baf0c8155cdcb60176354d5c7df4ab
-
Filesize
5KB
MD5c7820cf449841b74b1d5417b87feacaa
SHA1046e049e17bdc8ea68527b990f904c696c70506d
SHA256d15dbaf116965a7f5f3f674d37d5f3ce0fa0893d5af299a0c9dc7f48852bc9c0
SHA512e8173955c49162ce363a3d01397a573b50fdd5fe4c218fd64b7b971bf4df15725e13c54e84ebb992199f853f888b10619d1256b621aa79b101177583c83348f0
-
Filesize
5KB
MD510f0dcfd875f66db1d7146c215c35c0e
SHA1efda92ca967dc2680931c2afeff55af6ce640b2f
SHA256769092ef368caf934ad8bcd977226384547c30567cc18aec9fd22e530e66b063
SHA5127a3302cc56027f196f0f42324b33f09eef81bc0f58fa14251e0a85b1e777d0b1a7b3a869e7fafc0e8a26b5e06b4289f6fea6b4bbefa25e1f67c99554d63db52d
-
Filesize
5KB
MD56776185fe3947ce1b9644ed4ee3c8a3a
SHA14134ba4d257d3902d00be3390c6dfecf389b2eea
SHA256c495c3e1cbdd9681446f4772b0d31baf6e2791df5ea0b5e53db59cb2ed8cc88d
SHA5122bc7b62dedb97cdb0e0e1ee46ba208287ad8cddb12d6568ef1caf7990e9da8a9d1fe68272c3740ed90c570169ccd2fa85a71494b0dc325b945edf9f5185ca5a9
-
Filesize
2KB
MD508ba8bae76bcc4d484e96d6751faddf2
SHA11a588e6e084717d13e5f24ec8df7d8b857817a54
SHA25687f4b3e7e7f58ce7bc65ea3e4b0e3f0eaeb60f740722f0ed9007d7be5e5e8ec7
SHA512cbc2072954a1e5547b1f5ceb944be13bbe881951a980da26e74e74156d41daea1704fe04a97486a57221d82861d3bdbb99f355a9e6a3a0bee05c2ba405bb25c7
-
Filesize
5KB
MD57d81f52c390907399cf3ce4af48e3726
SHA15a5ccdfdae3433ab8e7b203568112605908054cc
SHA256612be8134417033796a65a50c4003f205676cc3e36719cb7c60b82eb1dc9b2f5
SHA512a6bcd3585e812897ecaa55d76ae75abda87d1d94c6c2fed7ab6aa319820a4e2191725b0a2e3ea09dab6b66b82da159cd460efc10d3e663567c3913e69723ee61
-
Filesize
5KB
MD5759bf9f4d2a527e288b95dc812de5ea4
SHA192e2ebfd088573f60531c97c2f9ebac44c119a2e
SHA25636cda1357cffa1129440c2d1ff4d33d0213eedf4b9a63612d7f61af585527d9c
SHA5127fb6f0ab3245da01f06fe0ca47e7eccc2c1d82a5f391d1f9c73454e007d89faf0925cbcd9af149b701fc587803aba4ca75993fffe8d4e48877183e734f4ad0d2
-
Filesize
5KB
MD5dc49eb4dede5f3258d81f3b1c732ac47
SHA15a3809a45841a94a40dd72df485f756c7b0d0cf6
SHA2565f00a9a63402210438da06bca5eecb6afd446006d74af94c2d7d2415f7b98c72
SHA512a9a179c158b1acb7778449cc2d1f5785cdd5edc96d67fc09902a1c62eddedc7ccc6c20834e95cad662105ea1e4da02e5c077b5776b46368dd3e15b4f7c39f41b
-
Filesize
5KB
MD5c5ff249080864b7acb736d476c729770
SHA17522a998066bc867a4166f2c2e63ce516f056d52
SHA256dfc777d93af38526e550a8deaee2d67c0f77a4e4f4411c41d58687d358c54620
SHA5125caf0de1a4ba25ebf1c57dfd3496d56640ec64f31ff1bf026fa4eacba7e7c3485a1fdde95ca308b2e46d88240bbb4579785114d10a72469ca6ac57a4393dbba1
-
Filesize
5KB
MD5fd53fb745cca80f4c58c3b27d9ce09a1
SHA177ec43de27c2e035621856039928cbe00721434e
SHA256e065f6de7517395dcd5b393baaa7717652763d775fdc7bd070da11ba0b394037
SHA51292588e81a22d4bec54f0779fd9a623fc05ad059b6a368af27c9ef545e8ac8b6f5fcda5f975c61d7c6651eb695ab009790610d8b40c4c1faf5ce7bc51568bfb19
-
Filesize
2KB
MD5a55e7d7192f77eaedcba28034d932c0c
SHA109e47896378e2dac0d545c15d51051ae7fca79c6
SHA2567bfa91b3a5629d82934fdb3e9496e7cc4c2b862f7b5385bacd6a56b7f84081b6
SHA5122cb12ce2a9843a09ed21d97ebc65c4235269ae07637938023034dd4315de13c5c7a79b30ca4e0b11915463df106b721176d1c20af7eb1d77153e3a284be145b8
-
Filesize
5KB
MD573410495f1674a506636ebf6d30819de
SHA186a086ba960ee8e6ab3941c81f1ea8ead31d9f44
SHA256509f9f32099536426b8d8770060740e3c170c1a92bd399bb4fa1f3bd69bc8394
SHA512912409039d89d98feb9d7a89fe737a126b6f491c2405b0f5b27b7e6f47b7b699313962283bb74ae8b6ad97eb71b91b7e1d74fbbb29b0d9a6beb2588884810402
-
Filesize
5KB
MD5fa2ab641a88f9f07ddc19d52586c2e6a
SHA111d6eab8b197bade6f252b0e4edec3f240d88236
SHA256a83f1e5140fbbe9cdc04c8f9e79c30a1e456f1492f59dd797cd442aa7c092323
SHA5129c3d2c7b2def888391427e02da781b6ff9d21b126153670f6a64ac4c1b3fc115c0a4192c32a794cd07081c0823907030588c8853bdebdddf01b55cbf0500ecfe
-
Filesize
5KB
MD586ee0b6e9457ec131285a2d589682695
SHA189fb01d0149a2cb52f4585d660300915d773290d
SHA25651338721edd9725c73188c0f74bdea8883f5456c9cc5ab63fb563986539903ca
SHA512de3339db46bc2908adc0dfb8c29aecc27a91c749bbd0e5d3dcf2bc45ee18627d939bf53b8a22f1db5531f8d642cc36a229176480e6bbdc29d7d140d1f4e9dd51
-
Filesize
3KB
MD566971cd2d157842d8715037c039eaabc
SHA18aab8e76e294d2d6f5832cea301b5ee9776af03a
SHA256b8251077ff86dd03012b1ad51dd48fe09808084192c4e4157bc0c97df19c3ce6
SHA5128373d44bf387b6af176aeedf2b9a0b95cbf302a2b84d1e1ef7a2e7f343f29fe57a4df1ff935f41b169571ece06e18ada565c1f070c139ad7879bb82d5e146feb
-
Filesize
5KB
MD52ba025bf368c9d75ab9bff519fea91bf
SHA15231abcef4688fd747b36a2db8337550147f1a41
SHA2562935928788bd6fb6eab5f4c51f72af07775cf5bf4eb711622c456d0865f7076b
SHA5129a70cc3f95c5a20ba967e4f662cbc7340843134ef85d8f6008ec73b6e9edf16094fb374d4c5d6844ada04014fcad2ae7f532c331d661aaf984547eb5014c7313
-
Filesize
2KB
MD50c206e20cc2ed12c3c70353ff4cc188f
SHA1e65c0cf6a9b4d8a0a6c4bc24d768b927e2138b15
SHA256a6df086fbf10c385e820b590558bd834e10fd48a1d92f90205ddb025dd1d2844
SHA512203c05042e26c0448806c71a2ac95455f6d29f3016886de28d88e54746c1b3c0f72b68b2a96738b3e64d94df4c9f8336c77141d9e85c22151622e8f19885074e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
12KB
MD5f5674610441a3e1b43a650646258c988
SHA11986fb642553cb91e4d2b8d4fdda35be258f32c7
SHA256bf9072ee133e8b0cd0180dde96d03325368ca5d6c01661b686395b0d53cd8617
SHA512fc78db87a06a787f60e9f387a07b742fce4f3ea67bb9541d53aeb6587c446cff10bd36f72cb2825df825a8b632d7188c578b6102fea680d5db6ed063f3617c32
-
Filesize
12KB
MD56f2cf1b334e996d18e4ace78912f8c3e
SHA10c6ce09e5dee15786fb76ac74e7bb5ae48bb511f
SHA2561d877762eb1a26f82626f3d8144953b5d44a4f54e950f9899cbc9d21cd0b4ec3
SHA5127c7163af8b11dcdc3672db422a1ca8b4d24a2d0d1634df0d0275e23a2e64ad4d18e5774b967178a334d939692d0dd1b595bccf5ba4ac1017730e39a5c4fd0840
-
Filesize
12KB
MD58438bf3f81d87f7519387442e266f41c
SHA1db734150d18e1cdb3ecdd444c1e3cca790b9906b
SHA25610035bd5d194cb7f557b1bcef142119decf4c1bd4c37daf84db90403e4fa1036
SHA512f2633f99659c6bcc1122fe508791795b9bed7fab4aad73ff72da1c524ee83e3c29c8d2173e09d69b2bf6fbb8b8a234d86abaa50ad49cf82981b83fb4263de115
-
Filesize
12KB
MD5ccba74b374bced8f0a88842a221212d1
SHA19d52352cc82a0af75913f47630f8c28a38538266
SHA256f633ba60cae2fce4690b1a2207f79b82469a13003661796b73481a013ef56158
SHA5128a97df3f70443b8ff4423b25df350a98f60dfa850726454f5674543831b49af7d4d2c4d9766b8f6f62c00edd660b780ac7181294521c1bb9d8b15c7f75af54ed
-
Filesize
12KB
MD5a7b3393109eb3c386dde1bb964279cc5
SHA138ac943d3732f38b1ad2c673d171ecb8913f09f4
SHA256ea2c577919ca705ebd64871efc639e8f4803ceb6a771ce4bf198c60a5441a4a1
SHA512dc2772d2b566575758f601eb6b5a994db27bc33529736d70f27290cb86a1154d23f19c5caf020021f0ef83132ae7c78e639b6796c24296094b4eaa07835e360c
-
Filesize
11KB
MD575d0612b320b8b9e3b13fa4f1fe2629a
SHA146ff80bc0d6e20459dd310ec246fffb98e3fe56f
SHA256bc5031f184c816ee1b24ed92ee6ee4d4dec535f83c3234978e8d272bc5b7c12b
SHA512a561fd44c51d3a2050aaa6ebd79b99ccc14cef6b6d3dcb2eaf8cc4e1d3e7c9c4f645e52517b437f543b2bfde1b79b302cc09fb4b77836f214afa01bdee07d3c5
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5ac695eaac061717104d1a29c91adae37
SHA134826e75425a7e865538f4f39b09f5f17d8663c0
SHA256db7caca69af3e56b861cced7dec09e2b78a6c12013f1e7db3559886722ab1e2b
SHA512aef237e5f82a36262456600a7379564b63353bea27fcb0b0afb33a964fad8d089adcfefd7eee33edb20d2c2cbf29f92b1feffb1189c6454525092c9b069f07ab
-
Filesize
662B
MD530c7b2bdc35c650d2b65150241646816
SHA194d466a5f5159784155b6adcc9555bfdae4710c6
SHA2560784d39379f0a4f971777844ba07550aff31a3d5e32ce1d1eff6f4c7d49b90b1
SHA5128d51ef924b6c8f46a7ced69f188f2ea583ef3feb7fd84f51a8af8810c51e5099052e2c1513f15ac6fb83fecbef8c984fb4e124ff524c2b20a437943dc127465d
-
Filesize
5.8MB
MD5071a86a82f51e91c9a47bb2db7499e0c
SHA1d583e6fc19ddf59a70b7f3898fb1b1933504cfeb
SHA25615ce1bdd1a117d0a755f8f77e5a789ccf171cfd0c56bb7532ac8cad8c35de692
SHA5121345b189bfc4c5a7eb9c6397efb2d9d19a6498b6e4da03e5b2fee3904c2ce914b3d4ea7f80958dfd5946fb92ab1c45b262f81a029a7302237b96575c94160dbe
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
Filesize
280B
MD569f731fccf87e5d6c1b72969c47f52ed
SHA1f19f3cca98c7511eb8568ee0ec979a8511acec61
SHA256516b3b42330574b0b5f7566307fa6f9902d70c38470b361d3adf066bc99177e4
SHA512bd7a8e2b9bdfff2616ecad8f7f9c5c7ce67f78f321d62cdc34a748441e38847272e05b6dec0c033309e7c50c2e0e140a8cf9c4582f335ae7c76efe3515e809a8
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\90552ed1-aa9f-432d-86d8-94bd68191f34.tmp
Filesize6KB
MD5bd01cff4ae0199fa290146ab46da1ea1
SHA1df9ea5b256fb2e15008c5fa645dc0d40d7b753b4
SHA256e5e23bd54acaec73df3b5ebf402a3ed389a9a3e0ff97c68f5daf028e37ec7e8d
SHA5122c37869a0760f35f30d54d414e6143f14c2d935ac78a28afc78380b5d6f87daac79f0f93f496f3de8bf5ba77fb86982592ad7ed8540daff75bbd06bf992e257a
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Cache\Cache_Data\f_000017
Filesize147KB
MD5759ab24cf5846f06c5cdb324ee4887ea
SHA141969c5b737bc40bbb54817da755e3aa7d02f3c6
SHA2567037e6c967c38477a5fcd583c74892e16b7a9066cd60287c7035bf0760d05471
SHA5123470ae07eb7c54feee1e791e63a365cfb0da42f570a66e6c84faf5db6bf8395173c6cb60e8c5cf28eae409f26ea5433c3c5d6ea32eb07e5997c979c6e3ccf4be
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD58243be70a6c519ddceca26ce226caa0d
SHA1af28838dbbcf7e1bcf432efb10cae61c380da143
SHA25653808b69880661c68dd06ef11b6902a3d41b366120b90b70738c5f05e561f991
SHA5128d5bbb6054bfc7f3fc7789f893670b78214c0dc0926e2dba8674fe785c5007ec18d60fd0b07c32d9a8d02bc5e4f89a7cf0ffc5b0f6e80bc069d7d235a31a303b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD540344fda391276cdd7a06cd3b7ae991e
SHA1f42c88efcdb0e30c90956cb6f6191963b079f1f6
SHA2563c9cbbea4a2c59de23d06a996e5cb53712c8dd1832cb244071e3208a9b882330
SHA512c93e9b378be4d278f2a6b4cf07cd189aabb7df5dee38db0462e0fb00e6aa0ae9c44148fd77354e01862591df84fdf36c5dc6767c765028bd547ae7e6c1170364
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD51e02743897862574d93b17c0ab7bfc6f
SHA10d17aef0e12065da2e1f964e987d1e67790f385c
SHA256b86abfbb0c6d7e6244f85819f403bba6dd7346b8dcd8bfe027bd5ff7ce387cd8
SHA512866b4b9eed7715f4711165f06681a8b04151765125344d00f3ea65305b77c9ccc1c19bf04e0cc6b343b13a709633aa4717c137c8b1a9373e135f45e7ddd8beff
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5e5448.TMP
Filesize48B
MD531e9516a225177911739476754e6c879
SHA14bb362abaafe005edd3c0c1814b211e93d583822
SHA2567bb97e5587501701a92b1d17f8c3de187187d376d3a2f7ca37d9655365b618f8
SHA5123d5286c534b56e878ed9715908253ce082a6d53bbece736df519ebbb6723bb72e03541ef87debf9c48e56ba5b1fed392cf0cd1084be77f0b50c0f2da324ea6cc
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize3KB
MD576a57bb027fb00a887f94e49a2a208d5
SHA10bea9072f68f8c5cf6108561d9a24a34a6cb943c
SHA25663593f6a516f53a5bd13222c51951faa1be5b5ddc35cc0fba7d19e6d978f5c65
SHA51248368392a1be17bd2e06e5b350339a8a4d72fbe9b6dbaefb4411f3b5e4d027926ad04eec04bbb3d5e367baa56a22688eaf2e3caf6f5bdc5900867700b9edc7d1
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize3KB
MD5b015bb8c1ada5df9dcf8c311fdace97f
SHA1fe1167247b7216a175140eec7d9a2cd527290b13
SHA2569a6192a87c757e730dab34953f9f750269b62240252b2b579161670f60d9b1c1
SHA51217e5fa51377d98e7af2d6c85eb885817c2eb9ef312cfb24dc042692dcc3a0d9a30307b86d43b2ae705d41cbe82419c139de3baaeb732bcfc4d30104ca4805f3f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize3KB
MD56760f2e01891faddeb067ee0fe7bd67b
SHA16236154d18cb78980036a1fa445124bd02c207d1
SHA25625ac9931435a31f22a14e598b5c1b75023810a77b9da620206689efee1dfdfbd
SHA51276b19563e6bf4234403ab9aa8b5ca6daf319b4fbca6e814492b22f9092e33badc1c0f06535d007acc291a076630f69471bcca3f3950e6f0a878f064c924f30b7
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5f1277.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5f8dea64c0fdb67af80f0089e64c45195
SHA1406bd9603adc0c9195f4589ea2ca24a6a2dbf3b0
SHA256aa1c09be5c3ac261b300ad7eb6a9ed076a6ca144ed8673ea1d919747dfc41117
SHA5128b5fdf1cd63eefd4d9e3e2607d78beba6866a1d818c86e25cbc2e7e01ef117acfbda617c32521d35622e2ccab0826720cce27981c4f2afcd37007ea1739008cd
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5a7bbe13bcc9306654a4b1bb7de3643c4
SHA1daf8e2d8215ee25a1093ee0f2f950e9d7585bc30
SHA256d8c2ce39154e89ed50da04d6ad71e1f7db090aeebedefd4df30e16efa5f6a72e
SHA5125c834e63d3d0fce7eb30828b6a20a68f99b88354d5362cc4edffa514450fd11d1e696a51b6b5d53c9784f80f577c6b367a565a33d358daac633e1df40c6bf1cd
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5a15a40bf4507dd7281bae26fd619af54
SHA1e19a9f1bf3bc99e8f5e9fcf4908acaf5b77b3c53
SHA25652de43a562f31d0bf902c94f0f0fe4bbcee52980bdd706edaf7b80a7bb58ff89
SHA512bc74ae247057fe0e2af58670969fe72cf95c7a5d3dd0d052a63fb9d346b3bc83cec45004d0b82f81a593e8f2315d2b19942e8b36bab562858a4cdd449971144d
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5408c14b6e404477acd572a8e88e21168
SHA155cb6eea7caed6d57efe51815fb2cb352c55eb2b
SHA25655e33c7de16aae4916568d7679a2f54eeab846437b86e1290a8c3d3c33dd852d
SHA5128366ca922cc1f323fb1c822c3420c2fab08903215556609218dfa39a1acc360c9ca1e370d8a137029d4f5f7e5d2634a64d747a84257a443903f6567a4cd72352
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD51f3e5e22c2fcf7946a40a30b126169d7
SHA1d8a9c22c1858c8783f74f98a2b805b1944cd925e
SHA256b147a7b07378a652f0d3ef393b02bb2b50b627901f14509944e86c213601b23a
SHA51221d6830c66f4f581a83df96fd7fdb81b45e5b6a8b56e23e9b529af87f5325f9f3771fe98e3639c66eb5476c39228c366d90bd9b867ae96badfd59291ffde196a
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD53b9f7ff0aa17b25f1cfd84742afd63eb
SHA1e0143466aac0c58f7f3199d04f0b793dd0bd88e6
SHA25666d69e9f7e1c3eaf91870b37b8e1d55bb39720d67382672ed385a24d2bc1ee09
SHA51287a3a1fdfb2773651fd7cc821d48ec25aafe218e3a5acbb45b83a3b226ce51cdb7871f8ab701f84952e955eb52b6af9d26d10203dbde8afa25c2412095d8c486
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5a72d2c988c85535f766ded4f83858ee5
SHA1c73709823d455bbf4825f4da8d97a02313d6c00e
SHA25672b950299cac456069063ac47949936ae305b1dfc9a6cfcdc9c54910ade2d001
SHA512dd560dff1ad2cb0b2a33ba3b9dea307e91fd7a000617fc99c005cc3f69b56ada9209e5a941ec7a29f65bb17459b80959c1f9a22b841268911d5d912fae4c7bc8
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD50fc04bc3b721573a415fa3332935e06c
SHA1d9d709239908f057dee21f21f08e383648e51b52
SHA25657918e257c3e1fcf2b8fdc4997c4a9ebd3167dedd88f55241cf08638519bc136
SHA512194665387d6dd95baae479cb46e8a714a5167d5b2e894d037a8fbb666414ac121b5a3a7af035d20c33133e392e555d899b1b386be09d7461ee38c83b84106fad
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD55bdd49893135a799a4cea21087048b2b
SHA152e0863a16344baf84613db8ec721afa7e4ffb6a
SHA2563d1d4ee51b0c1326ef8b7b517a6e580edf4194450bbd7a559765133a85bde5ba
SHA51218f66c9a0c5c8d0f9b0479981929a212aa5681d54f42347260e0b0494d96659c6e50a983c576274993e769513ec93d70fd05c219edd9e347665a891689d209ed
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD56c2b1103c1a90df64b5aa6f8d210a1fa
SHA1e8477f6ae2ae74b549cf4e0578732b4a5bf15554
SHA256c1d0707cd7a83590392e706259b29e00c676e52a26e3f4cbae1a854baa9304c7
SHA512f184b87ae0940d27fc061dfcba4d2d045785559c7379d08c2030667ce2b8300605ba1892d6a81fbe74f2fe29ebbe1db2a5571e8fa14c5af49a16a403970b0233
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD523c196e1fb4d896778498da8aa71e7f9
SHA1065f652f186c05a55118d0d8b58aa56e812cb00b
SHA25636af61ea11c64e98e3e6c45cd173572b10952253926f5d89d7ce3371dbf8a757
SHA51239488664c2be3f4616a582e1cad528adfcde133e4f14179d64a75a7487a0141e8019f498fcc8bb0158fc2b5aa8d58687ef9a8427415a136f706b60bc5e2858b3
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5bdbf3149563a005ec58be633addbf887
SHA10fd9ab584462cdc27ca4e54e2be0b3e7d7050670
SHA256995cbfa445275b545016cce124ed2c47705ff9c6314f30554ff0b1ab902a72d0
SHA51248a2737ad3f0d621380d9c5d6ec1c8a497e4d24db8c084bdae86c7dc0fb52fcc94c337175a6e572f45cf57bc0b5da43b1ac015bf57219472e35bcbb1769915b9
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5e52c1.TMP
Filesize1KB
MD528b2b847198318fb1ebd00f9f60c4492
SHA1d8625fa81d9b51057c4d92c795c966ecde7801a7
SHA256d4b6340e0c96d630ad39571cd04b16373482d9fb2fe5a55176634a81308da860
SHA5123cdcaf08a13c64ed94798661642362aa37ed15555cd95e47bb54d603799ce543d03d354616e1feb2a083d53b3105db86cfe68a743354d320d0fa56277ff6a68c
-
Filesize
6KB
MD51fbfcdfdb1d4f49e9463adda081299cf
SHA19b3fe92244520d69d514296a62275466f8d3bb27
SHA2562b41b4be73f887394ca5cffba4189cae9c25fd7c4396f8758440829477d2b3f1
SHA512f4abea2c5731a6f71214828c2924a03102773780441a460f37ccb75fc169e748f9e12040c84908608f42324092e2a5e64849c343e86d91f9a50a7ef98ca879c6
-
Filesize
7KB
MD5942183b47f73eae712e880e47f38e05f
SHA188346212f994d6b2df14b8418bc8eafd161f5f67
SHA256dab8b5924989a833c22686a85c0e49c0130fc40e9f5f2b7f1a04cf9171966052
SHA512fedd89c692c89a42a4e5ea5b813b19091ac4c41388c3aaa241fcdbdf2d5873550fb5b3b5ba7d8913d70f47d702f5ac8cc833e36e64ca29c6b99527ac6bb26a6a
-
Filesize
6KB
MD5c83968b57c524268096fdaa6a309d535
SHA122b6b39b11264b8adfc58024a34aa17bf77cc659
SHA256dc516e35e92e4b30c20a5dbeec7c9f255951369f41890d6cec1f1174cc5e78a5
SHA5125127d54131efe6871626384ae6d1f3a53adf627a0394e172a19071bf7c4ae378a0b9accbe509b2709564c2f572ba72c1517eab57e7f61046add64e1d7b0e1f0e
-
Filesize
7KB
MD541fa6f81fd7b9fdef64ce81d2dc515a0
SHA171d42fef9091ce27124279f780ba552c02901bee
SHA25630a658ef9af559098041847f9d437397ed20aac132ef8044a10913e53d5b4601
SHA5124280657a1cc27645171e4d7d789f570c96f5c3d557f4ad199eaae7506972b8adc7a22f44c05fd39832c8fa223559a2776887ac49e39c4181b0c39e5ddd6586a5
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD5d15b07c959ce69c53b5c880d55192d47
SHA136ae3397b93873caf97ae181f5955f3add0a9d35
SHA256262d7c589f8d5e2ca87567ebd471f6bf140efa16d46c959dc5cf7354ea2d0390
SHA512bc494306ed74faf35b92cfec82abd5c43dd20e981d2cdc191f405f36179571f6df26a85cb7521b936c941a4533724a1e0087145e5d04f6fcdb4967c291d6cfdb
-
Filesize
2KB
MD51fdd70fcf5b08a245de20fa7dd5d3f9c
SHA1a5ceda069c715f341bffa5bb0daf760038d5e1bf
SHA256f658dc2809f45ed72b3e0c727288d29a87aca923b22c5d9276a7f93cbf421eda
SHA5126ff99fc7c480d465f9ce57c70733fd40ca156324266d04d32060471215abb583ca076cf929944c0b278ab16dcec860a624a3817b99607214e5dfe4ecd25798c9
-
Filesize
3KB
MD5b71ba6575136d4f4ce6cf3721ece1224
SHA1ddec94fb0aaed6af3096324a009c32b58b35dc36
SHA256b06051194bb7a821c43a3522c57337441418d16dd2b97f08352e85b8e111dcdd
SHA51208ab08f200dfb8e176c190d20f2ea72ab88b7798c30cb8596b8b22475a109a9510925d9a9c2a283bb50c6757029ab9c0d474d627cd78812d8b8c677cd5e09d52
-
Filesize
16KB
MD5eacd2f757878506648ac1d10ac1e16c3
SHA1335545944e03b32156c503ad02db444d81b94c05
SHA2560b4366939ac5707bd31590d108bf1c811bb15031039ff31f3cf335ee6a1ac858
SHA512ad6b6e95d559ba7461951d59d9b4b1d2ca9594224d94c639eb0d6b37febefe7ef1a659403231cf106de7a4e5f7cd2ae92fbc59af58ded924512cdbb55d130a9a
-
Filesize
16KB
MD5887b624fdd0bc75ef6c84963cee8a370
SHA123f8d43eb7cc098b6e02e153c1fdf455c9e2e291
SHA2563a73d5f6684c254224d60ea31027021ca51a1aefe8e7325b4c2fc2d6409b297f
SHA512b99c43b6ee83eddfa2c3025c446f93bede483ec4c4d503e98dc19eacf5b348c1aed42bff14fbe5b0f2dcd7844c8c3b1cd5b73cfe2cef0a4ff46202fb4fe3c8e6
-
Filesize
17KB
MD563d12bdba5d8e308efd5be16f2c1d756
SHA1718bc5d11cbb973b90bf27ad9c9572e3f4cdc259
SHA2564ca9a2199761d786504c7ade92fa72c9d3188b150d6f54c06797f9dd6a072ecf
SHA51233799fb13c2f2d53d986572638445789f62b4e95bbf713faa782eae567b4bd24c514d6ac86845fe4ca047d5ed28fc9c8d336c7c5b829efafa347e607e19facef
-
Filesize
17KB
MD583ac6238d40ee501ab68ff82557745e7
SHA1672815e7e21e7a54180b8b538d3d7b8927af0721
SHA256fe183b0d5dfea57d80a832afb4008e4047358358809ac10b5735af2d44ccd0d1
SHA51284d6634e93e59455825bf3a5e10b26596ec804a670aadf731b25c30e753558086d2f5cd73a52903b2314e8295992a171ef037d619c22362b41df150d9f170805
-
Filesize
1KB
MD588df1fab1da990bac2cd8e23e1d9a88f
SHA180197f3b12d7df0d043626bdba41aef0093025e8
SHA256868ed6137c565013cd81c5659acb761c13d47b267c01b29834cb5001a58b8fba
SHA5120469908818751501f7bce4f026dde416347379a3b7865b7ec9248dd472833bad34e7aec1fe958376931e9d045a81e455cdae8985479025ac1e92fae7e363123c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb
Filesize703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
5.5MB
MD527469372591b14ff1c57654facb5e020
SHA1492c166cd0e6c8d122ca4687659bf047cd48afd7
SHA2563b8fcd52686095049b1563fbb6ba0bf73113a01b13c303bebcb36d8339a1519f
SHA5120cfa845de57acf6f17f295f0771c2a61cd846efdee79da012def474bcaa91d9e99d3d528cf5698e6112a310c4f97e98ae74b6cfc601b2988c51e92270ebf92a2
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c