Overview
overview
8Static
static
3BetterFold...er.dll
windows10-2004-x64
1CeleryApp.exe
windows10-2004-x64
1CeleryIn.dll
windows10-2004-x64
1CeleryInject.exe
windows10-2004-x64
8Costura.dll
windows10-2004-x64
1Dragablz.dll
windows10-2004-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...ns.dll
windows10-2004-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....ms.dll
windows10-2004-x64
1Microsoft....pf.dll
windows10-2004-x64
1Microsoft....rs.dll
windows10-2004-x64
1System.Dia...ce.dll
windows10-2004-x64
1bin/Monaco/index.html
windows10-2004-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco...tes.js
windows10-2004-x64
3bin/Monaco...ase.js
windows10-2004-x64
3bin/Monaco...ses.js
windows10-2004-x64
3bin/Monaco...del.js
windows10-2004-x64
3bin/Monaco...num.js
windows10-2004-x64
3bin/Monaco...tem.js
windows10-2004-x64
3bin/Monaco...ums.js
windows10-2004-x64
3bin/Monaco...nce.js
windows10-2004-x64
3bin/Monaco...del.js
windows10-2004-x64
3bin/Monaco...nal.js
windows10-2004-x64
3bin/Monaco...der.js
windows10-2004-x64
3bin/Monaco...ace.js
windows10-2004-x64
3bin/Monaco...rnl.js
windows10-2004-x64
3bin/Monaco...ons.js
windows10-2004-x64
3bin/Monaco...als.js
windows10-2004-x64
3bin/Monaco...rds.js
windows10-2004-x64
3bin/Monaco...ing.js
windows10-2004-x64
3Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BetterFolderBrowser.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CeleryApp.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CeleryIn.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
CeleryInject.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral5
Sample
Costura.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Dragablz.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
MaterialDesignColors.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
MaterialDesignExtensions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
bin/Monaco/index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/base.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions-krnl.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/globals.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/keywords.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/libraries/Drawing.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target CeleryInject.exe
- Size 5.0MB
- Sample240809-abhm2swglc
- SHA256 c5448339124931a267dc09f9ccf41878ef64e0e9a2553a220b2cb950a7aa8f56
- MD5 6b11846ac7d1cdfc7bdfb9e27210ac7f
- SHA1 ec2056b1a47b60a30ffd16313c07bc7e8e28bf64
- SHA512 dbb516ed47772151d5c3b3147a419f9157a22f9f6853c9a77db4713f06f7d02eed2295a9c522721ca3d5b256972089dfb76d62d5b42bbc271fef9d22bae76264
- SSDEEP 49152:3esFEyhNi5PyeVuOvW/eDGjyYl2g53PaiTs9dnNdnndn+dnc81u:uzVP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 12 IoCs
pid Process 4280 RobloxPlayerInstaller.exe 3524 MicrosoftEdgeWebview2Setup.exe 412 MicrosoftEdgeUpdate.exe 3308 MicrosoftEdgeUpdate.exe 2132 MicrosoftEdgeUpdate.exe 3932 MicrosoftEdgeUpdateComRegisterShell64.exe 368 MicrosoftEdgeUpdateComRegisterShell64.exe 1476 MicrosoftEdgeUpdateComRegisterShell64.exe 3456 MicrosoftEdgeUpdate.exe 3136 MicrosoftEdgeUpdate.exe 4500 MicrosoftEdgeUpdate.exe 4460 MicrosoftEdgeUpdate.exe - Loads dropped DLL 15 IoCs
pid Process 412 MicrosoftEdgeUpdate.exe 3308 MicrosoftEdgeUpdate.exe 2132 MicrosoftEdgeUpdate.exe 3932 MicrosoftEdgeUpdateComRegisterShell64.exe 2132 MicrosoftEdgeUpdate.exe 368 MicrosoftEdgeUpdateComRegisterShell64.exe 2132 MicrosoftEdgeUpdate.exe 1476 MicrosoftEdgeUpdateComRegisterShell64.exe 2132 MicrosoftEdgeUpdate.exe 3456 MicrosoftEdgeUpdate.exe 3136 MicrosoftEdgeUpdate.exe 4500 MicrosoftEdgeUpdate.exe 4500 MicrosoftEdgeUpdate.exe 3136 MicrosoftEdgeUpdate.exe 4460 MicrosoftEdgeUpdate.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\PluginManagement\checked_dark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\RoactStudioWidgets\slider_caret_disabled.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\Small\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Help\XButtonDark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\Unmuted80.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\9-slice\gr-btn-blue-3px.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\PlatformContent\pc\textures\sky\sky512_lf.tex RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\fonts\BuilderSans-Medium.otf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\LayeredClothingEditor\RemoveIcon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\xboxView.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Help\AButtonLight.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ViewSelector\left_hover_zh_cn.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_2.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\avatar\scripts\humanoidRunFamilyWithDiagonals.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-60x60.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\StudioToolbox\AssetPreview\rating_small.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\TerrainTools\icon_flatten_grow.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\icon_localization-16.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\Large\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_1x_1.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperFramework\AssetPreview\close_button.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\transformOneDegree.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\Tutorials\Tick.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_5.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\avatar\unification\AdapterReference.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\SpeakerDark\Unmuted0.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\TerrainTools\import_selectImg_dark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\traildot.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Camera\CameraToastIcon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperFramework\Votes\rating_down_red.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\Gamepad\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Input\Ring_padded.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\particles\forcefield_glow_main.dds RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_1x_3.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\BottomLeftSelected.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\FaceControlsEditor\checkbox_checked.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\InspectMenu\Button_white.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\FTUXTutorial.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_sq.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\CollisionGroupsEditor\checked-bluebg.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_4.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\chatBubble_red_notify_bkg.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\translations\CoreScriptLocalization.csv RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\LegacyRbxGui\_preview water 03.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\AvatarExperience\glowDark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\LegacyRbxGui\popup_redx.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ArrowFarCursor.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\Misc\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\avatar\compositing\CompositRightArmBase.mesh RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\Small\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_kok.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\StudioSharedUI\menu.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChatV2\[email protected] RobloxPlayerInstaller.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3456 MicrosoftEdgeUpdate.exe 4460 MicrosoftEdgeUpdate.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676354499208169" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MicrosoftEdgeUpdateComRegisterShell64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe 448 CeleryInject.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe Token: SeShutdownPrivilege 3096 chrome.exe Token: SeCreatePagefilePrivilege 3096 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe 3096 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 1360 3096 chrome.exe 91 PID 3096 wrote to memory of 1360 3096 chrome.exe 91 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2452 3096 chrome.exe 92 PID 3096 wrote to memory of 2924 3096 chrome.exe 93 PID 3096 wrote to memory of 2924 3096 chrome.exe 93 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94 PID 3096 wrote to memory of 4980 3096 chrome.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe"C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff895dccc40,0x7ff895dccc4c,0x7ff895dccc582⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1860 /prefetch:22⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2220 /prefetch:32⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2412 /prefetch:82⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3912,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3672 /prefetch:12⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4764 /prefetch:82⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4952,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4752 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:4288
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff66e9d4698,0x7ff66e9d46a4,0x7ff66e9d46b03⤵PID:4384
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5228,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3412,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5440,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5448,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5520 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4048,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3148,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4524,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5828,i,5098672494359350078,10592613135862575889,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5832 /prefetch:82⤵PID:1448
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
PID:4280 -
C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3524 -
C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:412 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3308
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2132 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3932
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:368
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1476
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjRCNTIzMTgtMzlCMi00N0E5LTk3RTctRUY1QjRGRjgwQkI2fSIgdXNlcmlkPSJ7OTdDQTM0RTEtMTVCNi00OTkwLUI1MTgtMjBCMkU0MUYzNjIwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRTY5RTBERS0xMzFFLTQzN0EtQTE1RC1ENjgzNEQ0NzYyQkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMjQzODc4NTciIGluc3RhbGxfdGltZV9tcz0iNTkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3456
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{B4B52318-39B2-47A9-97E7-EF5B4FF80BB6}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3136
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4020
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjRCNTIzMTgtMzlCMi00N0E5LTk3RTctRUY1QjRGRjgwQkI2fSIgdXNlcmlkPSJ7OTdDQTM0RTEtMTVCNi00OTkwLUI1MTgtMjBCMkU0MUYzNjIwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBODJGMTM2Qy1EQzQwLTQ5NTktQkJCQS1BREI1RkJERjIwRTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMzE0NTgxNTEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4460
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\EdgeUpdate.dat
- Size 12KB
- SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
- MD5 369bbc37cff290adb8963dc5e518b9b8
- SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
- SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
- SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeComRegisterShellARM64.exe
- Size 179KB
- SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
- MD5 7a160c6016922713345454265807f08d
- SHA1 e36ee184edd449252eb2dfd3016d5b0d2edad3c6
- SHA512 c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
- SSDEEP 3072:H8czUqc3YHFwUztZr3OtjwC/5kPghc2dFi1CJhf:VUx3YHFwCtZr+yZgd81Yp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeUpdate.exe
- Size 201KB
- SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
- MD5 4dc57ab56e37cd05e81f0d8aaafc5179
- SHA1 494a90728d7680f979b0ad87f09b5b58f16d1cd5
- SHA512 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
- SSDEEP 3072:wHrfzYYc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+s6LRCkuB9N3iQzFXf8qUV:0Ael/DRfkTC3dM7B+mCDH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
- Size 212KB
- SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
- MD5 60dba9b06b56e58f5aea1a4149c743d2
- SHA1 a7e456acf64dd99ca30259cf45b88cf2515a69b3
- SHA512 e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
- SSDEEP 3072:LwZr2PMjkqEq/X0GbjILfh1W5vpynTywTZoY46OdO8A5l3eX7jR:LSr6akqEq/X0sjIT25v0rohoJ0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\MicrosoftEdgeUpdateCore.exe
- Size 257KB
- SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
- MD5 c044dcfa4d518df8fc9d4a161d49cece
- SHA1 91bd4e933b22c010454fd6d3e3b042ab6e8b2149
- SHA512 f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
- SSDEEP 6144:24yWbEHb9XVfocP/yd7UAOuJ1NXKSih+9A:PEHb9XVfomq1lK5h+9A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\NOTICE.TXT
- Size 4KB
- SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
- MD5 6dd5bf0743f2366a0bdd37e302783bcd
- SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
- SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
- SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdate.dll
- Size 2.0MB
- SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
- MD5 965b3af7886e7bf6584488658c050ca2
- SHA1 72daabdde7cd500c483d0eeecb1bd19708f8e4a5
- SHA512 1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
- SSDEEP 49152:T94O+C4rss1x1pBVwRQjS729TKQ3M3rMv7:TmO+LrskPjSavErC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_af.dll
- Size 28KB
- SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
- MD5 567aec2d42d02675eb515bbd852be7db
- SHA1 66079ae8ac619ff34e3ddb5fb0823b1790ba7b37
- SHA512 3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
- SSDEEP 384:5f8NVFXh7JWmyIWxjrYiVDxlwC3W+uyeHRN7HT3OOP5AR9z5z/S:j6mW+LKz3OOPO9z8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_am.dll
- Size 24KB
- SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
- MD5 f6c1324070b6c4e2a8f8921652bfbdfa
- SHA1 988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
- SHA512 63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
- SSDEEP 384:7inQVFXh7JWmyIWf0Kl8js/MyeHRN7GkGER9zYb5Nf:cee8js/1KG+9zK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_ar.dll
- Size 26KB
- SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
- MD5 570efe7aa117a1f98c7a682f8112cb6d
- SHA1 536e7c49e24e9aa068a021a8f258e3e4e69fa64f
- SHA512 5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
- SSDEEP 384:T2LPBbJWmyIWcYwTPsQ8XvPGCdyeHRN7JMOOP5AR9z5zKk:RCbQXvPLMKJMOOPO9zkk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_as.dll
- Size 28KB
- SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
- MD5 a8d3210e34bf6f63a35590245c16bc1b
- SHA1 f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
- SHA512 6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
- SSDEEP 768:ekLZ452DuUu3+F/D06DpJKIlHpbKSOOPO9z6/:3S1Oizy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_az.dll
- Size 29KB
- SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
- MD5 7937c407ebe21170daf0975779f1aa49
- SHA1 4c2a40e76209abd2492dfaaf65ef24de72291346
- SHA512 8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
- SSDEEP 768:cfIOFe5FEuo//rtkPFS5OrF9FTFYF+uzKi+9zH:cpFe5FEuobuFJrF9FTFYFuPzH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_bg.dll
- Size 29KB
- SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
- MD5 8375b1b756b2a74a12def575351e6bbd
- SHA1 802ec096425dc1cab723d4cf2fd1a868315d3727
- SHA512 aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
- SSDEEP 384:0DTJVFXh7JWmyIWbdsSCCdrwdPMQgv6Sf46JyeHRN7RsWAR9zgXb3AQe+:QEVdshCJCgCz6gKWL9zcbAe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_bn-IN.dll
- Size 29KB
- SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
- MD5 a94cf5e8b1708a43393263a33e739edd
- SHA1 1068868bdc271a52aaae6f749028ed3170b09cce
- SHA512 920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
- SSDEEP 768:yZvAGEtJtVWCZsnM9/r94amPdQ8JBlHhKZ+9z2f:ydAGEbOmcz2f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_bn.dll
- Size 29KB
- SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
- MD5 7dc58c4e27eaf84ae9984cff2cc16235
- SHA1 3f53499ddc487658932a8c2bcf562ba32afd3bda
- SHA512 bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
- SSDEEP 768:fUvAGEtJtVWCZsnM9/r94amPdQ8JBlHMKL+9zzCC:fMAGEbOp+zWC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_bs.dll
- Size 28KB
- SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
- MD5 e338dccaa43962697db9f67e0265a3fc
- SHA1 4c6c327efc12d21c4299df7b97bf2c45840e0d83
- SHA512 e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
- SSDEEP 384:NEDVFXh7JWmyIWGaDAmqRDU5NLCdJlwcSXp+U1s477yeHRN7qxkGER9zYb5BTRZ:ZH6lwcSXp+2s4CKqx+9zuRZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
- Size 29KB
- SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
- MD5 2929e8d496d95739f207b9f59b13f925
- SHA1 7c1c574194d9e31ca91e2a21a5c671e5e95c734c
- SHA512 ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
- SSDEEP 384:o7VFXh7qWmyIWMbkbOnGNfNFoBWk5S0IlyeHRN7/bFkGER9zYb5zO:u6bkbOnMffoBWfRkK/bF+9zx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_ca.dll
- Size 30KB
- SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
- MD5 39551d8d284c108a17dc5f74a7084bb5
- SHA1 6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
- SHA512 6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
- SSDEEP 384:yyUVFXh7JWmyIWFHEWdvDNfNFoBq1ZqFGyeHRN7+UAkGER9zYb5f7:rzHEWdvpffoBqiTKe+9zG7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_cs.dll
- Size 28KB
- SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
- MD5 16c84ad1222284f40968a851f541d6bb
- SHA1 bc26d50e15ccaed6a5fbe801943117269b3b8e6b
- SHA512 d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
- SSDEEP 384:VnPVFXh7JWmyIWXTL7PGmxQEnwd/OyeHRN7NkGER9zYb5+B:MtTL7orKN+9zVB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_cy.dll
- Size 28KB
- SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
- MD5 34d991980016595b803d212dc356d765
- SHA1 e3a35df6488c3463c2a7adf89029e1dd8308f816
- SHA512 8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
- SSDEEP 384:wEcVFXh7JWmyIWjtZEmiuTHsyi7zAaaVamYylVb2UFxOF6dJDyeHRN701OOP5ARQ:zFDVEUjxdJmK01OOPO9zq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_da.dll
- Size 28KB
- SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
- MD5 d34380d302b16eab40d5b63cfb4ed0fe
- SHA1 1d3047119e353a55dc215666f2b7b69f0ede775b
- SHA512 45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
- SSDEEP 384:saIhVFXh7JWmyIWmm4HcyvBdck0yeHRN7lb7EHR9zKRELY:2Av4PcktKh7Ex9zA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_de.dll
- Size 30KB
- SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
- MD5 aab01f0d7bdc51b190f27ce58701c1da
- SHA1 1a21aabab0875651efd974100a81cda52c462997
- SHA512 5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
- SSDEEP 384:mjPVFXh7JWmyIWqeI4FBhj3ZnswxWbzOyeHRN7PkGER9zYb5AWK:doetj3Zn7xWbzrKP+9z1WK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_el.dll
- Size 30KB
- SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
- MD5 ac275b6e825c3bd87d96b52eac36c0f6
- SHA1 29e537d81f5d997285b62cd2efea088c3284d18f
- SHA512 bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
- SSDEEP 384:M5jSVFXh7JWmyIWHnBzBUBOTG94vTZtfFtSmFK9q8LPgbYyeHRN7OPOOP5AR9z5z:iJpnxmFTAK4OOPO9zl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_en-GB.dll
- Size 27KB
- SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
- MD5 d749e093f263244d276b6ffcf4ef4b42
- SHA1 69f024c769632cdbb019943552bac5281d4cbe05
- SHA512 48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
- SSDEEP 384:DB6RVFXh71WmyIWtkagyorTm0yeHRN77NkGER9zYb5BJ5r:DkUAagyo+tKp+9zcJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_en.dll
- Size 27KB
- SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
- MD5 4a1e3cf488e998ef4d22ac25ccc520a5
- SHA1 dc568a6e3c9465474ef0d761581c733b3371b1cd
- SHA512 ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
- SSDEEP 384:W0WVFXh7JWmyIWAkagyDl9FR/lyeHRN7AI3kGER9zYb5JFBG:XfagyDldcKA0+9z0BG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_es-419.dll
- Size 29KB
- SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
- MD5 28fefc59008ef0325682a0611f8dba70
- SHA1 f528803c731c11d8d92c5660cb4125c26bb75265
- SHA512 2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
- SSDEEP 384:rSwVFXh7RWmyIWHaduUrFaByeHRN7KkGER9zYb5hqy:o8BrAIKK+9zi9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_es.dll
- Size 28KB
- SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
- MD5 9db7f66f9dc417ebba021bc45af5d34b
- SHA1 6815318b05019f521d65f6046cf340ad88e40971
- SHA512 943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
- SSDEEP 384:T3rVFXh7JWmyIWrt34jmI8yeHRN7VFM7EHR9zKEVn:iRt34jmIFKVFM7Ex9zzn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_et.dll
- Size 28KB
- SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
- MD5 b78cba3088ecdc571412955742ea560b
- SHA1 bc04cf9014cec5b9f240235b5ff0f29dbdb22926
- SHA512 04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
- SSDEEP 384:QeqVFXh7JWmyIWYVc0dEyjELtX7gid1LFdsTwAiDiLyeHRN7IkkGER9zYb5XP:La5jELBgG1LFd/AwrKIk+9z2P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_eu.dll
- Size 28KB
- SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
- MD5 a7e1f4f482522a647311735699bec186
- SHA1 3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
- SHA512 22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
- SSDEEP 384:tSNVFXh7JWmyIWqcLpNrX58FOXAzt4OqyeHRN7/tsWAR9zgXbPy:9JRuFOkt4IKCL9zcry
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_fa.dll
- Size 27KB
- SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
- MD5 cbe3454843ce2f36201460e316af1404
- SHA1 0883394c28cb60be8276cb690496318fcabea424
- SHA512 f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
- SSDEEP 384:2bGDcPBbJWmyIWpXlQEqtOW0QSGfZyeHRN7s7EHR9zKEp:YGHknuCQKs7Ex9zL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_fi.dll
- Size 28KB
- SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
- MD5 d45f2d476ed78fa3e30f16e11c1c61ea
- SHA1 8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
- SHA512 2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
- SSDEEP 384:u2LVFXh7JWmyIWLJWHJWEFIxnyELZWEYXSN6ZKFl+EoJth0vg3yeHRN7MOOP5ARk:uBJOJOURxiKMOOPO9ziF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_fil.dll
- Size 29KB
- SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
- MD5 7c66526dc65de144f3444556c3dba7b8
- SHA1 6721a1f45ac779e82eecc9a584bcf4bcee365940
- SHA512 dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
- SSDEEP 384:wHVFXh7JWmyIWIsXsjbjkbZz9IrJqPDDiuByeHRN7bkGER9zYb5el:TusXsjboFz9IrJqLDTIKb+9zz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_fr-CA.dll
- Size 30KB
- SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
- MD5 b534e068001e8729faf212ad3c0da16c
- SHA1 999fa33c5ea856d305cc359c18ea8e994a83f7a9
- SHA512 e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb
- SSDEEP 384:5wVFXh71WmyIW0s7otIR30088yeHRN7qeiOOP5AR9z5zhO:NSINR3V8FKqeiOOPO9z2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_fr.dll
- Size 30KB
- SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
- MD5 64c47a66830992f0bdfd05036a290498
- SHA1 88b1b8faa511ee9f4a0e944a0289db48a8680640
- SHA512 426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
- SSDEEP 384:3+tVFXh7JWmyIW08bW6h0MXyeHRN72OOP5AR9z5zXu:ry8nh9CK2OOPO9z1u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_ga.dll
- Size 28KB
- SHA256 abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
- MD5 3b8a5301c4cf21b439953c97bd3c441c
- SHA1 8a7b48bb3d75279de5f5eb88b5a83437c9a2014a
- SHA512 068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a
- SSDEEP 384:2nlVFXh7JWmyIWJ5vCQkcYoIoAHsc37GTyeHRN7OkGER9zYb5y:jP5vTYoIoAHsaCWKO+9zF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_gd.dll
- Size 30KB
- SHA256 e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
- MD5 c90f33303c5bd706776e90c12aefabee
- SHA1 1965550fe34b68ea37a24c8708eef1a0d561fb11
- SHA512 b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a
- SSDEEP 384:I8T5VFXh7JWmyIWYFYiA73DpfDfqegs2/jRkxAyeHRN7k6zaHeR9zFqq6Rx:eeFYiA73NbqpTkxxKUC9z4qQx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_gl.dll
- Size 28KB
- SHA256 e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
- MD5 84a1cea9a31be831155aa1e12518e446
- SHA1 670f4edd4dc8df97af8925f56241375757afb3da
- SHA512 5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51
- SSDEEP 384:X/hVFXh7JWmyIWKsCi2RK1eo6wyeHRN7uZGkGER9zYb5i7:4ss281eo6BKf+9zJ7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_gu.dll
- Size 28KB
- SHA256 838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
- MD5 f9646357cf6ce93d7ba9cfb3fa362928
- SHA1 a072cc350ea8ea6d8a01af335691057132b04025
- SHA512 654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528
- SSDEEP 384:XJ8VFXh7JWmyIWUt7vdQrsojGtCAPPFZdxjACT6hyt/yeHRN72nsWAR9zgXbz:RqCrwXaK2sL9zcX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_hi.dll
- Size 28KB
- SHA256 024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
- MD5 34cbaeb5ec7984362a3dabe5c14a08ec
- SHA1 d88ec7ac1997b7355e81226444ec4740b69670d7
- SHA512 008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8
- SSDEEP 384:HWIVFXh7JWmyIWpQj9qYmmqkKByeHRN7TkGER9zYb5Gje:4nQxqYmmqk7KT+9zC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_hr.dll
- Size 29KB
- SHA256 65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
- MD5 0b475965c311203bf3a592be2f5d5e00
- SHA1 b5ff1957c0903a93737666dee0920b1043ddaf70
- SHA512 bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007
- SSDEEP 384:NEbVFXh7JWmyIWa/fbmrsCCa9PNV8qa0a/FyeHRN7ekGER9zYb55D9:tGsDJna/EKe+9zE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_hu.dll
- Size 29KB
- SHA256 b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
- MD5 f4976c580ba37fc9079693ebf5234fea
- SHA1 7326d2aa8f6109084728323d44a7fb975fc1ed3f
- SHA512 e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981
- SSDEEP 768:LIKkZ2hSV6S8+i5bufJHw1DNJUKyOOPO9zB:LIKkZh38+BRHQDvVOizB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_id.dll
- Size 27KB
- SHA256 192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
- MD5 03d4c35b188204f62fc1c46320e80802
- SHA1 07efb737c8b072f71b3892b807df8c895b20868c
- SHA512 7e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1
- SSDEEP 384:QxWVFXh7JWmyIW+PC8kJZT9rLVcvQC+yeHRN7ykGER9zYb5RP:GItjKy+9zq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_is.dll
- Size 28KB
- SHA256 a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
- MD5 5664c7a059ceb096d4cdaae6e2b96b8f
- SHA1 bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec
- SHA512 015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8
- SSDEEP 768:htBkg5TpAhr+8wh0xo8pGArPzKmOOPO9zyF:htBkg5TpAhr+8wh0xo8pbreROizyF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU7DB2.tmp\msedgeupdateres_it.dll
- Size 30KB
- SHA256 abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
- MD5 497ca0a8950ae5c8c31c46eb91819f58
- SHA1 01e7e61c04de64d2df73322c22208a87d6331fc8
- SHA512 070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9
- SSDEEP 384:mGfVFXh7JWmyIWluu1+JsJDcyeHRN7nwpsWAR9zgXbQpSD:2t1+JCDlKLL9zcspSD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
- Size 5.5MB
- SHA256 810a386924e8aeb9ad6a432067a96b9af05b2070b4a034b28c6d715d99740666
- MD5 9f1edaf7fec140c4fbf752bceb8faee9
- SHA1 446e908ae656e01c864606d2cef06ed8abd96fb3
- SHA512 2a97bdf30878cabc8460b26baa810fce2f06e649a98937c4112e674ddec24a3cab259b820fd6a382a11cb7d8167b33ebe28ae7e10338a283b299b9c5a4951f0e
- SSDEEP 98304:dxv+bJVPUAxQLEOgNOncNcJt0gfSzjUfr0p8RywXZ/MEUDh/9uGug:D+bzPJm/BcrgfZRzE1zWg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
- Size 1.5MB
- SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
- MD5 610b1b60dc8729bad759c92f82ee2804
- SHA1 9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
- SHA512 0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
- SSDEEP 49152:Jy53/rfy7dJ1zlMCXCFaJQyiOMFxBBr3kqeac:JyJrfy7dvBMCXEaFrM3BBTleac
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
- Size 181KB
- SHA256 71e972f3e3990eaf293e481b9398fea353688446d02eee43cffda4eec760f041
- MD5 e3e6ef3bd3c03b164daef2b3cabeed3c
- SHA1 bc89ee4f6b715a90e11135db6df5b53d77012620
- SHA512 d8bef402ca8dee8263e0098d2e5e74dd95f16c7a82790dab6f54cf66f7226c8c6b4e3da23c1d5e4a73c331a69f6f7f8e429836d82b300697f908e6ea37ed285f
- SSDEEP 3072:+prLemA6nVx4F36PDTFPeVVIse4tdHqVx7p1RyPxrctyPxrc8JEalXYbCXA2XRmh:AG6nVxq6PdPpVVx7NyP+yPPJEa1YbyPu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
- Size 100KB
- SHA256 144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da
- MD5 fdf09c3c067041ffdefcc9e1bdea9718
- SHA1 e31cf28187466b23af697eedc92c542589b6c148
- SHA512 9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268
- SSDEEP 1536:AycrCPYTLjoS7woqaxu6CDA9tz8g/5A+k9r975X6DiczR9BW34BSpEo5Fne+sXSo:QmPYHwoq96CQF/Urp16AE4sXSo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 bc915f009ec29867fa94008899565b60869f83bb53b35db81b9e819b24adb9ba
- MD5 86e89fee34288a74194e4a5b9a9dcf47
- SHA1 c0f0dcd2b2a90fe3d1f7d0bcf52ffe0b056f0d9e
- SHA512 76c43ac285857a06aa6367f3fb4a740c0170476def8000dd5d1b8d4c7f2119f3e900133c36b080fe053f453a152762300854c89fe8b56ebc2e2e09f365a22775
- SSDEEP 96:J3zgdkTfGkV2FTsectWE+aQSZg1Et81p8kCXCj6eAJIuHdsMyzrhCb35QPjKQXoW:5zgdE6eX1JZCESSSSYH32nW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 04ff5a4957f58a6477a8b3179db4ec57e92345aa874fd90c1f37e00d54c87b10
- MD5 0f129bd5f6f63bd3f84a8ef4ad730f79
- SHA1 02ba0728044fd03a1b63c6a9834031814193d501
- SHA512 7d2459e4ef09941e59ce7f7c5040b553d9d1476e901c66d76f8d464b2402a96376f7b452f6a9e31c75330e4664f58748acf894fe6875ac59c2e2ab353078b87c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
- Size 387B
- SHA256 9afd4c9f42f941ce19c8b03e5abba5e956c4ee83e7a2b52d999ea3cae78008c2
- MD5 21e82df56fee09b555e3f547c1d1115e
- SHA1 a9437711e2f935d7f788484b757a3392f8d42b37
- SHA512 a694d18dc9f4e730a38b272d9e59c00278180dcaa575fee30393de33a2a69b4dc26e0f50c6306d26967e76ac3b0b819c7e7d07938a52db9e6039305c46b86984
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58e9af.TMP
- Size 675B
- SHA256 9649b92a0bf42cc481187a87409b490fad3cc5f0568ab3c8a0466a924d129ef1
- MD5 7b477a13c6e9992ffbddcd35391534b6
- SHA1 3d709eb98e7314ad3358d17cec04dd5b4b4668d9
- SHA512 5ff7db88399330507d99dd03fac53ba3bda15714ff5dbe46af385c1840cb49129f7428e3f951a4f881384d3abd85a3a4918048cc24a2e4d2b29f229ee358ceb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 100B
- SHA256 596c2b144777a0c1a1c3dc9bc1ab15fbf15c8817b7d41b513deecb0564dec0c7
- MD5 b2028b209d87fea47f2a672702731872
- SHA1 fb08b8eb4ac9cd4390e373727bbd7cfee5f1492c
- SHA512 6db5036081a5453faf106bf9313f1b2787991777521ca096013b71bd521da7a06afdd271050206c42560ae95446d95a2868560e16f2b260ec0268506595c8c25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 cfa86656f823ed0fa09ab8b3249047ca7c11e0b7079e4f099e18eb27a7c94ed4
- MD5 6ab2baad0127ca4a5e8953532bd83cca
- SHA1 539a0207d91ad332e48bd9c53c2ca5a0798f0a27
- SHA512 8ed2fdef26a5323abbf51a54c2fb5d558026edceee26f6067416d1acf5873bb3cc9d8e7030d12e0610e036d0fbbac03cc6acdbd9c3768f4163406c82822ed701
- SSDEEP 192:SdOLgMw24yP03eks4Y2jjHQqOXy94qNYR7QkopCNFfglACN4KqITT+ryfRC:SdOLgMw24yP03eks4Y2jjHQqOXy94qNY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 f6c21292d48b911e365979e17fd96c2f88e6df3dd58cd8f1924d809e5b8ce452
- MD5 ac2cdde114e8b63e0c7b80e11bbd4b46
- SHA1 688df21582f76283ccf23b7f3d113d3888b47c7e
- SHA512 935a8918ce6f558280711d25ea7beb5529322c147379734b5fec046a674e17e05220b60c11e2d413115cf5daf087bee048d379e79331cebe9c37afe1f89d6fd6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 86c9f72bf4f5b349918a3df43c304e9e1ae488ff5cfd648b1ed4fdfe5a830a81
- MD5 c86c1c8e9f8e26067872ac872a13b945
- SHA1 7636b1bf7d531c8bae808e3f04ecfc10a5783b09
- SHA512 55c603ab2032e03aa2e04e2869e33d613b2f381a2afd0480f6831486875fd7e94bd481a20ee4a2041aaa76f7b40839ea436534cf8ae57d1384fbbaa3c723540a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 2KB
- SHA256 3ae540113858efddaa267a34fae5b0bad58e4b11916244b096d50943e4cd2930
- MD5 bdf04a8983e5a667dc68c207f18df5ba
- SHA1 0aa6c04cae8be5ac908bbb72b974b2b95353db89
- SHA512 9488ff9e2f9c258a3588df8a12f720d6cca2f6d24df286b1597edd788ccbbfffdedba00bfd5d134ff8dd50c9255ece9995889c08d9d3642857cd6cf55c6876cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 3KB
- SHA256 70930222646a22174cdcbb44216ca0fcaa1f6d353a90c25b70cf45e360cd9e83
- MD5 c816eda54b19d8246afda5ec5ca66c88
- SHA1 17cc4d9621b2f19c3fae0bea7dbe23a6c972e044
- SHA512 6080ffac8c4f0d3c7ca7bd4d87ac7df90ead27f052195301bd8c77ce5accd31791dbeac1e6dc6fa6d8cc7a15b8f616ce319e9b62418937bcfc5efc1427e91e0f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 4KB
- SHA256 5558edc38bb1f80477c75e62d5330b822b703a7aff097686e17866165a2b1914
- MD5 ebd5c978a8a8f98d120ee94438cb5b21
- SHA1 9903efcb67df38e6415ba0e9cb65bb6d761d3f51
- SHA512 bb43587dc4bd438768332144510b75dd6ada7bd13c96bceb517c21385bc2d5ef3d34661f2d48c67eb1c1e519cf29e4d28bc6bc4d4f6ebf6f2c451e23b21a3624
- SSDEEP 96:UAUc+QUWwytkU5IolGUC2IUFbJUjh/Uw8oUn2UW3UiG/UZchUneRU+rowUr3Ul/j:UAUQUwkUBlGUBIUJJUt/UdoU2USUH/Ua
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 4KB
- SHA256 947f16a16c1a1c94af6573282f30d06fe06b2b0dcd9335111999999042aa008e
- MD5 74c4307542cdc8bcb06b10c9235e119d
- SHA1 b1d984713e4b8cc919ba1e5a385316a192ed0d8b
- SHA512 eb03431bf1459e0bddd223ce454fcf23ebc9fb670c76354811352a049b30c201d01aad35de8e0aa16d9df3dc9bfb91fcf491b899057d220c412c26c3ff8ff9bc
- SSDEEP 96:UAUc+QUWwytkU5IolGUCwRXIUfbJUjh/UwhzoU+2UW3UiG/UZ1hUmeRU+rowUr3U:UAUQUwkUBlGUxRXIUDJUt/U8zoUHUSUX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 4KB
- SHA256 f77d2cc14a6d881b6c363c1fcfdbe58df56494a19b23e1f5dae2b0a56c9a4ba3
- MD5 e1f22c512700d63fb16ca83b61e6db85
- SHA1 383604f105ba3587f7d5e4b52766cf23d287fae2
- SHA512 5d8f00e55c144c8d11d50a49a88e6efdf9fd2b667da4b154b6457b50af57eb6a476e9723465394aafc1aa01bc6817607677f9d59856b45f5441b278320417043
- SSDEEP 96:UAUc+QUWwytkU5IolGUCjXIUYbJUjh/UwFzoUO2UW3UiG/UZ1hUmeRU+rowUr3UT:UAUQUwkUBlGUkXIUEJUt/UczoU3USUH3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 4KB
- SHA256 705bceeceaa0d144f1a72d0a8bb4be7a620131441f61a9c903a1a99bb3a86a2c
- MD5 90e94497ec6733380db50d27fc274bf7
- SHA1 b9792e0a66a9b271e31bada7eb89e6cdcab38f7b
- SHA512 9b507c0702754c9a11745aad50798c145f3c5c00b18c5f063841e3333ff61d494226db0ee51531f61cc770d0ef6eed4e148e79b16458bb9ca580cc9aadf82c39
- SSDEEP 96:UAUc+QUWwytkU5IolGUCIXIUjbJUjh/UwTNzoUxUv2UW3UiG/UZ1hUmeRU+rowUo:UAUQUwkUBlGUjXIUXJUt/UczoUx5USUD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 4KB
- SHA256 a101f17011e308110ca940e651449b856977a2c48b0ff156625dc02547112d20
- MD5 3a4c21e85479259aae53b30804bcab23
- SHA1 8f3a8560806fa485e54987ea67636fb7844b71cb
- SHA512 f92fb926e29202c45ed6c05070a9ea4c5f8f85111eed602f398b88248b8d700228f861433d407c9b1ec3a37e65a6aa6ff7c707d635df3a7209677d2cdb04ef46
- SSDEEP 96:UAUc+QUWwytkU5IolGUC+XIU5bJUjh/Uw1NzoUIv2UW3UiG/UZ1hUmeRU+rowUrM:UAUQUwkUBlGUhXIUNJUt/UQNzoUIeUSQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 b51a952258245c09e45a2ed9a3a69ff20136ab125f1cef5d47fa271beeeefbde
- MD5 9531cfb5c322db33e4c3f772274659d5
- SHA1 9df4f551d085c7bbc2135b19930543b5865bca8f
- SHA512 12c102625941dd2bb089626c239234e788667d6f475abf1d300462dbc6df0f08889b15ebb76aa61a09a5c9a5522c097ae29da012844adb10238d0c71c5942822
- SSDEEP 192:TXiB5lbfmF4jZQe+CHV+FMQkke9D+Po6yIsnVdg4:TXiBfmFAamG/krD+4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 fef191742d84008e3078e528cd7b1c3a857fd3cc27286fc282add26710d6795d
- MD5 0e2a428380d1e101b50fa39318e5dcee
- SHA1 6a3c493b8c0c8268bde0fac281eefbd13067ea91
- SHA512 fa207880c4aa6916d96c28451f52da7191d94269b43a0139e9ea5fad1f06969a3001bbf9dc17de4d34ad3fb6ce44f201b3cc8e1a6405f7d0374a98ce94449db6
- SSDEEP 192:TXiB5lbfmF4jZQe+CHQ+FHr6JecD+PD6yIsnVdg4:TXiBfmFEamXL6RDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 4ed5a220a044048f65cc8eb0d83880c327ce55fe2969092541f1213547cd6c8e
- MD5 aedd4ba42e017175674b520e9f77e900
- SHA1 69fbdc0d28af9625549667147130637179f0984d
- SHA512 b1bd77bf96e9cb284bda6ceae6a15a2f6f8c2b94cd7f550fcedd77b1d45a40ba0d8cf9566bd8f5fdd9560a3b8ad51010a4b278049b4ce067636a2091e7854e3d
- SSDEEP 192:TXiB5lbfmF4jDQeyCHQ+FjOuCecD+PD6yIsnVdg4:TXiBfmFK2mX6uMDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 616de55bd850105ff9114c3acac41008de3daceb4eec2593c07861de2f6c3499
- MD5 3bf7bd92636aba59a5616e66081d15a8
- SHA1 de003fe70882d0bc6938885067e9b6263e2a616b
- SHA512 2e79b4155c2cbdc8630ef340d0e3ed8a6efde1e0d4d40a4c1f8077ba2d65508413567e927b287581931b0847e42f84f5e180141a2467423b43f45ee8858cb2d7
- SSDEEP 192:TXiB5lbfmF4jDQe3CHQ+FjOuCecD+PD6yIsnVdg4:TXiBfmFKDmX6uMDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 e6180ebbedb47bc54e173c8aee765ae2d2ddb11ee18d3c1ba5aec9d3e7f51930
- MD5 ed7627d54a7f6a6ed951bde7dc3ad1c9
- SHA1 6bc493b2e462ff3cac175abd4c5516f401ff229b
- SHA512 0f94d438d7252814e2ac1670c93b29bf2531e990da66d9f36fdc4be1638eecbfeb798e1c7ea39fdd0d1c9e93c31675935ca1f3d5a2e4ae0f244aaaa28a322d0b
- SSDEEP 192:TXit5lbfmF4jhQe3CHQ+FwRiOe6D+PD6yIsnVdg4:TXitfmFUDmX2iWDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 22c8da017d10a2b086ca46f7155268c34759b7ffc9305ee3e178b3c7e00c1ece
- MD5 16cae493cfb63f35309ce72b99fcd005
- SHA1 8dbe8eebb3b93a8c7728ce9636360c53372f5e3d
- SHA512 131c805684dbdbed717bdf4b12d28487e3277992ae85db6d99dfb46a7f7f71a4d28240718472cd28cbed318c63c0e6fabdf0f13e1393f7cced0a54a608abb5f3
- SSDEEP 192:TXit5lbfmF4j/Qe3CHQ+FwRiOe6D+PD6yIsnVdg4:TXitfmFyDmX2iWDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 930845cfe698266246c1bc25661d0f1bae6e8cdf942065e9a0ae02a4d5395fb5
- MD5 a3db8e3ae7812f021b4aca0e907d2f9a
- SHA1 58b1a83dc193a6f6d469304aa5340dbaf0415b5f
- SHA512 d916b67ac4dc55b821682839ac75cbb4345076d57822171e530e72971fb5510459f3f2e6543b3372f6663c32fb650101e410389befa042753f0a477b5a8e8e85
- SSDEEP 192:TXit5lbfmF4j1Qe3CHQ+FwRiOe6D+PD6yIsnVdg4:TXitfmF4DmX2iWDr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 d3f340728e6aa0ff2c6dcb6ca69229bea141959e967be169efa768c282a485a3
- MD5 bf52589ab2b282e2f184514f2f15e747
- SHA1 980205291dee41b7213ebca709dc98f64cb66b27
- SHA512 fa33c4ed95a9d3399e31b4e4135936352078e915c21e1518c3ffe1e59f9e19719fd31942f57a4076c76759c41caa5b57a4d14a7649e1b41b78af8f694097d539
- SSDEEP 192:TXiB5lbfmF4j/Qe+CHQ+FAcsEe9D+Po6yIsnVdg4:TXiBfmFmamXXsLD+4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 bc2e0de8ae50d9dc7f5e04e829d38a3a8e6e20b9d82205bb4fe1a0dcd644dac7
- MD5 a6530626371ff0447ef1bb522aefaae4
- SHA1 69cb80da59aec546e20f7e3900581dfa1a279573
- SHA512 2dbe2e7145122f7049972e3d74a02f55fd1e5b56e37fc2aeb57763760ba0c644066db25e08d8aa5b927c59dfd0caf0d340055e76e6e72d9549b98c8c4b999c01
- SSDEEP 384:Rlvj7pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crUfWTg:Rtj7pLhLnyemo1kXqKf/pUZNCgVLH2Hi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 9dd1c705a786430c188719039e5350f5572b66952e45cf3c6303f649917d7680
- MD5 57afbff4b60cd605e92a7203bea52fe7
- SHA1 ebfa9a5cbb2c18ad40cf793ece87a2f8bab4434e
- SHA512 6b19cb7ef225b38be55a0067b291b65fbbff0e80da989e4132f9c15e5b0a678a3bcff45b4563f0f18900b66f5bc43b3ed8b44a9e5fcc1519bbadb56df5f79839
- SSDEEP 3072:OXIYwvtT8EhmxT+YY8M6CpSkQd/9JxfAGavCM306UOGEqGfL8mLJjs2BCw:Ozw1Fm8/z6CpSHVr4ZlTFqgImLhs6Cw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 bc61dcc8f3cb66c8f34e3add27b91ffdd0b4f5036121db9be63f25cc34650fca
- MD5 dc6fcf9713f587fb7a2fb0f9b081861d
- SHA1 ba1ceb2c859c289f72443231b38f2045a1dbb671
- SHA512 725a1c464facfad63dbc8b8d9810d57e64d3d9e84ff940b7422f8d800ca450389e333b6918310b437c2c79065cccfc38add39718e038f00d1f39563195fc54d9
- SSDEEP 3072:RXIYwvtT8EhmxT+YY8M6CpSkQd/9JxfAGavCM306UOGEqGfL8mLJjs2BCw:Rzw1Fm8/z6CpSHVr4ZlTFqgImLhs6Cw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\576e1c153e9a4c8db9cb845a7679bfcc
- Size 5.9MB
- SHA256 da54941bc273cb5ea3c50a3df7983f6560114d0e9f6fe196a2077e3810f561dd
- MD5 576e1c153e9a4c8db9cb845a7679bfcc
- SHA1 7fa5235289c1eb038774cdcf30be21cb72771201
- SHA512 a4d956c4c860ba9b652647c4fd94ba0a617d1ec3436a8fe267292d36b38805acc4f484aa65e9c45e20c10536365a13645d25acbdc4c23e7506829a6f603820af
- SSDEEP 98304:zUvQ2IjlfUfHQuUkM3bDnWZPwpgnt0ntFw8eREAgsVglum8:oQfjlfaC3XXgnLRwsell8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
- Size 5.5MB
- SHA256 cbd127eca5601ef7b8f7bec72e73cf7ae1386696c68af83a252c947559513791
- MD5 3191d6165056c1d4283c23bc0b6a0785
- SHA1 d072084d2cac90facdf6ee9363c71a79ff001016
- SHA512 ac0fa1c6e8192395ec54f301bc9294c2a13cb50698d79d1ca32db9d4deb4852e7607032733d721bc5c9fd8d1ce5610dd73b30b66e0302141377f263a3b7fa0f3
- SSDEEP 98304:PvvnSTv4jyAjF0jl4kj4/5N6v1sgHqN1qlwlR4tcbMjh+1uGQOY:vnav4xFG2h5zgHqhlRpMjM1oz
- MD5 SHA1 SHA512 SSDEEP