hxxps://cdn[.]discordapp[.]com/attachments/1239664136208646184/1272013828774957119/CeleryInstaller[.]exe?ex=66b96eb1&is=66b81d31&hm=e6328c786775a541be817db34b17ecc6b72dcb286be58333ac0587e237e140b1&

Analysis

max time kernel
760s
max time network
759s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1239664136208646184/1272013828774957119/CeleryInstaller.exe?ex=66b96eb1&is=66b81d31&hm=e6328c786775a541be817db34b17ecc6b72dcb286be58333ac0587e237e140b1&

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	CeleryInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.7.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Celery.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.7.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Celery.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.7.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Celery.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	CefSharp.BrowserSubprocess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 42 IoCs

pid	Process
5300	CeleryInstaller.exe
5868	Celery.exe
5140	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
4452	main.exe
2884	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
5392	Bloxstrap-v2.7.0.exe
3656	Bloxstrap-v2.7.0.exe
2040	Bloxstrap-v2.7.0.exe
252	MicrosoftEdgeWebview2Setup.exe
1980	MicrosoftEdgeUpdate.exe
6084	MicrosoftEdgeUpdate.exe
2276	MicrosoftEdgeUpdate.exe
4996	MicrosoftEdgeUpdateComRegisterShell64.exe
4136	MicrosoftEdgeUpdateComRegisterShell64.exe
3696	MicrosoftEdgeUpdateComRegisterShell64.exe
1316	MicrosoftEdgeUpdate.exe
4308	MicrosoftEdgeUpdate.exe
5524	MicrosoftEdgeUpdate.exe
5624	MicrosoftEdgeUpdate.exe
4532	MicrosoftEdge_X64_127.0.2651.98.exe
6048	setup.exe
6052	setup.exe
336	Celery.exe
3476	main.exe
2016	Celery.exe
612	CefSharp.BrowserSubprocess.exe
4788	CefSharp.BrowserSubprocess.exe
4632	main.exe
3672	CefSharp.BrowserSubprocess.exe
3964	CefSharp.BrowserSubprocess.exe
5012	CefSharp.BrowserSubprocess.exe
3920	luau-lsp.exe
928	MicrosoftEdgeUpdate.exe
3332	RobloxPlayerBeta.exe
208	Bloxstrap.exe
3008	Bloxstrap.exe
1104	RobloxPlayerBeta.exe
5688	CefSharp.BrowserSubprocess.exe
5776	Bloxstrap.exe
1924	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
5868	Celery.exe
2884	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
4988	CefSharp.BrowserSubprocess.exe
1980	MicrosoftEdgeUpdate.exe
6084	MicrosoftEdgeUpdate.exe
2276	MicrosoftEdgeUpdate.exe
4996	MicrosoftEdgeUpdateComRegisterShell64.exe
2276	MicrosoftEdgeUpdate.exe
4136	MicrosoftEdgeUpdateComRegisterShell64.exe
2276	MicrosoftEdgeUpdate.exe
3696	MicrosoftEdgeUpdateComRegisterShell64.exe
2276	MicrosoftEdgeUpdate.exe
1316	MicrosoftEdgeUpdate.exe
4308	MicrosoftEdgeUpdate.exe
5524	MicrosoftEdgeUpdate.exe
5524	MicrosoftEdgeUpdate.exe
4308	MicrosoftEdgeUpdate.exe
5624	MicrosoftEdgeUpdate.exe
336	Celery.exe
336	Celery.exe
336	Celery.exe
336	Celery.exe
336	Celery.exe
336	Celery.exe
336	Celery.exe
2016	Celery.exe
2016	Celery.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
51	raw.githubusercontent.com
167	camo.githubusercontent.com
177	raw.githubusercontent.com

Network Service Discovery 1 TTPs 10 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4988	CefSharp.BrowserSubprocess.exe
4788	CefSharp.BrowserSubprocess.exe
3964	CefSharp.BrowserSubprocess.exe
5012	CefSharp.BrowserSubprocess.exe
5688	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
2884	CefSharp.BrowserSubprocess.exe
612	CefSharp.BrowserSubprocess.exe
3672	CefSharp.BrowserSubprocess.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	CefSharp.BrowserSubprocess.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	CefSharp.BrowserSubprocess.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	CefSharp.BrowserSubprocess.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	CefSharp.BrowserSubprocess.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
3332	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 54 IoCs

pid	Process
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
3332	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\pt-BR.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ca.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\fa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\id.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Trust Protection Lists\Mu\LICENSE	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\kn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\PdfPreview\PdfPreviewHandler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\cookie_exporter.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\en-US.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\edge_feedback\mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\bn-IN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\lo.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\nb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\km.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\lt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\sr-Cyrl-BA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\id.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5868_2125446141\_platform_specific\win_x64\widevinecdm.dll	Celery.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\as.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msvcp140_codecvt_ids.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\d3dcompiler_47.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\dev.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source6048_1815510837\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\dxil.dll	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CeleryInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1316	MicrosoftEdgeUpdate.exe
5624	MicrosoftEdgeUpdate.exe
928	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	RobloxPlayerBeta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	RobloxPlayerBeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	CefSharp.BrowserSubprocess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	CefSharp.BrowserSubprocess.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 31468.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 592708.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:SmartScreen:$DATA	Bloxstrap-v2.7.0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2348	msedge.exe
2348	msedge.exe
1392	identity_helper.exe
1392	identity_helper.exe
5192	msedge.exe
5192	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
5140	CefSharp.BrowserSubprocess.exe
5140	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
6016	CefSharp.BrowserSubprocess.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe
5868	Celery.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	CeleryInstaller.exe
Token: SeDebugPrivilege	5140	CefSharp.BrowserSubprocess.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeDebugPrivilege	6016	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe
Token: SeShutdownPrivilege	5868	Celery.exe
Token: SeCreatePagefilePrivilege	5868	Celery.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
5300	CeleryInstaller.exe
5300	CeleryInstaller.exe
5868	Celery.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2040	Bloxstrap-v2.7.0.exe
3008	Bloxstrap.exe
3008	Bloxstrap.exe
5776	Bloxstrap.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5300	CeleryInstaller.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
3332	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
1924	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3240	2348	msedge.exe	84
PID 2348 wrote to memory of 3240	2348	msedge.exe	84
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 216	2348	msedge.exe	85
PID 2348 wrote to memory of 2152	2348	msedge.exe	86
PID 2348 wrote to memory of 2152	2348	msedge.exe	86
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87
PID 2348 wrote to memory of 5084	2348	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1239664136208646184/1272013828774957119/CeleryInstaller.exe?ex=66b96eb1&is=66b81d31&hm=e6328c786775a541be817db34b17ecc6b72dcb286be58333ac0587e237e140b1&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96746f8,0x7ffcb9674708,0x7ffcb9674718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Users\Admin\Downloads\CeleryInstaller.exe
  "C:\Users\Admin\Downloads\CeleryInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5300
- - C:\Users\Admin\Downloads\Celery\Celery.exe
    "C:\Users\Admin\Downloads\Celery\Celery.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5868
  - - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=1976,i,10201459249772375110,1822702523844017077,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2 --host-process-id=5868
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5140
  - - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=2476,i,10201459249772375110,1822702523844017077,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3 --host-process-id=5868
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6016
  - - C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe
      "C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe"
      4⤵
      Executes dropped EXE
      PID:4452
  - - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=4340,i,10201459249772375110,1822702523844017077,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8 --host-process-id=5868
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      PID:2884
  - - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=3572,i,10201459249772375110,1822702523844017077,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8 --host-process-id=5868
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      Drops file in System32 directory
      PID:4988
  - - C:\Users\Admin\Downloads\Celery\Celery.exe
      "C:\Users\Admin\Downloads\Celery\Celery.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:336
    - - C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe
        
        "C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe"
        5⤵
        Executes dropped EXE
        
        PID:3476
    - - C:\Users\Admin\Downloads\Celery\Celery.exe
        
        "C:\Users\Admin\Downloads\Celery\Celery.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2016
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=2008,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2 --host-process-id=2016
        6⤵
        Executes dropped EXE
        Network Service Discovery
        
        PID:612
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=2832,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:3 --host-process-id=2016
        6⤵
        Executes dropped EXE
        Network Service Discovery
        
        PID:4788
      - C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe
        
        "C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe"
        6⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Users\Admin\Downloads\Celery\bin\lsp\luau-lsp.exe
        
        C:\Users\Admin\Downloads\Celery\bin\lsp\luau-lsp.exe lsp --docs=./en-us.json --definitions=./globalTypes.d.lua --base-luaurc=./.luaurc
        7⤵
        Executes dropped EXE
        
        PID:3920
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=4476,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8 --host-process-id=2016
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Network Service Discovery
        
        PID:3672
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4468,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3980 --host-process-id=2016 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Network Service Discovery
        
        PID:5012
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4640,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4632 --host-process-id=2016 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Network Service Discovery
        
        PID:3964
      - C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Downloads\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\Downloads\Celery\debug.log" --field-trial-handle=5000,i,5696705765079049538,14651872924256647325,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8 --host-process-id=2016
        6⤵
        Executes dropped EXE
        Network Service Discovery
        Drops file in System32 directory
        Modifies system certificate store
        
        PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5327694141421867370,1189726002930659827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1984
- C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
  "C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5392
- C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
  "C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3656
- C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
  "C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of SendNotifyMessage
  PID:2040
- - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:252
  - - C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU330.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      PID:1980
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4996
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4136
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3696
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjdEQkQ3NjgtNUE5QS00NTg1LUIxMjctOERBOUFDNTk2NkEwfSIgdXNlcmlkPSJ7RDkyMThDRjYtQkE4My00MTY1LTg1NTEtODVGRDA2NkM1MkVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4QzE1Q0Q2MC1GRTEwLTQ1OTEtQkE2MC01NjFFMDFFOUEyMUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMjkyMzkwNTA2IiBpbnN0YWxsX3RpbWVfbXM9IjM4NyIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{67DBD768-5A9A-4585-B127-8DA9AC5966A0}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4308
- - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" --app -channel production
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of UnmapMainImage
    PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5524
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjdEQkQ3NjgtNUE5QS00NTg1LUIxMjctOERBOUFDNTk2NkEwfSIgdXNlcmlkPSJ7RDkyMThDRjYtQkE4My00MTY1LTg1NTEtODVGRDA2NkM1MkVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5OUJDQTE2QS1GNTQxLTQ0QzgtOTZCQi0yNzFFOUY1QzE2NUZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMjk4NjAwMjgzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5624
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\MicrosoftEdge_X64_127.0.2651.98.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\EDGEMITMP_45C89.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\EDGEMITMP_45C89.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:6048
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\EDGEMITMP_45C89.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\EDGEMITMP_45C89.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6EBCDE81-F25F-4C61-9632-2A765D90CFC8}\EDGEMITMP_45C89.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff60ac3b7d0,0x7ff60ac3b7dc,0x7ff60ac3b7e8
      4⤵
      Executes dropped EXE
      PID:6052
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjdEQkQ3NjgtNUE5QS00NTg1LUIxMjctOERBOUFDNTk2NkEwfSIgdXNlcmlkPSJ7RDkyMThDRjYtQkE4My00MTY1LTg1NTEtODVGRDA2NkM1MkVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszNDFDQzYzNy00QUYyLTRDM0MtOEVGNS00Q0MwNzY5QTFCNjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzMjY5MTAzMzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDMyNzA2MDQ0MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNDk3NjYyODkyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyMzk1NTg4NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1JcERXZVhVUzBMREh0eGFrdHhBUjRVZzJOSnNqakxMWlVzNDNiRzd0VFR4MnY3QlNqcklYdWtrMU1qZldjWTNaSEtqOE4lMmJwN1FyQXRwOW12aHZyM3lRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjA2NDA4IiB0b3RhbD0iMTcyNjA2NDA4IiBkb3dubG9hZF90aW1lX21zPSIxNTAwNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNDk3OTUyNzg1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1MTI0MDMwOTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwOTY5NzIzMTk1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTgyMiIgZG93bmxvYWRfdGltZV9tcz0iMTcwNjgiIGRvd25sb2FkZWQ9IjE3MjYwNjQwOCIgdG90YWw9IjE3MjYwNjQwOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDU3MjgiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:928

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe" -menu
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:208

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:3008
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" --app -channel production
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  PID:1104

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:5776
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" --app -channel production
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe

Filesize
6.6MB

MD5
527503f430c5fd4a542f8c0f163fde47

SHA1
6b4db644895df6c71b547d8b147ef3e327418f9d

SHA256
d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

SHA512
ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
5ed013bbce5499b4a5ae3cd41b6bd66d

SHA1
3fc6bc3e74fe24d4c8e3e8c04f89414721d5a681

SHA256
018ea8706e99d6731f47ed6f829c02c5faa2abf0cef08fa416e105432c0fe4d1

SHA512
aed55fa7ed3195eed089098df810e6c6d426ed154d6f64a7324cd371693151d6bda659f13d43a30f6a96e5cf979e9dd208894ca22c857c967f11b2aea4ed9cc4

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5868_2125446141\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
181KB

MD5
70af8f7bdbc30f6b651f365357c1b51c

SHA1
b18c2e3e1747d92b77c603a8972f0fbbf33b4d74

SHA256
dbeff5c30f3f48152862ab021cb86fa9302192cbda5da05cfae5e03e79513d67

SHA512
af32a9e73e57799db0ce2c1558ff9dc9080345fcbc302ee909a2664b90a1e98060d8fa5e6e801be4d34b6e1f440b3ee751d961d698ded5cade6283260a6a2870

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json

Filesize
79B

MD5
eab6dcc312473d43c2fa8cc41280d79c

SHA1
b4e9ec7e579d06dfcaa5ac616de2751308a153c3

SHA256
0a27d3c9100ab7ab6f03c45daeb0f0cd586f3aeb59daf7986e853f9614e954fe

SHA512
1ce0fdc237110d644bcc8238f184554f25813ccf7142fd312ce96fbb6659081db677b04485bf66d52100136da6bb9688e48b1287455725c7b4950153aa2a4595

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6fdcfe060c6440cd\content\sounds\ouch.ogg

Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\6ce5a3f0d9f0e769\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
37KB

MD5
a2ade5db01e80467e87b512193e46838

SHA1
40b35ee60d5d0388a097f53a1d39261e4e94616d

SHA256
154a7cfc19fb8827601d1f8eda3788b74e2018c96779884b13da73f6b1853a15

SHA512
1c728558e68ed5c0a7d19d8f264ad3e3c83b173b3e3cd5f53f5f3b216ed243a16944dbe6b2159cfe40ee4a3813ca95a834f162073a296b72bbdedc15546be8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
37KB

MD5
93acf02790e375a1148c9490557b3a1d

SHA1
78a367c8a8b672dd66a19eb823631e8990f78b48

SHA256
4f2513f353c2cdd3177e3890f216ea666e4eb99477a56a97ff490f69a9833423

SHA512
e6354f4e4d35e9b936a7ddaebdd6527c37e6248c3f2d450c428903a32d77439cab78020a45834379cf814a79149c3dddf4e1280b9d06a7f972e5f8e61c463d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
a6d2a865e9f16ea305950181afef4fcf

SHA1
082145d33593f3a47d29c552276c88cf51beae8e

SHA256
2e5d94863281987de0afa1cfd58c86fde38fd3677c695268585161bc2d0448a2

SHA512
6aa871d6b2b0d1af0bda0297d164e2d685bc53f09983e5a4e1205f4eb972a2017323c99c3cc627c3fb01381b66816e570f61d013d3775cddad285ac1b604cdc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
23KB

MD5
bc715e42e60059c3ea36cd32bfb6ebc9

SHA1
b8961b23c29b9769100116ba0da44f13a24a3dd4

SHA256
110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

SHA512
5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
109KB

MD5
91aba671d01790cd073f98f07d478bd1

SHA1
30f5a51338c58dbb585eb80f5cdc9a3586694e79

SHA256
03e18dd23a3368f2e4b5ce9949ce008e9472c79f6b5db37fdad39fcbb95eb1b0

SHA512
0312f460b117b2e154a5404b422f0d52f1281fda1cf05a04fbd35bcd40041298c3bb7bf9adeb2006e95c838e6bf3a1c5b299ac603c59cc94138e5bd83ccd9558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
141KB

MD5
d3d747f42b7b13b2aad27fd2a18be80b

SHA1
4e3077cb7ef676a4c7d81b18bc9429c473e46de1

SHA256
99eff48a135ed9e4e343b096a2c08cf3ca47cfb8a7e4957bd2a0f0814c24389b

SHA512
76381c4c21e8481091b1396698a6fb5868ba2b5985b6d0711617c412d57fef6c9466f7446239b19615b9c2460eea252974a25afedc2ea53d131616bd1fd415ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
99KB

MD5
82184d01f31478829c8f00e74cc3ab12

SHA1
102dd35019bde5d1ae354ca78a3f47bdf6ae5806

SHA256
a4f60d0546b7d64ce364731a1fb8a9386bed39a70111e811c3977f3c2773e22b

SHA512
4fa76b197bdaccf85a36e22292103edea0a6ba8802350563c7e6bb87a9f1f3e7086bce687d840d0441f3a47f10225dd9855c786e4a034dddc91e487eb67fb941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
248KB

MD5
8973fa9b7b7a0dba6138cd04fdf80210

SHA1
ae4a07f7672119ec8ee54b488dcd580ded328e0b

SHA256
85492825fb1a16d2cabde1ce78d706bc2b51401df512cbdc2cda967a7bd28160

SHA512
5750658e8a2609e1f794704a501828211d8450bd173454cec67d23532aa819b0378dbb2f99640f4431543fdf18214259f01d6f09c3e07592c36114a9d4725b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
34820fa8fd8444a401bc4a66c4a3d00e

SHA1
c687a384d5ecc35556d8859fc98597c860ba506a

SHA256
29bccebc431540476e007d517d7e0126d5ca5e27fa103d6725cbef927fab4209

SHA512
a5eba397f411b1545939d5daefe783a187354510369273f06a42586a0187c725abe89334637024a24e88eb8a29df05c0bf29c6ef4b505020f73a7bc10e91e2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a8a65b3af8c9db31ea8450ce617773e8

SHA1
a54a3320cdc4e1fefa6e4ca4ec4e0d69384ce79f

SHA256
7594b5e0df9564fadf80c9893d9bdabc74738a678dc5a5675d317bfbbe40f9c8

SHA512
0abbb02844d3178c3d8983b67ffb8a228a975cdfd4b4f8eea231f0ae944ccf02e6e166e8193c7cb1e198a5e5d6f82fcb799f8314fff417493971beab9a061cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0484135df78d69dad5fb3e6249a0780d

SHA1
6360bf736e46b3b0de40d128ddd573d6b6e0aa47

SHA256
10eb2fa6c38896bcfdd69398ee45504fc1cffd92e593d06feabb1663bc42a03a

SHA512
e45e0f2000915c7cef01a051c9b63c60af689330c6086a0ddddf3e2861190e65aa19937b07e86f1a12e30a0a415320b2ee48848e20c107060da4554b839c4879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
859cf9cd77c9a6bd5b0af56f08fb5128

SHA1
d62387a78e8a1643ba3117187479da14bce1b65c

SHA256
d16c0bd72e9deb73d2e3a40eb21ac668477363c33e58765884b1663324a4eb05

SHA512
e60f5d7000507794a20316c7110fbee3f1d9b02efdba877bec150d5d63939eff3aa9fbba758709a8094c65a083b158840563a8e8399b64e16a077d12a1cb8fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24267ebc8a13a774b8076bf730928be9

SHA1
3bdfaa21f37885e0f7a79c6fcc5437851fe54b42

SHA256
8222bc37ad8c3a38d5d5a52b27288aff49bc4329006d33a97ca98faf25e1015e

SHA512
dbf858d5504fd8e03755c8736ad2e98d740b0bd777b3ad4a6a8d45f2795b31d1bf6e945df4b8a307a380f100206658472bcfe2d54714b0338fb0fc4005ed9503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d9ae4ed9ab35a452f02a7e63ff6efc9

SHA1
304c1ba7ad4fbec866e0b42ca5d252525082eb9c

SHA256
b0b83589a0a1b81e4768c460d63b621172280fcf8d07fda4616dabace09a7630

SHA512
8dbd308ee46eb0a31138635b4f223617fd74b3f9b9471769331aed20247ead2f21a55d72a36317d9076bddc41998f823d0d8f2c48abefd14679f19f75e150a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0fc4e14741884d96cfb8569bc2c9bcf

SHA1
e3f280ad28ffda57d23aeb4240f40216084c89a0

SHA256
12b486be30d1736932579012e19519ceac2c9c262d27b986c41ea7f526c34ce2

SHA512
86391de60dcfc3896999428c44812059b184f72d5d9febb3daa2c4aba297a399bde5cb357cb9d324e7fe4ef82848b06fa65879450dc174c0c85881e268bada48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b59365d6feab74c9980453fd3d951078

SHA1
e18a3bbf373d9586d72fca9c36660f051f48c9db

SHA256
ac63e7dec473a137ed83041d2993ab33ac230269070e9ccefec301ee328c0d49

SHA512
a7cfdfb920d5b045604e830f1d0251ad558f9e31e4ab413224484921877a3e6400ddd0da10fdfc847382e93c235d680c29dfb46a1db2fc8ded81ef798dad6c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e8cd881e9402811074a0d6055a83b41

SHA1
ac0d05b82db21580749b57fbefe18b02be166804

SHA256
5b979e0ff6c31a0d63dee3fe9fc7dc46045babda9a2eb07a322152d9bb26db0c

SHA512
ed2d0dd500def80ba8a065fc7a0e0be7a0c477429141038e55edc664f0f62e31cfeffaf52323abc27ce3f5b97ba2f1f65c5e08af6ff74431df9636086a7c14d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae236bfbb617984843b4336a3a14aa6e

SHA1
febd51da1a74a68faa4195e62b1dcdfcd632d72a

SHA256
ba5fec9b5cab1fd33f6721537a0e1c040ce4ff17740f27344a4d537cdba2b356

SHA512
e69328bae252215c075c21a40556a5b303531736ee7352d6e7c702b75a36b32fe670dfeabd6aab9e4d99849acd3299c09b65f2a4ad1a36970aa15a05dffdbc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b88236d9373aeee35aa8d0cb3813a982

SHA1
f4189223e3f1f046e2bfea966cf7106110ff23a0

SHA256
745a2e80ab3b9c66a21fb4ed3ce436f4f9d9051300a4fb528829c0de63524c92

SHA512
cf5cfb69d1009cd2d86619e4e6a1441cf4f3a5d178949c5d85157a34fb3ac80d9ad263c51a0c9b3de5f18f3f6af00cee1de85a26e7e0b07dfe516362328bf8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5125c632cd93d9e476ae5f0688c04fdf

SHA1
5171bf5418a6380c9c0b654e613c50c22784e932

SHA256
73f47d0e91f67838a7f3b452712e85e896f746960a0625f22bb8accf2300fabd

SHA512
f252fd2aff127ef221ff3025e238ab813452fae2cc876b2421366853e75e8cf404f97de2222428d31c775c690d58e1b3e6879476f2563d147620b9d8a29cf0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
03ca7a18f754d6e737f0eedfeb22bd0a

SHA1
ac161dab80be2e446b78cae5a30c971a5eafb900

SHA256
83b6b3f097ac29b2f2ae4d17a4aa8a8f172a13b89882c6b0f8452c1f45a41a8b

SHA512
2784c2b0416d19ded7f0b9ec773f669e6f32c3ce24926dc2cc0eee55214885a6a6690f434d0058492eee2c08098d28e771929734c69d8897cf6d667d4823fe19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f17a45880ce4d2d57a1d0b461548edae

SHA1
331523b5a651cbcae35946041b631f3ea85003b0

SHA256
0b28e2ba9c73f55995c890542d3b029b5b943534c0141b01f560820dc52d32ad

SHA512
64bf67be3ab365b4836feb0be692253f643000da0bb8adb058926c5237000967b95c0d7219f1d93ad3610efd0e17cec018e68c0744ce2ac6ccf6a4d75c9e9d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
915bde6c563d6eed300aeb2c4c547fd2

SHA1
cf3b175b1d456e471c89377a8188668a732b7ffa

SHA256
a6b1fd86aa9c2b4a1a111f4125b7612a0312b6d9b54c23bae4efa01119ca5ff0

SHA512
14893e71036b39ce2e9ec87c7cbde9d45752b8a4b1908d2b699fd583cf5fdc37216f5d5f9b06fda391c93ea16865ab77129755c7c83c6f1673799dcf308235d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5eea6d.TMP

Filesize
538B

MD5
eade100300e887fcbcee250fa3452c1e

SHA1
7719a472455dd0f4af21777564be372a81bcec14

SHA256
ce1e176e68514a2c807f7a570c0b38201eb6820b47767645e542f45b2a0afeb5

SHA512
87e87651f3ba590755bcd971cc96fc84392c3d21c4da6ea6a621bad403231aad359f4856af7bfd22114afab2af49d0775b162c93a7f94673847d46f9cd613d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e2826ff56de9cfee6995568cbc3b7cb

SHA1
fa4f9fa6e19043a63bad7cce0ad08f56d8eadfea

SHA256
31195cf7b86abf7eda12427596f5096d24bfc8a013c890f10fe4af91cc9cb50b

SHA512
212cdd2d21b6fa90891a3c280a8cda8e2ae722f1710ed6d98370b0aed0a5d78850dac314893839196566c3c283a54d69a559e0cbab8ad10245d755aab9062922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c13e65ef3c594ab06b5b5bb9131193d0

SHA1
8cb88c496c71a045bd157eaddafc9d6b42c338df

SHA256
63a2b9cd29e09358141ace5391a9e4ef96e84b3d8e088946c5dff80ffab71987

SHA512
3c20565438513ddd8061efa4e4c27aebaf2094ee7dee070512720151360f64428ee9d37f8a6361be9366b277143f3a31a556451e038b9d904f6a463bf4c843bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
deaf337984981e75d4880100ede18e56

SHA1
0455ec58a0db3e32ca0d541210bc6c416012af6c

SHA256
3d22ddb7a3375c4fc6a3c5bb3a547dd2a6a573ef4b277d7a6a26497bfc1a2a93

SHA512
c464e61c88cdfb510117c127c3a6179bd1a8017ecab75747994495e297f7098fe54a39a7575d359c4c410064bcc867f3fbbfeaa3329e0dc2fa5ca46910bae374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
086f7728cbbf6f228c87925dc0e1c686

SHA1
9afc4a856b772ba862d4ebaae68deef1a5c8b2c6

SHA256
e4952e749df2718bbde3c4a4a9a3e0fda95a807deb5d8e46f513612e0f7722ae

SHA512
0c7bcd25e7828603a5e31efdc3bcdbf96e6a5c4aad19b75e5c9279a31a9f0c686a33cfc1d32f1eac24378b97d2b9efadc7e34952a7bcde74506f77bdedd6078a

Download Submit
C:\Users\Admin\AppData\Roaming\Celery\settings.json

Filesize
95B

MD5
549e0849b62ac1edd0e200f6821cf237

SHA1
c38c5e610a29fe868404c0a6c1dd28dc46c32654

SHA256
45907882a0e460ceb2cc46205083aae3eae5b874c1863bc6ff332d683486925c

SHA512
318d6c6f86460742f2890734d39d1c5291c3e0d18f6ba0bf22e7c8f327c2cae24cb1b468ff89f422a76eea63e6aed18e07b60159c96c0243f9f48fcfc631c243

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.Core.dll

Filesize
1.1MB

MD5
5b745ee879e65f7a47c56265881f16e7

SHA1
e6a90771b8f1bf53beeb7c9e4268756ff07a088d

SHA256
c8944a83938c39fbea72700485db8a61ab82e1c51d8e16d5dd48de4e36a6f264

SHA512
3b4bef98a1f751c3a747de0eb050828bf8474efa68aa7a26d0369f1c3b42829eaab221cb612c005a54ed5b84f19180700e51aab39adb84fe7246d9e91e6899c8

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.BrowserSubprocess.exe

Filesize
6KB

MD5
bcd22b9511d5383e23d875e2cf3c339e

SHA1
0ef86afaef536cc4b046ea2866414bb193d60702

SHA256
95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792

SHA512
c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.Core.Runtime.dll

Filesize
1.7MB

MD5
21719cf581f5cc98b21c748498f1cbfe

SHA1
aaada7a02fadcbd25b836c924e936ce7d7ee0c2a

SHA256
6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6

SHA512
6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.Core.dll

Filesize
897KB

MD5
16f8a4945f5bdd5c1c6c73541e1ebec3

SHA1
4342762c43f54c4caafaae40f933599a9bb93cb5

SHA256
636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a

SHA512
04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.Wpf.dll

Filesize
114KB

MD5
36946182df277e84a313c3811adac855

SHA1
bcd21305861e22878271e37604b7b033ec347eb3

SHA256
8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720

SHA512
80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd

Download Submit
C:\Users\Admin\Downloads\Celery\CefSharp.dll

Filesize
272KB

MD5
715c534060757613f0286e1012e0c34a

SHA1
8bf44c4d87b24589c6f08846173015407170b75d

SHA256
f7ad2bbbeb43f166bbbf986bdb2b08c462603c240c605f1c6a7749c643dff3fe

SHA512
fcaec0c107a8703a8263ce5ccc64c2f5bfc01628756b2319fde21b0842652fbeee04c9f8f6d93f7200412d9bd9fad01494bc902501fb92e7d6b319f8d9db78d7

Download Submit
C:\Users\Admin\Downloads\Celery\Celery.exe

Filesize
17.3MB

MD5
433bb23192adb1d78a2fd99ca652eab4

SHA1
40087ada7a5020046c30d8ffb9fd70949450151e

SHA256
06a7351cbbb9e794e8ee5793114cb74cda3b55f23eb634ea3b994adf851ddd3a

SHA512
d74a2156ea003640774a1139aa4c1b5b76f0f97ebbeec1dd3cebbf902eb667d369f7ea8e1d3c6aff140da6f75e5c64cee23cd1e2cb988873db95723ea9cca93e

Download Submit
C:\Users\Admin\Downloads\Celery\Celery.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\Downloads\Celery\D3DCompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\Downloads\Celery\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
ff34978b62d5e0be84a895d9c30f99ae

SHA1
74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

SHA256
80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

SHA512
7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

Download Submit
C:\Users\Admin\Downloads\Celery\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
62KB

MD5
00053ff3b5744853b9ebf90af4fdd816

SHA1
13c0a343f38b1bb21a3d90146ed92736a8166fe6

SHA256
c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e

SHA512
c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4

Download Submit
C:\Users\Admin\Downloads\Celery\Microsoft.Extensions.DependencyInjection.dll

Filesize
94KB

MD5
3452007cab829c2ba196f72b261f7dec

SHA1
c5e7cfd490839f2b34252bd26020d7f8961b221b

SHA256
18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698

SHA512
a8b83a8582dfee144925a821d09c40f5730f6337b29446c3bce8b225659bdc57a48778081fa866c092d59b4108c1d992e33f9543ae2b4c7554b8ff27b5332cdf

Download Submit
C:\Users\Admin\Downloads\Celery\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Users\Admin\Downloads\Celery\bin\Monaco\assets\theme.json

Filesize
390B

MD5
53140e18fb33e7e9a25e13f57a4190aa

SHA1
dd72190319ae2b7ddb12a137f50fad2579fcc897

SHA256
1cbd08945e5e8612b690e1eb663917cfb4f84f0083bf7d2c2a61f43e6c455e9b

SHA512
fb9b0456c7c9d468b14db242659d2cda36f7457f9035628d92538850a509e78116972e9890edc3b69d4379aaafb6da76ff2876b446b6953e14914cdfe7dc7b94

Download Submit
C:\Users\Admin\Downloads\Celery\bin\lsp\main.exe

Filesize
36.1MB

MD5
43ad962c7acda3e30300e7d0f1add3fb

SHA1
362c217d315f288f375fec7289a2606ed6d4f432

SHA256
534e6212f155fba25a38fba248ce7970e69335492d57443d04037b617260dd9b

SHA512
3822b6b426c85a61c4d754de7c33fdfbca45c9e80f2ba52f4c6ac98ad726109e276851af3612ebb39a6cefa4de9589d412e2805a3bacf7845d2aa22189396e4b

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d25ab33b0c2ee788b15ad695ceee0a9b

SHA1
32eaffb2b43bbf7b3a195359a346ece25a1a302e

SHA256
2b2345917a833c10b0d70a47f05d5ca0552ea4da515ec393e4a6776d255c37bf

SHA512
cc9ea511d8b1b50a6601883f30ac9e5133f7d627feb99c6ce57c71f3ffb768771bc5df466193044b9db7b080d1fcf13bf28443012cb9df01d1812fd486740b5a

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Code Cache\js\index-dir\the-real-index~RFe61035b.TMP

Filesize
48B

MD5
1023ea92e632521068deb672e441e0aa

SHA1
53d8993385f8afe36eaa92470b355ad010324baa

SHA256
481f0daa7f6506853ab64c645b59de76c0a04a339485c8b787897898d74dfb67

SHA512
0e591c0534ad4c917dbdcbf1a051b18de65d5002c8b96139426a81ca1c027153645ead8332d12840feaccc041d8a50be782a6029f2040b2305dadc8b1dbbf153

Download Submit
C:\Users\Admin\Downloads\Celery\cache\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\Celery\cache\DawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\Downloads\Celery\cache\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\Celery\cache\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\Celery\cache\LocalPrefs.json

Filesize
850B

MD5
70305b8f9490a36e04089a255d74f898

SHA1
a76a74212e966d688c987a4a493912baaa7889e3

SHA256
c028a548b107f3b578fe4e30f731114e7e6d1eba47fdd2bbe42589497636daed

SHA512
7a1f27e8eafd222d18ace37b0b0214bbaed116ff57630acdc595918088b0d793352652a07fce3a39ecfa26428a242e254b0086bc40c29703829a37df1ba251bd

Download Submit
C:\Users\Admin\Downloads\Celery\cache\LocalPrefs.json

Filesize
643B

MD5
56c6479b917a137801f800c383863bbf

SHA1
60aa4d6fa151bd94b9e668671bc15f7ec19a2a6d

SHA256
fdfa9ccbba384f72bfa2b77ca7acbca9af2fe5fe6886a224ff67bc8889745283

SHA512
ca9f7b3f5c5e4f215e66567537fd3969c94ac6f8137a1eb3764f2aff81858b4a7fc535461618ff0eef1603ae6f8aa87c9094434f60cf2504f100e3c22d7a0674

Download Submit
C:\Users\Admin\Downloads\Celery\cache\LocalPrefs.json

Filesize
850B

MD5
e1337d273a30893bae8e8528e0777310

SHA1
e17f0ffded99a411831b13ad5d539c1230583cb0

SHA256
59fe78c176b0db59a8316fd3625239e14dcf73303361319a7a50a0973cd05a0d

SHA512
f6e4a8476d1d71ddabe9e07a5baf8012b37fce1f52462d9eceef5f841e718da37fe404dd7d01cdf68f42ff42fa05b455613833b538f48a01f1df225fda8a9543

Download Submit
C:\Users\Admin\Downloads\Celery\cache\LocalPrefs.json

Filesize
755B

MD5
afd7774be833e9e6dae514f30c097a38

SHA1
06cfca80410faffe0353a30c6efd8a63da5c6a9f

SHA256
02f4a084f83729e593b5ce264646b7d2db4cd4b5c8434c58663e419b1ce60a56

SHA512
576d828b636672a1db27fd23d0728f771d364b640298fc9b419968f45f3328d3d19d4ff2116707a00df4fe5fc27ded59a22b90afa544ae02025ac8a5ca7bdce5

Download Submit
C:\Users\Admin\Downloads\Celery\cache\LocalPrefs.json~RFe5e6dcb.TMP

Filesize
434B

MD5
099df57ee8690ead180ab849605db8b7

SHA1
9031e999740ff865a5e0c42d9c624a2b2c7db607

SHA256
ce63a6b28210de419aa9e7ebfc0d16cfeb633275b06d6e83a5e5d3395acd4cfa

SHA512
83d00635908852ba9bb8a2a409beb3b7d92a6d6ce15832adf9b6fc851ada4d6487394e617e048f5ad4090b90779517653f0988f7a823809ca49a36d749612fad

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Network\Network Persistent State

Filesize
300B

MD5
11fc40e5e950fcd3162e4067cb3d0b7c

SHA1
9ff71bb0d55d7202824ed499b9b3af8afadeb6b3

SHA256
b72ab9290b7d81aaf75d16e8096ad3c8752ba531925a21484a4791b23754678e

SHA512
97367a1a1117e1607410ed218030ed8dd7106617bccb3039958013982803d2716497c12c2b3e220eebf9a416c483c977e80d826246250480ef77d268c1f53e74

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Network\Network Persistent State~RFe61c4d6.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Downloads\Celery\cache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Downloads\Celery\chrome_100_percent.pak

Filesize
682KB

MD5
d3e06f624bf92e9d8aecb16da9731c52

SHA1
565bdcbfcbfcd206561080c2000d93470417d142

SHA256
4ee67f0b0b9ad2898e0d70ddfad3541fbd37520686f9e827a845d1930a590362

SHA512
497126af59961054155fbb8c3789d6278a1f5426000342f25f54115429ff024e629783f50f0c5350500007854712b07f7d8174ecfe60d59c4fdd5f3d72dac262

Download Submit
C:\Users\Admin\Downloads\Celery\chrome_200_percent.pak

Filesize
1.1MB

MD5
34572fb491298ed95ad592351fb1f172

SHA1
4590080451f11ff4796d0774de3ff638410abdba

SHA256
c4363d6ecfa5770b021ce72cc7d2ab9be56b0ce88075ec051ad1de99b736dbbd

SHA512
e0e7deccb26b7df78d6193750bfb9aad575b807424a0a5d124bd944e568c1bb1ae29f584246f753d619081a48d2897815145028ffedd9488e9a8f102cdc67e2f

Download Submit
C:\Users\Admin\Downloads\Celery\chrome_elf.dll

Filesize
1.3MB

MD5
5b3802f150c42ad6d24674ae78f9d3e8

SHA1
428139f0a862128e55e5231798f7c8e2df34a92a

SHA256
9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799

SHA512
07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007

Download Submit
C:\Users\Admin\Downloads\Celery\dxcompiler.dll

Filesize
20.8MB

MD5
141f621285ed586f9423844a83e8a03f

SHA1
9c58feee992c3d42383bde55f0ff7688bc3bd579

SHA256
5592056f52768ba41aad10785d21c1b18baf850a7e6a9e35526f43a55e6ada6d

SHA512
951a55bbe86a7ebecfc946bf1c9a8c629f0e09510089a79a352cd6d89b7c42e0e23fd4f26232b0e73bd6d4ec158b86728cda2ab25745abcabfafadd964b55896

Download Submit
C:\Users\Admin\Downloads\Celery\dxil.dll

Filesize
1.4MB

MD5
cb72bef6ce55aa7c9e3a09bd105dca33

SHA1
d48336e1c8215ccf71a758f2ff7e5913342ea229

SHA256
47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893

SHA512
c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0

Download Submit
C:\Users\Admin\Downloads\Celery\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\Downloads\Celery\libegl.dll

Filesize
459KB

MD5
ce2c45983f63a6cf0cddce68778124e9

SHA1
6553dc5b4bc68dcb1e9628a718be9c5b481a6677

SHA256
9ca8840bbb5f587848e66d08d36cb5eb30c1c448ef49ce504961ff4ac810c605

SHA512
df81a3356168e78d9810f5e87ca86eb4f56e5f0cb6afdb13408b50778a2d8b18c70b02c6348cd7ba59609ab2956d28eed324706eb65d04bce1159a2d8f1e0e8f

Download Submit
C:\Users\Admin\Downloads\Celery\libglesv2.dll

Filesize
7.3MB

MD5
c9b090ed25f61aa311a6d03fd8839433

SHA1
f1567aa2fb1fcad3cde1e181a62f5e2bccadaf68

SHA256
c7a7a59cf3c26d6c8b2505996065d49f339764f5718e6f53a9ecec8686c489db

SHA512
21cd4618b6ad011afa78abe8fbc42ecafbb992322912c4a77e5f193a04aeb97a5655dedfc513e1a7667db55b92a322e3d9a6dfe7e845af25f37a6666a1798470

Download Submit
C:\Users\Admin\Downloads\Celery\locales\en-US.pak

Filesize
455KB

MD5
a8d060aa17ed42b6b2c4a9fcbab8a7e1

SHA1
16e4e544eca024f8b5a70b4f3ca339a7a0a51ebf

SHA256
55e4ae861aa1cacb09db070a4be0e9dd9a24d2d45e4168824364307120a906b2

SHA512
8f3820e3c5aca560344a253d068936bdb797d07eb22711020d287a949c97d7a98879ff9ff5a4fb2f3fe804bf502300b6f4c92918d973bef351d587483bc43723

Download Submit
C:\Users\Admin\Downloads\Celery\resources.pak

Filesize
7.9MB

MD5
5955471c84eaad269c23f8a22b71f781

SHA1
d625fb0b12d132fec9f91cbc7db54887589f202e

SHA256
b8ae091d95e927a75a9b0a367a8ee9bc5fae0a10427eb77cb3c3460097cd4f5e

SHA512
537fa6f414c7759e70ad6e70350571221ba69afaf89427c7450acf117e58a97fc7beb2a1758cf05b2ef76a14ad50e762f01b1c65d1ccbc63e4d714af445988df

Download Submit
C:\Users\Admin\Downloads\Celery\vk_swiftshader.dll

Filesize
4.9MB

MD5
3262e23f3fef8b021b93c801f5649c92

SHA1
de49b94cfc981a0af5a4e134854f69620e7ba566

SHA256
1c9098e8a6f21462864a91e74555f299ebc41d3bc79d6ee1b9c577c929957285

SHA512
54b0b26b95f6fc799b3e24863a65ef3896786811be3cc9fffa2a06e95e98daf32b16f0ede6b8a87acc319ea17650cdd089c56798236476b894054195738e1797

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 31468.crdownload

Filesize
822KB

MD5
0bd82e264be214414d6dd26bac3e1770

SHA1
5325e64053dcf599a9c5cedec532418716f9d357

SHA256
60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4

SHA512
842a80fed2286d06987cd2dde7ae94fc6c7986eb49cc62684f62f148973e5080df7866e1d2f81d53cb5ac95ef9d88489f6765265e29104be0ae349c6a3164592

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 592708.crdownload

Filesize
10.1MB

MD5
2c752edef5b0aa0962a3e01c4c82a2fa

SHA1
9c3afd1c63f2b0dbdc2dc487709471222d2cb81e

SHA256
891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8

SHA512
04d25fe7d40c8c320ffc545a038ad6ea458df6a8a552b0e0393b369a03b9bf273c72f30169bd54e8eb10757c04bdddf3859c601c1eb9e1a12fe4d15658906dfe

Download Submit
memory/612-5201-0x000001DEF4310000-0x000001DEF442E000-memory.dmp

Filesize
1.1MB

Download
memory/2016-5200-0x00000172FA860000-0x00000172FAA21000-memory.dmp

Filesize
1.8MB

Download
memory/2884-862-0x0000021FAE200000-0x0000021FAF200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-1299-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1294-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1293-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1304-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1303-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1302-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1301-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1300-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1292-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/4988-1298-0x000001C52AF60000-0x000001C52AF61000-memory.dmp

Filesize
4KB

Download
memory/5140-575-0x0000026941450000-0x0000026942450000-memory.dmp

Filesize
16.0MB

Download
memory/5140-387-0x0000026926EE0000-0x0000026926EE6000-memory.dmp

Filesize
24KB

Download
memory/5140-391-0x0000026941330000-0x000002694144E000-memory.dmp

Filesize
1.1MB

Download
memory/5300-79-0x0000000000B30000-0x0000000000C02000-memory.dmp

Filesize
840KB

Download
memory/5300-80-0x0000000006200000-0x0000000006208000-memory.dmp

Filesize
32KB

Download
memory/5300-82-0x0000000008B10000-0x0000000008B1E000-memory.dmp

Filesize
56KB

Download
memory/5300-81-0x0000000008B50000-0x0000000008B88000-memory.dmp

Filesize
224KB

Download
memory/5300-92-0x0000000009AE0000-0x0000000009AEA000-memory.dmp

Filesize
40KB

Download
memory/5300-102-0x000000000A8A0000-0x000000000AA26000-memory.dmp

Filesize
1.5MB

Download
memory/5300-158-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/5300-159-0x0000000002EE0000-0x0000000002EEA000-memory.dmp

Filesize
40KB

Download
memory/5868-401-0x0000023D7FF10000-0x0000023D7FF22000-memory.dmp

Filesize
72KB

Download
memory/5868-402-0x0000023D7FEF0000-0x0000023D7FEFA000-memory.dmp

Filesize
40KB

Download
memory/5868-536-0x0000023D80170000-0x0000023D80222000-memory.dmp

Filesize
712KB

Download
memory/5868-373-0x0000023D7FF40000-0x0000023D7FF8A000-memory.dmp

Filesize
296KB

Download
memory/5868-365-0x0000023D1A640000-0x0000023D1A801000-memory.dmp

Filesize
1.8MB

Download
memory/5868-361-0x0000023D7FE90000-0x0000023D7FE9A000-memory.dmp

Filesize
40KB

Download
memory/5868-359-0x0000023D7FE10000-0x0000023D7FE1A000-memory.dmp

Filesize
40KB

Download
memory/5868-357-0x0000023D7FED0000-0x0000023D7FEEC000-memory.dmp

Filesize
112KB

Download
memory/5868-355-0x0000023D7FE70000-0x0000023D7FE84000-memory.dmp

Filesize
80KB

Download
memory/5868-353-0x0000023D7FFC0000-0x0000023D800A6000-memory.dmp

Filesize
920KB

Download
memory/5868-351-0x0000023D7FEA0000-0x0000023D7FEC4000-memory.dmp

Filesize
144KB

Download
memory/5868-349-0x0000023D7ECB0000-0x0000023D7FDFE000-memory.dmp

Filesize
17.3MB

Download
memory/5868-5130-0x0000023D7FFA0000-0x0000023D7FFA8000-memory.dmp

Filesize
32KB

Download
memory/5868-548-0x0000023D800B0000-0x0000023D800D2000-memory.dmp

Filesize
136KB

Download
memory/5868-561-0x0000023D7FF00000-0x0000023D7FF08000-memory.dmp

Filesize
32KB

Download
memory/5868-562-0x0000023D7FF30000-0x0000023D7FF40000-memory.dmp

Filesize
64KB

Download
memory/5868-563-0x0000023D80120000-0x0000023D80158000-memory.dmp

Filesize
224KB

Download
memory/5868-564-0x0000023D7FF90000-0x0000023D7FF9E000-memory.dmp

Filesize
56KB

Download
memory/5868-572-0x0000023D1A810000-0x0000023D1B810000-memory.dmp

Filesize
16.0MB

Download
memory/6016-576-0x0000025CC5EF0000-0x0000025CC6EF0000-memory.dmp

Filesize
16.0MB

Download