hxxps://cdn[.]discordapp[.]com/attachments/1141173275305726042/1274172944590835893/FluxTeam[.]zip?ex=66c14986&is=66bff806&hm=f610fcff4a720e409688f08c91b0d8dbcffdeac7a1dabddd681db827902599e2&

Analysis

max time kernel
599s
max time network
599s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1141173275305726042/1274172944590835893/FluxTeam.zip?ex=66c14986&is=66bff806&hm=f610fcff4a720e409688f08c91b0d8dbcffdeac7a1dabddd681db827902599e2&

Score

9^/10

credential_access defense_evasion discovery evasion persistence privilege_escalation stealer trojan

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 33 IoCs

pid	Process
7064	RobloxPlayerInstaller.exe
3568	MicrosoftEdgeWebview2Setup.exe
7004	MicrosoftEdgeUpdate.exe
7112	MicrosoftEdgeUpdate.exe
7140	MicrosoftEdgeUpdate.exe
5724	MicrosoftEdgeUpdateComRegisterShell64.exe
6016	MicrosoftEdgeUpdateComRegisterShell64.exe
6232	MicrosoftEdgeUpdateComRegisterShell64.exe
5812	MicrosoftEdgeUpdate.exe
6604	MicrosoftEdgeUpdate.exe
6384	MicrosoftEdgeUpdate.exe
5376	MicrosoftEdgeUpdate.exe
1404	main.exe
6752	main.exe
2192	RobloxPlayerInstaller.exe
5988	RobloxPlayerInstaller.exe
1152	RobloxPlayerInstaller.exe
2340	RobloxPlayerInstaller.exe
6932	main.exe
2284	MicrosoftEdgeUpdate.exe
6968	MicrosoftEdge_X64_127.0.2651.105.exe
3712	setup.exe
5772	setup.exe
1192	MicrosoftEdgeUpdate.exe
3852	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
6948	MicrosoftEdgeUpdate.exe
4684	MicrosoftEdgeUpdate.exe
5768	MicrosoftEdgeUpdate.exe
5200	MicrosoftEdgeUpdate.exe
2476	MicrosoftEdgeUpdateComRegisterShell64.exe
5656	MicrosoftEdgeUpdateComRegisterShell64.exe
5428	MicrosoftEdgeUpdateComRegisterShell64.exe
6104	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
7004	MicrosoftEdgeUpdate.exe
7112	MicrosoftEdgeUpdate.exe
7140	MicrosoftEdgeUpdate.exe
5724	MicrosoftEdgeUpdateComRegisterShell64.exe
7140	MicrosoftEdgeUpdate.exe
6016	MicrosoftEdgeUpdateComRegisterShell64.exe
7140	MicrosoftEdgeUpdate.exe
6232	MicrosoftEdgeUpdateComRegisterShell64.exe
7140	MicrosoftEdgeUpdate.exe
5812	MicrosoftEdgeUpdate.exe
6604	MicrosoftEdgeUpdate.exe
6384	MicrosoftEdgeUpdate.exe
6384	MicrosoftEdgeUpdate.exe
6604	MicrosoftEdgeUpdate.exe
5376	MicrosoftEdgeUpdate.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
6752	main.exe
6752	main.exe
6752	main.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
26	pastebin.com
30	pastebin.com
31	pastebin.com
222	pastebin.com
223	pastebin.com
3	pastebin.com

Checks system information in the registry 2 TTPs 18 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\Debugger\Breakpoints\client.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\MaterialGenerator\Materials\Sand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU190F.tmp\msedgeupdateres_th.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\R15Migrator\ic-blue-arrow.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\StudioToolbox\ArrowCollapsed.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU190F.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\fonts\GrenzeGotisch-Regular.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_3x_3.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\fonts\GothamSSm-Medium.otf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\image_scrollbar_vertical_top.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\InspectMenu\gr-item-selector-triangle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\9SliceEditor\Dragger2OutlinedTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\PlayerList\AdminIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\FaceCaptureUI\Background.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ViewSelector\background.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\CompositorDebugger\select.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\PlayerList\FriendIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VR\circleWhite.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Locales\mr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Scroll\scroll-bottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Settings\LeaveGame\playernumber_strokeStyle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\InspectMenu\ico_isnt-wearing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Trust Protection Lists\Sigma\Entities	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\particles\forcefield_alpha.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Settings\Radial\EmptyTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio_6x6.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\sounds\action_falling.mp3	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Emotes\Editor\TenFoot\Wheel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\PlatformContent\pc\textures\water\normal_09.dds	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ConstraintCursor.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\PublishPlaceAs\common_checkmarkCircle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\PlayerList\AvatarBackground.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AvatarEditorImages\circle_gray4.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AvatarEditorImages\Sliders\gr-slider.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\StudioSharedUI\grid.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Emotes\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Menu\rectBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\MenuBar\icon_leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\account_over13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\localizationTargetEnglish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\btn_removeEvent.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\xboxLT.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\R15Migrator\Icon_Reverted.png	RobloxPlayerInstaller.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5848	2476	WerFault.exe	94
6608	5548	WerFault.exe	136
3844	480	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5376	MicrosoftEdgeUpdate.exe
1192	MicrosoftEdgeUpdate.exe
6948	MicrosoftEdgeUpdate.exe
6104	MicrosoftEdgeUpdate.exe
5812	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\FluxTeam.exe = "11001"	FluxTeam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	FluxTeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main	FluxTeam.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main	FluxTeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FluxTeam.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main	FluxTeam.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FluxTeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FluxTeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	FluxTeam.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FluxTeam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	FluxTeam.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FluxTeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FluxTeam.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdate.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\FluxTeam.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
3092	msedge.exe
3092	msedge.exe
5600	msedge.exe
5600	msedge.exe
5284	identity_helper.exe
5284	identity_helper.exe
7064	RobloxPlayerInstaller.exe
7064	RobloxPlayerInstaller.exe
7004	MicrosoftEdgeUpdate.exe
7004	MicrosoftEdgeUpdate.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
1404	main.exe
1404	main.exe
1404	main.exe
1404	main.exe
6752	main.exe
6752	main.exe
6752	main.exe
6752	main.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1152	RobloxPlayerInstaller.exe
1152	RobloxPlayerInstaller.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1180	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	2476	FluxTeam.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7064	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	7004	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	5548	FluxTeam.exe
Token: SeDebugPrivilege	1404	main.exe
Token: SeDebugPrivilege	480	FluxTeam.exe
Token: SeDebugPrivilege	6752	main.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	1180	taskmgr.exe
Token: SeSystemProfilePrivilege	1180	taskmgr.exe
Token: SeCreateGlobalPrivilege	1180	taskmgr.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	6932	main.exe
Token: SeDebugPrivilege	2284	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	6384	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	7004	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4684	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
2476	FluxTeam.exe
2476	FluxTeam.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
5548	FluxTeam.exe
5548	FluxTeam.exe
480	FluxTeam.exe
480	FluxTeam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 2040 wrote to memory of 3848	2040	firefox.exe	81
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 3160	3848	firefox.exe	82
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84
PID 3848 wrote to memory of 1932	3848	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1141173275305726042/1274172944590835893/FluxTeam.zip?ex=66c14986&is=66bff806&hm=f610fcff4a720e409688f08c91b0d8dbcffdeac7a1dabddd681db827902599e2&"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1141173275305726042/1274172944590835893/FluxTeam.zip?ex=66c14986&is=66bff806&hm=f610fcff4a720e409688f08c91b0d8dbcffdeac7a1dabddd681db827902599e2&
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07923388-e9e9-4ea0-bfd7-96050dd0f0de} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" gpu
    3⤵
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {678fcfa5-119a-438e-84ee-d4547272560a} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" socket
    3⤵
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=928 -childID 1 -isForBrowser -prefsHandle 2740 -prefMapHandle 2904 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5453af03-ea62-4357-8702-9385995ba4b6} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3704 -childID 2 -isForBrowser -prefsHandle 3208 -prefMapHandle 3032 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7294aa8-b123-4428-aa77-0412d14cc26b} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:1244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4588 -prefMapHandle 4584 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccb58e53-f12e-4da2-bf44-a7de02fb8441} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" utility
    3⤵
    - Checks processor information in registry
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 3 -isForBrowser -prefsHandle 5600 -prefMapHandle 5596 -prefsLen 27091 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53ebd0f6-8ffa-49c5-8df4-d46815779757} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 4 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 27091 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42eb20fb-d12d-42af-9b81-91db145db372} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6032 -childID 5 -isForBrowser -prefsHandle 6024 -prefMapHandle 6020 -prefsLen 27091 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6bbe721-065a-49ae-8f80-b949a3752381} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3648 -childID 6 -isForBrowser -prefsHandle 3332 -prefMapHandle 3688 -prefsLen 30491 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79c9d3ea-ecff-403a-b781-fc54544d4f1c} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6588 -childID 7 -isForBrowser -prefsHandle 6612 -prefMapHandle 6516 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29452c74-5093-416b-982b-2ef496e2416f} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:6276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6948 -parentBuildID 20240401114208 -prefsHandle 6760 -prefMapHandle 6944 -prefsLen 30620 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1929506d-f0b7-4d1f-bd50-ff14a4a7530d} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" rdd
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6992 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6984 -prefMapHandle 6980 -prefsLen 30620 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85dd4167-9a69-4d4d-80ab-d321bd7f3b3b} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" utility
    3⤵
    - Checks processor information in registry
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7392 -childID 8 -isForBrowser -prefsHandle 7404 -prefMapHandle 7416 -prefsLen 28088 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a499235-f0a4-485e-8175-29b02b932371} 3848 "\\.\pipe\gecko-crash-server-pipe.3848" tab
    3⤵
    PID:6004
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7064
  - - C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:3568
    - - C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7004
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7112
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7140
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6232
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTg1MzNEQUQtRDhDMS00MDZGLTk2NjctMjQ0QzYzQUZBNzI3fSIgdXNlcmlkPSJ7MUY4QTQyMjItNzBFMy00NzIzLThGMzAtQjFGRjYwRDcxQ0RDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MjVCMjMzOS1GRDY5LTQ0MTYtOTUzNS00QTMwQTg4MTEzQTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3Njk2MjI1NDkiIGluc3RhbGxfdGltZV9tcz0iNDU5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5812
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{18533DAD-D8C1-406F-9667-244C63AFA727}" /silent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2460

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/2VURYJ5g
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb384a3cb8,0x7ffb384a3cc8,0x7ffb384a3cd8
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1676 /prefetch:1
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13560644017266134280,15901425191814486725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2860
  2⤵
  - Program crash
  PID:5848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2476 -ip 2476
1⤵
PID:5840

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6384
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTg1MzNEQUQtRDhDMS00MDZGLTk2NjctMjQ0QzYzQUZBNzI3fSIgdXNlcmlkPSJ7MUY4QTQyMjItNzBFMy00NzIzLThGMzAtQjFGRjYwRDcxQ0RDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDN0UxNjc5Qy04NTVGLTQwODktQUJBRS01RUVDMTgzNjFBMjl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NzI4MjI1MzkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5376
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\MicrosoftEdge_X64_127.0.2651.105.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:6968
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\EDGEMITMP_FD9B6.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\EDGEMITMP_FD9B6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:3712
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\EDGEMITMP_FD9B6.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\EDGEMITMP_FD9B6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{03D523C6-0007-4263-9794-8E72DD8EEB34}\EDGEMITMP_FD9B6.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.105 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7071fb7d0,0x7ff7071fb7dc,0x7ff7071fb7e8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5772
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A198FBE0-7883-46F4-A1AA-58006DE23188}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A198FBE0-7883-46F4-A1AA-58006DE23188}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe" /update /sessionid "{238207B2-A008-4F18-907E-130702196BE8}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3852
- - C:\Program Files (x86)\Microsoft\Temp\EU190F.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU190F.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{238207B2-A008-4F18-907E-130702196BE8}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5768
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5200
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2476
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5656
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5428
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjM4MjA3QjItQTAwOC00RjE4LTkwN0UtMTMwNzAyMTk2QkU4fSIgdXNlcmlkPSJ7MUY4QTQyMjItNzBFMy00NzIzLThGMzAtQjFGRjYwRDcxQ0RDfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7Q0Q0NUY2MzYtMTNCQi00MkEwLTkzNjItQTlBQUM4NTU0ODQzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjM4NTcxOTAiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk1NjAxOTEzNTAiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6104
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTg1MzNEQUQtRDhDMS00MDZGLTk2NjctMjQ0QzYzQUZBNzI3fSIgdXNlcmlkPSJ7MUY4QTQyMjItNzBFMy00NzIzLThGMzAtQjFGRjYwRDcxQ0RDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QUMxQkNBNi1EMzM3LTQ1OUEtOEEzMC04QjQ2RkU2QjBEMkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjEwNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc4NDcxMjQyMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3ODQ3NDI0ODciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg2NiIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTEwNjE5MDE1OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOGIwYjMyMzMtZGFhZi00OGI5LWFhMDQtYjM0YmE5ZTQyOTgwP1AxPTE3MjQ0NjE5OTImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RFIyejM3MDlsRjFIVWVSRnFxVSUyZkFpeVVTQ1B0ckduTUhaRlVJbEkzd0xnUEdsMG4ybmtkJTJiaWhSRnVzRnBEVzlmaUw2d1ZaSXklMmZHUnVVemY0TzQlMmZBZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjcyNzI0OTE3IiB0b3RhbD0iMTcyNjEyNjY0IiBkb3dubG9hZF90aW1lX21zPSIzMDYyMTQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MTA2MTkwMTU4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJ3aW5odHRwIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy84YjBiMzIzMy1kYWFmLTQ4YjktYWEwNC1iMzRiYTllNDI5ODA_UDE9MTcyNDQ2MTk5MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1EUjJ6MzcwOWxGMUhVZVJGcXFVJTJmQWl5VVNDUHRyR25NSFpGVUlsSTN3TGdQR2wwbjJua2QlMmJpaFJGdXNGcERXOWZpTDZ3VlpJeSUyZkdSdVV6ZjRPNCUyZkFnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iODguMjIxLjEzNC43MyIgY2RuX2NpZD0iMiIgY2RuX2NjYz0iR0IiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MTI2NjQiIHRvdGFsPSIxNzI2MTI2NjQiIGRvd25sb2FkX3RpbWVfbXM9IjE5ODk4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTEwNjE5MDE1OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkxMTk3MDI5MjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk1NDc0Njk4NjgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2OTYiIGRvd25sb2FkX3RpbWVfbXM9IjMzMjE0MiIgZG93bmxvYWRlZD0iMTcyNjEyNjY0IiB0b3RhbD0iMTcyNjEyNjY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0Mjc3NiIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1192
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjM4MjA3QjItQTAwOC00RjE4LTkwN0UtMTMwNzAyMTk2QkU4fSIgdXNlcmlkPSJ7MUY4QTQyMjItNzBFMy00NzIzLThGMzAtQjFGRjYwRDcxQ0RDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswRjdDMDRCMy1FM0M5LTQ1NUQtQjI3OC1CMTJDRUQwQjIwMTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkwODg3NjI4MzAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTA4ODc2MjgzMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTM0ODY1NTM1MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMyM2ZhN2Y3LTQ0NDUtNDEzNy04MmVjLTcxNTI4OTQ5MTgyYT9QMT0xNzI0NDYyMzIzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVVZU3IxSSUyZjlEUVdiNSUyYmVUYVRaR01DcFhObFFseVVRd3A3d2hueVZmU2E5dFpMYUNpS205SktXV0R4NCUyYmtZMXU5dnphdHZqNUV0ZyUyYmVhNVg4SXM2d0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MzQ4NjU1MzUzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zMjNmYTdmNy00NDQ1LTQxMzctODJlYy03MTUyODk0OTE4MmE_UDE9MTcyNDQ2MjMyMyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1VWVNyMUklMmY5RFFXYjUlMmJlVGFUWkdNQ3BYTmxRbHlVUXdwN3dobnlWZlNhOXRaTGFDaUttOUpLV1dEeDQlMmJrWTF1OXZ6YXR2ajVFdGclMmJlYTVYOElzNndBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTY0NTExMiIgdG90YWw9IjE2NDUxMTIiIGRvd25sb2FkX3RpbWVfbXM9IjI0MjEyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzNDg4MTE1ODIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTU0NzQ2OTg2OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTAuMC44MTguNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjgzMzA4NjU5NDUyNTYwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntBRkM5MDM2RS05NzM2LTRCRjktOEZGNS0zMDg5OTZGNjk1MkZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6948

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/2VURYJ5g
  2⤵
  PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb384a3cb8,0x7ffb384a3cc8,0x7ffb384a3cd8
    3⤵
    PID:3532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 2836
  2⤵
  - Program crash
  PID:6608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5548 -ip 5548
1⤵
PID:6628

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe"
1⤵
PID:6748
- C:\Users\Admin\AppData\Local\Temp\onefile_6748_133683308507272545\main.exe
  C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/2VURYJ5g
  2⤵
  PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb384a3cb8,0x7ffb384a3cc8,0x7ffb384a3cd8
    3⤵
    PID:3468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 2828
  2⤵
  - Program crash
  PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 480 -ip 480
1⤵
PID:6056

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe"
1⤵
PID:4668
- C:\Users\Admin\AppData\Local\Temp\onefile_4668_133683308780702539\main.exe
  C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6752

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5612

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5988

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1180

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1152

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2340

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe"
1⤵
PID:4368
- C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\main.exe
  C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6932

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Installer\setup.exe

Filesize
6.6MB

MD5
96937bb70ddb5b3a89651ad8391ce5a1

SHA1
3d5ee58c00667b4dc63da7205c20b1c335c3efce

SHA256
60ae19e62277efd9bbdc93ccc5fa8b4bc1f8f6537115d4a7e8e8df3c2014315b

SHA512
d3b1c07157817bfbcaee4bf196a3743dc177470f82880d5bfdd5fce573434a652f7da5f1dbc40a086e0cc6bb9ae4bdb4f8ce86985c8dc01923418724caab6c0e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe

Filesize
1.6MB

MD5
90decc230b529e4fd7e5fa709e575e76

SHA1
aa48b58cf2293dad5854431448385e583b53652c

SHA256
91f0deec7d7319e57477b74a7a5f4d17c15eb2924b53e05a5998d67ecc8201f2

SHA512
15c0c5ef077d5aca08c067afbc8865ad267abd7b82049655276724bce7f09c16f52d13d69d1449888d8075e13125ff8f880a0d92adc9b65a5171740a7c72df03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
f9646357cf6ce93d7ba9cfb3fa362928

SHA1
a072cc350ea8ea6d8a01af335691057132b04025

SHA256
838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

SHA512
654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
34cbaeb5ec7984362a3dabe5c14a08ec

SHA1
d88ec7ac1997b7355e81226444ec4740b69670d7

SHA256
024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9

SHA512
008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
0b475965c311203bf3a592be2f5d5e00

SHA1
b5ff1957c0903a93737666dee0920b1043ddaf70

SHA256
65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0

SHA512
bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
f4976c580ba37fc9079693ebf5234fea

SHA1
7326d2aa8f6109084728323d44a7fb975fc1ed3f

SHA256
b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791

SHA512
e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
03d4c35b188204f62fc1c46320e80802

SHA1
07efb737c8b072f71b3892b807df8c895b20868c

SHA256
192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95

SHA512
7e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
5664c7a059ceb096d4cdaae6e2b96b8f

SHA1
bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec

SHA256
a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e

SHA512
015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
497ca0a8950ae5c8c31c46eb91819f58

SHA1
01e7e61c04de64d2df73322c22208a87d6331fc8

SHA256
abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7

SHA512
070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
45e971cdc476b8ea951613dbd96e8943

SHA1
8d87b4edfce31dfa4eebdcc319268e81c1e01356

SHA256
fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d

SHA512
f1c9fccf742fa450be249dbbf7e551a426c050ae4af3d2e909f9750068a2bdc801f618eb77a6a82d13421d27949c9f2a9681a44bcb410ccdeec66b24a70f6a9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
b507a146eb5de3b02271106218223b93

SHA1
0f1faddb06d775bcabbe8c7d83840505e094b8d6

SHA256
5f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed

SHA512
54864e9130b91b6fd68b1947968c446f45a582f22714716bfd70b6dc814841fffe939bc2f573a257ec8c62b4ff939643211fb29cabc0c45b78a6cc70eaa3752c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU51B0.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
3bc0d9dd2119a72a1dc705d794dc6507

SHA1
5c3947e9783b90805d4d3a305dd2d0f2b2e03461

SHA256
4449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb

SHA512
8df01ad484bf2924892129c59317f3da4f79611be2ca29e208114e5ed2cb96a63f753511dc4fe97e281417366246f2fb576cc6ef2618a67803ae7ac01be7b067

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
658a6b0f3866e63545503fdff59d000c

SHA1
e5df1309e574ee77ca1727bf64a269f376d5ebd9

SHA256
61b302dcf209bd7a3288a6a9e478c6ad0a5d6b195f5328f827c938d5122f679c

SHA512
bc02baab236cf4427f26dba22fd3ab977abd8df1eb7d30b20d7b36f410f70877872a85f6d7bfdccc8b53c5e2ff5a70cdd056ac133d0bb7ec5a7596fbb7144e8a

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
34a11a31af34de9eb06da9c9d3c694db

SHA1
239661232d77998821881dbf61c0ac359d4a562e

SHA256
f41f52fe0cfc78249d2cf61519cc800bd77dd52b4f64b89a24ee02ae81555e82

SHA512
6e6eb40a05f6efc08e04ce13cf8b833973dc486a18627f88598242823fc7c9900651e58fe3f081f1c5f37820cdb7878b403f06013ca71532fe51365a9cc98c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
c6bb2b7557457393ee8933f95e16b416

SHA1
06a9169c024edb474cf6f3594b9e8b5928a984be

SHA256
8fd65b22a3a706f84d9548a79a1c4b5c9b4a7e8201e0c53737a65c200d1a246a

SHA512
d035320952e9173f7e01c75c2af885b6ac9cb1e91324694e8e68516a28891705d4f739f40b1f548deab699f2ed35b157f35b65f8b178353f314470fdc7a898ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
781f712234169a3d5217d656b97944d8

SHA1
d5a92c7938ee15cba8e6533ec411891af74458f1

SHA256
654d03bdf36ae7dde6005259a0e4a916ef40a33d8f0b90c2b7127fdff88a9338

SHA512
5b8169ac078a32bfbb58b2c444717832cf094d244cee9a93cffc9e068612554d515bd5cd2f919f3e447c6fea6df12e8d5aa5e385684aa2a7cbaf1c6eae042e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d7db467da3a516874305057e930acb4

SHA1
8b055e1e27054edb6b4feb18d6e38c4548d6b469

SHA256
6726c274e99c81091497ae83a797df119dc05b87942737eabbd124d4e3913cec

SHA512
f3611fde2f81060fad846c95d5b0a3a1ac3e1c0c34c15690374c3db459a4dd2987a72d4b8008062879339c0a565709f99658527cd0ce25dc7dff3209b534c192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dda7352fa7a7903f4bd93006c4fae7b1

SHA1
2bd961260357c23d52f79bb0bd2929b72feec429

SHA256
a33480dcde515a37940880ea0108e51349154339e962754f254c916c085e9f4a

SHA512
6a8c770d7b8f9d6965fd60ecfa0048c3c232680c50c26f5ea622799da964c4ccb2b0864188e8d5f0131838d7712b37fb85aa4b86caac0a13810e799639233cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49fb0b793cf4afe71e55c52bbe7abae8

SHA1
ee462c7cf08abd4e217ea2870b5a1fe2dce51a6f

SHA256
d1c0f7427a7baa7bafbb5cea0f3db40a463d0eb56dda60872a541eeca85ebacc

SHA512
9a149844168659b3d60ad080d77ef41770c0d71994b6350563241027a86b664c1c4f9a6b2f5b81816f5e5284dd8cdc73ba854a75e4534d1e430ea39b0506beea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0d0ca01b1ed9ee553cc43d05a22ce6a

SHA1
3cfd0c991f8bf3aa54f3629b122fcd6ecf1f0ed3

SHA256
9b8c9bc2caecc28aabc347b0d04fec60e9c95c55e48cefdc9cfd7b389ecb1bde

SHA512
974dfe040e68495bd0ae5c3cf5c4241796d20123175ea281297284131256cebfb8367a44b2538592d162be30cfe5889261cd238dd4dd381ec152ee99257cad21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
15c5f9e964a7e5e63321b3671195ffe2

SHA1
f24e0750535fed2516762200924eaeeccae76186

SHA256
6a53d0e1256021ca8807154be7ac18992ecbe40152633f05dea44dacf9cb815e

SHA512
47c5e8e4ae4bf02389d553ba0e71e3c86009bbab135bda3180febfcf2bab653be6de104d72498b300611fb256a5b4e6bb7eaff3109fe1876451d79fed2e3d253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7aae4f5e25cb2e3d19eb0620b68a918f

SHA1
5aeabea826a27caecc6aac12bc791979474cb8de

SHA256
b5ce634ec30a47f86d0955b0f5e66aca7c538e13d56dbb9392bd9689dd9092eb

SHA512
d93584153dc550336578b0eaadf29c8ef74bb393a68524316cc91d71982df9028510194292adbafe1afa5a51442751226145b12adebb6e69eaec684e8b392c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88e771f1128bef5b105a3073b5ceb9a9

SHA1
6c0720e8e0d805d5121fd88b1557efc9b4feccaa

SHA256
d38ee3ecf105157f12ce1ea52911e3e62f1b0def07a3de2a4318ed2dc1e79a8b

SHA512
5ca1e449310bb7e9fe6fe288830edf3f15e65a45bc51344242375d43ba91386f2469854d81c1190e2b7feeaca7cde775e90322a4df1b8de84673f76bcd69092a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json

Filesize
31KB

MD5
fd739a085de21238b9ca25dafa2a577c

SHA1
7be387a6e63dc7f6b810d9acfa5ce937c8b1f11b

SHA256
f61d74273f3cf7f0e2575531698ff99f3147a31c23e1e527dd8395464ed32912

SHA512
c879589a456834e95efdd7a0f2cd1a4400261f495ea50498a48b08576fcffe047f87f359a92a5f39d20bf1a941280f1f4c23af4ffaced413fe061e75c888aa00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\E1010D5D7482D53E10DD0E4A0C3EFC3A2E56240F

Filesize
109KB

MD5
8e0136b7d7f121ac584ae1753576c662

SHA1
4b296586ff11accf3730d2c286c40da0db47abda

SHA256
d9e27cd319650ff213c0898244e2c48850c9ab4abebf96d0c40dbcf65d3e72f0

SHA512
b32b84f3cdf948d243443e92eb314ed8055cd86bfe0d1ae76c4f0cd512571d4ba096f95e1db5a9ba6e2a593f471f07fb528381d4d41174339afa6b52ed58830b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\FF9846F612F8795E1A9369E36E57498546EAC5C5

Filesize
59KB

MD5
d4d16e7ade358502e0f4d06da7135bcd

SHA1
980a1649661299e50181b8dd54e9b044e5e1ab95

SHA256
5e3efbf60b47347cf957eb0bb78f1b69d5678493789bf7a0f046ba2ee123be68

SHA512
0b028674b154b939c5fd85a7975bc4a847a8d838885e45e4b913822102e5cfc372b49f4411390915357670eb754ba68d07c3e670e5be9d5e8e2118b3602cee14

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b93f42f728fdd67f390b066d6df035e0

Filesize
5.9MB

MD5
b93f42f728fdd67f390b066d6df035e0

SHA1
7c7f3e149096ce743262cfc30974689afc5c5152

SHA256
f32d067a66abe3ea7761ca4f698af726e82234088f3e4218e026d698c9c5f6c3

SHA512
17fdbe368d9f75e2b0f1d2c7e8730d398d3e6c8b4bc4e424d3519910d7756e622d2977fec60a8613f4c4062f4afc5d1f2da0f6b97b03ae7c1e720852ee47d804

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\_elementtree.pyd

Filesize
130KB

MD5
f89c26a967569f393e8e958c9127d4d7

SHA1
ea09407004b2b279f9424c20ba555cfc8909f154

SHA256
4869325e5cffbd13d3cc02dc78226478adfb51a802b52ff65b5adfacff3511f1

SHA512
eb2090ed5e00ea1a1b7b0c21f27bab45ec271dfb8e16c2df07be16df12ceaa1f8d0e0430b0ed65e4945e443aeb5248b42a6448decfc4157a39fa2c3dea20f5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\_win32sysloader.pyd

Filesize
14KB

MD5
7cff63d632a7024e62db2a2bce9a1b24

SHA1
6a0bc8add112cc66ee4fd1c907f2f7e49b6bd1cf

SHA256
df8ba0c5b50ca3b5c0b3857f926118efbeb9744b8f382809858ba426bf4a2268

SHA512
3fc02cb3bbd71b75bdc492dc2c89c9d59839aa484cfaff3fd6537ae8bb3427969cd9ef90978f5cb25a87af8d2cae96e2184fdc59115e947a05aa9e0378807227

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\httptools\parser\parser.pyd

Filesize
81KB

MD5
197a20d55b9e4e581d30b80e063313f0

SHA1
2ec6246cf938af720bd297a79acf96e869c48bf9

SHA256
45cf440b9f42ef54944ef77282574b44668f259a2d356f7ad53b6dfd61ac7d4b

SHA512
6ef2cb8f2a2c2b133b62c7695c38d40b5e66b3988f330599e2d5909b316fd62426db55f9e5c4543c40758657085b9d8690d29d54150d02c556c200f1aa9db041

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\httptools\parser\url_parser.pyd

Filesize
36KB

MD5
60ce3acbf7943e051c8e5e44f95daecc

SHA1
a70aa3a7a34bb6b5183b7b756328591eaefcb7dc

SHA256
de0940893905c0d957b4d66f05c2a6f1a6e167577098cb16aef52d7d008bc71c

SHA512
572ab441179214fbae9a9c22f217ece224563f639793ae41a5fc14f9452990182bd342eaf56ff227ff65ec29eb30b1ae16b440c2d0afa0f6cb878cf1c8b86762

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy.libs\libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll

Filesize
36.6MB

MD5
6228837855e10997ad5cfa204aaeb620

SHA1
23ec44b63a8203cac64180d044ba0ce2e5baafee

SHA256
39e80d3d5fd1e998cb7c5c7b5d54136af75a688dfa6c38470e8bf89b01eec134

SHA512
1364a21bbacc2a2fc688eba7a998631050a75566b950c10320468b51d9660c18b881c9bbe1af1ca1ee4f86238c6e85fd4516435fecf1a606afea931dc59b25d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy.libs\msvcp140-8021418012832a07a8ca5105a33b1086.dll

Filesize
607KB

MD5
ec84e4662e892982a726c3742547b64e

SHA1
7ebf56e97e586c05acffab4375a38c906d3f3d9e

SHA256
85448e376dfad1859740aedaa2544b565e8a6e4e2e555de6c4638f4ab1b28843

SHA512
837e4127f5aef404d75155c207ed8aaf1573793869453e3ff8e615b5ee06851b005f61b9071d40e820b493fe3d3be202b87d0be464765943241a07269df20c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\_core\_multiarray_tests.pyd

Filesize
62KB

MD5
cd54222449f4aa8ae4bb7fba50f26d38

SHA1
53782abe8ff0da6f4072f0a5cc26795332d5ff39

SHA256
dbb7a1d545feb54ba1b7cd124e20f7d6c8cc328879bd5f72969d0ff3aa8e5056

SHA512
b6ad326466794403917fcb6b5dae5d5bbc42f0aa16a9ae68b3b6e49028a584a63c97b45bfefa455bb38f8ba3c402b2bc53793b55c7e68e27df054641543f58d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\_core\_multiarray_umath.pyd

Filesize
3.9MB

MD5
ac23ec7cbb7017edf1c375c307662a74

SHA1
d11204dbffd2f3b011894748188de1780641157a

SHA256
61f1c7ace31fbfbfaae8417d5fab2a459494486cdd69d357cda7e00ecaa07a07

SHA512
f866989d1446bb27ec6dfcd9150d461edab779f3c21f1520ae03b9fe9efc6897575f8d690becb8d86a87d6dc6d01e309d0a444b338418ef1c2474bbdc07fd495

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\fft\_pocketfft_umath.pyd

Filesize
272KB

MD5
f0abc9f77f73db341201a6b2013f1ea5

SHA1
8c9a4bce00364a5c2bd3bc2bd0c9d2c01e346fec

SHA256
a8d668beaeef8801c197ef7e35661e8e07e92e2d7a6400765fa70819d9c5a858

SHA512
cf2db68f87fb4a1a2e37b4f53f876563219942ad4169140dd5c6731d9260daa7e40e0264e8d71644f2e452be81f762656391d88ca4f82774d18c6f852d791c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\linalg\_umath_linalg.pyd

Filesize
106KB

MD5
5ec5faf7db65a5e922533a8dd4c55ffe

SHA1
bf2149229f1f15df0d19515baf56a0ec4f5c873d

SHA256
ce80fddec4b670d8f11bfd3ff7b793f7f31dfaa2c97131b8e72fe8b0a67f950e

SHA512
a2e6b1a1fd174700735c3826ba2190f87246cae773eb8ce5ab2f8ec5a73cd9f03d5edfadf3e9805602059f950f6034321b90ba0684f5504e4f4da93ece5eb009

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_bounded_integers.pyd

Filesize
221KB

MD5
8f3cbd061a692c331207bbcc5aba07e4

SHA1
778e9fd9748e6e130755d81b300bcaf0dff51c42

SHA256
522b324637d6e307a0fd75b1b3e3e9e06c2e03e0b7d9532124985b26a928bc64

SHA512
5a71c3cdc651518f7ac0afa3414af60b1b59d6b411aad22d801b144429177c0bc741c2b2ef804bdefcb318fa551db6aa34839c8beda43d00401530d715f5a8ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_common.pyd

Filesize
165KB

MD5
82fd008f72821bd092e60b48ed8d604a

SHA1
b20b8a4409718e3ad168fc5da8d1b68083f68c52

SHA256
b2e60cfaecb571481131ab64c1ed2b85ca552df3e77542d42f91880958432932

SHA512
159c32c74e3ed82148df218a41a4c72fb9c5889f4ca33d688829948aa97174ecab13976baa14c8f8a76ff1afc7984d9f6e2852ea647285e2a173e3917a3afea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_generator.pyd

Filesize
730KB

MD5
7ae46e06b282df27cbd063c4512ce96c

SHA1
41195abd5af45534dab2d0d1f9c42c66826151ff

SHA256
0e2f6af27d342a215c037450fcf6ee001be2224e1241daff6634f96352cd2952

SHA512
82a8ed7286871bdcb0901bce13ccf9ff5080207e83cc9a1c41e0bac6e6f8c335e9a44e0d7193d1e6dcf98147f1bf7ffc6b1b18b34c9531fab17619ce35c3a867

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_mt19937.pyd

Filesize
86KB

MD5
8e4a1acbd04455a38772869b8c971f6d

SHA1
50c6e60d320abf677615bccca830c36183d8e097

SHA256
8a5fe12ec03a1af09cdb600c1adcc94fdbc61684f89cb0dceb231eb14aa12025

SHA512
f6b19249356eefe6fe21fc99355fb10bd8a6c9416029cd88f9c09df1d9a7bcb360f1ac4b1cf260e57b434c3fea74b159a2c1a3a2807c61d9efcdc7db99fc5222

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_pcg64.pyd

Filesize
95KB

MD5
559f4467632ea5fbc486cade39d193a6

SHA1
544af2cf84b88b692ba90e143a8d18ca2b87a1c4

SHA256
f243dd43ccd3ef8ccd0eb954b30be0e81823ee01bc8df448ae2b280545a9e2c4

SHA512
6585fdb75c1d59a39e7e35805279a59df5b39b54cbd9528e4184148558c1544f479736e208a3540fc1b7ee47508c3e0aa60e5d30e82c492182ffea5afeb44fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_philox.pyd

Filesize
80KB

MD5
ee2b620530b19338dc08305c961ffa7d

SHA1
2b250b1e978ef0db75f34038be401ad3fdc36a84

SHA256
cf7bdf4841b8f2e009fde9ae988a3546e696eb267a62e42f96e01e3b20ad8b89

SHA512
2e01e8e5bad9ed62bf62acc56ecc9bdd988e9c0cc56aeb3fd0410315264cf4230d34edc563708746d13abdd9b9b5d673b888cc35b344d836f936da2318744c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\_sfc64.pyd

Filesize
61KB

MD5
abe28fa1b176212050173d6a1e1b52d0

SHA1
ffc1fc70465f48722b6ab72476a02142c63c828f

SHA256
3b63dadb1e0f5cf9f68ea87d9d6997a7ab4ba377c3de4831c9a4ffd6ae791e86

SHA512
c1730fc1eab51ef1232d80b61848e9dbb88f9cec92295a3910770358705220cb7abe282e3415dbd7ee0c94110c6eac557933bc910cfcd47b9e7cb462f84a3e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\bit_generator.pyd

Filesize
168KB

MD5
e7302b42919946e3449dfeb922587b5e

SHA1
e6fbe96c243188ff91b3ed7a224607f546836c6a

SHA256
c08f02ae5fbfec48aeedf264abcf6765897188173d48daa6aa39f18b8eb066ad

SHA512
fe80887ad93bf059e1860689c247c6aacc4db95f131b6aa53a080d8ca22830c31458d990ab752bc2908955af7a3c06ffdbb4d741cf47b905c0079f55c28da258

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\numpy\random\mtrand.pyd

Filesize
618KB

MD5
c7af5b09d22db85f62d0af85af50d919

SHA1
e506eba0a189e6103e0bffcb8e6a934f4f3c7e71

SHA256
ad8082b5eebf3245957d562ef233a234b372fd50d8144c9e00dfd8d879118c5d

SHA512
01e4e3a9ef5d05201cd6f675d0dc732857f2d09833c7f7bb69918533353862351c73a41500add346a1777fc7d30de2ecd7a18cd8f7265733a07cf3903ea2347a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\pyexpat.pyd

Filesize
197KB

MD5
958231414cc697b3c59a491cc79404a7

SHA1
3dec86b90543ea439e145d7426a91a7aca1eaab6

SHA256
efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f

SHA512
fd29d0aab59485340b68dc4552b9e059ffb705d4a64ff9963e1ee8a69d9d96593848d07be70528d1beb02bbbbd69793ee3ea764e43b33879f5c304d8a912c3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\pythoncom312.dll

Filesize
655KB

MD5
a2cc25338a9bb825237ef1653511a36a

SHA1
433ded40bab01ded8758141045e3e6658d435685

SHA256
698b9b005243163c245bfa22357b383e107a1d21a8c420d2ef458662e410422f

SHA512
8d55d3f908e2407662e101238dacdbd84ae197e6e951618171deeac9cfb3f4cb12425212dbfd691a0b930da43e1a344c5004de7e89d3aec47e9063a5312fa74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\websockets\speedups.pyd

Filesize
11KB

MD5
aeed28bc093d2134425b4547a4420bce

SHA1
4b73cd31ba8aa7ca4b9b69987ef9df9c749121d3

SHA256
51a536d4ac626826b1536bc2f522d0410829acd47a0284babc849d501a25a330

SHA512
92ab3fd601be9386e11d4a50b11616871426ec5dda957ac5510373b0d457dfe614d12195e1ac6499ebfa7f3330bbcec4017b802e401ecd8853c42932e0b55b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\win32evtlog.pyd

Filesize
71KB

MD5
e789d89b5dbdb33d2022cd7fb11c2b90

SHA1
0839ee5cdf5b24264fb65ccbd32005ec683d81a9

SHA256
7caa0a481e17cff16e1129628fef036101fedc06c843b9a39ee062c7c88d5b5d

SHA512
6a0ee3015a2825a75c92e285cd3346a657f57055e05bc40b961712e2ec1674e5bb9720ce48b957044d62483d39618612a757c23aa3f5a8680fc8e6fe2785f5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\yaml\_yaml.pyd

Filesize
217KB

MD5
55b11a967b77c25af37bd020db5fb3fe

SHA1
9449ace86d400d031833db471b6cf3a641de6457

SHA256
087881df55b9fe1d90bd11f89b6c9516dfd20ac330e40f97dbcc188b0cb034e6

SHA512
7bba1567792899108a26913c0e2114ee0ac92f88a4b821b9cedad6be47518fdea1e1999a25049f18869b0fed28fcdd8e69a11e865c16557509e4e2101930fcd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4368_133683310449546575\zstandard\_cffi.pyd

Filesize
635KB

MD5
afa2b9e9c7153750794acfdf4bd0e416

SHA1
19c521d35dcf6bc1546e11ece12904043be16fdb

SHA256
14db1d573f7ba8f41563bbc7cda6f1a46e5f86c1b7096d298593971a0b1c6c60

SHA512
38e2ec7f45c6ac7cbc0d5ab7ca94ddf47fc72067507d699fa32f42aa8a4187579724645e45042929140c832c83457011ef83914e397d6f8713a6e018b2823c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2NTAEWSCGLKENKNATNYR.temp

Filesize
17KB

MD5
8227d42d80b0b6378d606c416c268663

SHA1
48f4a5fbbff8c1d6af7e214f50994338b88b461d

SHA256
610376a54154edda4aa6f0062606f576ed542ff69bc5324fed8d7a97431bbc55

SHA512
6c11ce00b175f200fd9e6a7234bd62f6cc09fe8c96489270551071613b51fd777ddc124db83bd704924a5296c18150c8310ea844e6279d81d85e0f0f943c6699

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
17KB

MD5
a3770e965299f36db85dc47392d52082

SHA1
715537085ec1d1f4f1558fb74c89fea124830bf5

SHA256
2eee3721c237fe9d88d32a1e6780c5f26f0da66813e00c75b70d121bb2f08259

SHA512
0af590686742d8fd18ef5f321e29cbe6ec07cfe3b838733f3845a21a4b4d740089cfb85972b9ca46a30d67b97d87582dbeaf179bb0e1c0816dc43f15843ae8f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

Filesize
10KB

MD5
bf0c709e0b7f33bb197310012b1551ab

SHA1
5ee744f5e8b2ae283d471a61b677c084da769c2a

SHA256
49a7747a5ec825523fb650cf4ade44fcd205ac1c425d071a9617b35b9b516964

SHA512
28d54025228735a141c2ccb4f22ab1b6671aee48e33941a9f61e421184b2bf948be2b3428c02c577d966a8851147b4bd987027cdaac6cabf74854e40e21a553b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
84cc442793583ee8f24eb514454653fd

SHA1
70149840f3cad7edc9713447f05554f198f33a28

SHA256
e84833067c95bc4d490e6c3710c22e3e1860dc2bf2ab06e2af274c22ea99d9a4

SHA512
76185dc18a0cd34a8c3f088344b12ae8491b525eddb7aa7ad55c34ea75c4adbd836a6d06aeb55db87f114d871c7502b17a34dabf15f3aebe5dfcd0d66b81308b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
fe3cfc00108c9570007d71b2dc30fee9

SHA1
930381e593133959bdd74341c7f561905368d85c

SHA256
f9a27f7b86330dc40d90d50d4726645301a2c4e9dd9b59680bd4b1569c361118

SHA512
85f16669a6e97f84a668da58cb466a42a40a76bdbb4a83088ee8531ab91d8512ac97e355e21d64c21e3e726199823fcc282fb878ca7843ad8f5e121684810a62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
ed6fde67784cf9b6a18ac404e57cfcc5

SHA1
114fbb5bea7027e01bdca9e7580598b6919de1a6

SHA256
a5d3dcaef77cf0d49019969fae0f3904a6c4c15a07d17e8b1c43aeaba00d6016

SHA512
86031f42c527ab8c2f4329ae1305eb6a708de7f6c049c6ad88d43207a182b54be80f0a19e02487caf1984d3fe8f9dacf218ebb07ac1e1cbcd236b162adf2fd4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
4ad76f073ef789be88583533ed9bc466

SHA1
65df88651908b252155c9b3be75699347ba07221

SHA256
f524cd990da4e5002908ff0d9ac08496032cad4c417d9d4e8248a54ce7e75fc3

SHA512
e5c70a93b43469dcb25ec606709d0a1161ae50bef42c3e22c8b3b0337a645a7b59a62cec27839d358fe3f158d4a2f12ca4f95acf6a523f0e2263f878abb57c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
81KB

MD5
9e3aa1fd75640d5bfbf3116d75a6c571

SHA1
e7a43436b1a2f8e45317647ff47de5bc2eb204f7

SHA256
ab3402b16db278280841e09171f53a64b0a0f46144364ec8f3820e4e37070fbb

SHA512
e322f33db0a927e8083ccd53a9dcc02f6655b327bb1ab940427f04ce36c0e101e9fd494bfeec090c15236ef70b55f039d734483da43c301313c1163ceba8402d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\4059837d-98b9-4f68-9caa-1c325715fdad

Filesize
659B

MD5
0bdd645f130cde0171db0593692fef76

SHA1
a5d9e552a256c1c9f019bacb9d892164829949ca

SHA256
2667b7c233c299f334c2635199d05e010fbeb6a1199aa8404340e1875be9cb39

SHA512
8e38cef55f5a551e9aed8e580a065671c4b56993c6d21c28a600852cf30ca5db2f950e9a7624d71a08c6e66d423895650644a5a3d2fca4a4bef5bd26029132c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\b38dd56a-7a33-4e28-ae4d-f8231f48514f

Filesize
982B

MD5
99383f1edb9cd1c6a98aa63fd61e2e56

SHA1
ab5d91f58d5ccdf1970a84ea073f903721f81003

SHA256
2a62865fe296284b9a55afa6c2b37e5f6e5defec3fda5237d036e62e54489311

SHA512
59aaa0c5a89fdeb9ba2577bc4c95adf89f23b1882bd864c80688ee3e04528a9bd7f8e2efc35584f955b4fa0626354543351965252f70d1de8ca1e9addc366e30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\key4.db

Filesize
288KB

MD5
ed830ff0821843a21bdcfb613c96a6fd

SHA1
7d46b809acbf2e10938cdacd2c346125b8b3ee6b

SHA256
8f349206e7a1bceb283988c626c34857ccab4366f1cecf1539dbd78a6c51a43b

SHA512
1072cc63134eafb569635ce57da28409ffb36520aeab364a3415403e3c17b2a88b5c723450858a009427bbfba960c8bc6803805d331f297f7cdc48c99ff73e87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

Filesize
11KB

MD5
629baddb7867b49679722bc5c8ce7bd8

SHA1
40c0528dcab61a504bf789ee81b315e999511fb1

SHA256
f9af4c50243ff8eef579f23f168299977649f35af854f7248cf89eea606f3363

SHA512
4ee959226ac002b3e7df683161d9f3604ac32a3364060198bdf1adffba2de7f5adfb23cd5f698b75bd6257df01ff3cfd193955fa55835344889167d2021d7eb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

Filesize
13KB

MD5
43d85f1ac7379b605c7fd34c2dba1657

SHA1
94105df6931406266fd8b3bd2adf0a47950e3f43

SHA256
aaaf32d67d3e44ad5f780a279520deefa0c0b0584f99168b465e6a23de6a6177

SHA512
536396af9bfa6a59af22c94e214088b740fcfcd757722452034694f345034ab77870a80b1de6f9595181e93eb0e7187ce60124fa272e19d26a5c33d590014c3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bd4ab96b18a8dcd1b4ad780fce4b3046

SHA1
9b30fa8c610b67cf5a9d26cc8c8cbabfa1ce6e14

SHA256
eaae01bcb9058f0fc2f07835cdd3a78bac8b04c7dfd13ad14e661efdde9f3f63

SHA512
94aca1e35dad7f34a96a2d04e049424064ac3961d3aaaf2a019f1da89efcab949b0e5f254c57621066ff9e1f9f0eb5d0e3bf936c2fd3df922e24bb32313a6898

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
f9a9f218912a94f892861a38f69b4f3d

SHA1
16132f6ae5bdeea3991b3152aacd41f4f58a9e4f

SHA256
3e49e28796cb6957bfa0b820ace63d8d7586661a116ad2fc227a78dc94c2661f

SHA512
da4e3690c4be50d8480aa5505a871576a8ec0473d68ebd16165b3da26b9f66f5073c36a6e645abc91792df9231ec8eb3e3bafe79b8c20b54bd1fe34c4004db30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
356cf3bc6cb9dd311783465842ce6e1e

SHA1
221bc944e67bcf05c84c2e1d2c7de98e4d6db40b

SHA256
c689cba2ae245240b70077bea090624b16ab828c8ad1f8cb91449d5ecdac4ca2

SHA512
860c23684225a7b18a38eb9f1bb31dff1c3fa43fb68622e23d59ce806583907cb2e42dc597b8f60bf67ed9ad83ce755bfae56325b95a26c7888f7da8f158fd05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
3186e61a9c53a8a6ae36c36d973c6fd8

SHA1
615bf169057b66ffbb4b5cfc059e8935037dd479

SHA256
bf626f6d25229cdd0c0b63c2b8f4c6c3d48b1c6a9fdd2f1aada8a93c6ad26958

SHA512
25d1d53db206efe5a16a7fc4b93633e889a6d595841751563db18c43160f25b23785b8147b0e2344ebd9ae10870147ef00e39a159262c240ff610519e84fe80b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
43150b3aa33b566ab8a8e3bfafafe34e

SHA1
0aaeebb02526b0f4aa7db15fad2e7da1340f770a

SHA256
98a60da7726a6105a25ba648821b1425f2cd1764bffeebbae3c8c47f4e420c81

SHA512
394cd9b7e111b372f5802455e0bc4fe3b2a08145ae1b1811af73abacb30da46219dc0ede7bbd4e4a4e8a35bcb2c792041d7e64aa7dde7afe8455e2cec1ddf390

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
61798256e34e73f373189ef3b04be51e

SHA1
63ce8efce3c558e7f124c299487617ac43385fa6

SHA256
2720d88954ce92bbab7ff0dffe02974e1e9ea76fdfa52027f7fcf6f49f43502a

SHA512
7c11d957a0d8511f561cbeab0b48ac685bfc8f16f98537c96ed223d10c299c5956303e5309aa7381fb7f2c45b2b843f3adaec89a044013d9edebdf3461d7ceba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
9c0c695bb4e298302946f4ade9554753

SHA1
4c1ccfec2fa572c2cdc24f913b43a382a7707318

SHA256
62ce4e5e8e99f225e1a95b68ded4e2e5a468d74ea4edc0bd353b204889a01ae0

SHA512
104e912502140e584df90408a0e3bb44a8820b31129a90042a3162c9df148014a95b3fbf03a2cc29a0b8e28f707a082a7e724a29bfcb60e739c7aa60aa39b906

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
768KB

MD5
42029f81ec23bd8454be25db48f096cb

SHA1
b77d2de4756aa8e92c4bad15b798c1616a781676

SHA256
351092ec4563f393405523b7eb8376d6c66660ee541f2db84477b6a391c9eab9

SHA512
f6855d81ffda30aa5e9122e96a8384ccab5577de0064fc63aa982895a2cec9ad7d5a49e93e8921d338431961c1679eaefa74236beb46a3ead79802fb0cbbdef6

Download Submit
C:\Users\Admin\Downloads\FluxTeam.vJ98A-gB.zip.part

Filesize
34.3MB

MD5
da728a073b0f68e353caf123e71b3692

SHA1
48687f8abb7018b3e8557de4f5fe4ad2473120fb

SHA256
7e781206100180c84e2dd8a9946a8ad6ce8859383c4ecce1d23cd0fb77ff510f

SHA512
9d5ed086e541b5dc19a187d69f0381640afabe91de32455db88b2dfc93fd4aa8a39fea03d1eefef2ff02884b55f642da730e94c1732df2316f121b9e066daa76

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
148B

MD5
5d22adbb0b47dcdd3369b3347f6ccba3

SHA1
c64ff3111cf6a42a90cb76304701965a59b116b6

SHA256
a2118c4bd9b9945f4c7a7bdb57587251d3978719505a5261a09bce3d25f9fae6

SHA512
10a7f5c4c520a588cf084d4199b71c749b3f293e8a6a2960e37f786bc402832a238a7ef2430675339d1594dd4043d8a8af0bdc6d3a32e174aab4b11ac5d88f1c

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.u6OZguXb.exe.part

Filesize
5.5MB

MD5
6670e5c270db13d474d6f93c38303245

SHA1
ec8566078f8b1aaa425f59502372be14a60c3ad1

SHA256
80cb35cc5a9750f74e8b005e4a52c384527c2d2510d38069f32b023c27f62033

SHA512
5a1354134ac1765ecc3d85dd94baddd4ffd570e9935b68f6e43a1179f8a0f6d0e664989bfb42b409a6b0b2c6a53e6d33bc9dda723632e0a658fef5275578ba26

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
0bc3e9c323b6b9c24e0390cf3f1fd97d

SHA1
8addc74524b15b2bcda04878ecf3a47d40f90824

SHA256
327eac7bbc57401468a5cce56cbc4ba8b4015c0c85f42eb423edbe1efe509449

SHA512
c5db5074e18ad8b3d758b9a416d9d84e48d2f007079725f8a5ea90331d7b8f2c64246d654c821781530c6fc0c0c58a40fc35b1c9e208cb1e824b22c3d9125808

Download Submit
memory/480-2298-0x0000000005AE0000-0x0000000005AF4000-memory.dmp

Filesize
80KB

Download
memory/1180-2601-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2604-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2594-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2596-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2595-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2600-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2606-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2605-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2602-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1180-2603-0x000001F5ACAD0000-0x000001F5ACAD1000-memory.dmp

Filesize
4KB

Download
memory/1404-2271-0x00007FFB4A7D0000-0x00007FFB4A7FA000-memory.dmp

Filesize
168KB

Download
memory/2476-304-0x0000000006900000-0x0000000006CD6000-memory.dmp

Filesize
3.8MB

Download
memory/2476-308-0x0000000074470000-0x0000000074C21000-memory.dmp

Filesize
7.7MB

Download
memory/2476-301-0x0000000005F70000-0x0000000006516000-memory.dmp

Filesize
5.6MB

Download
memory/2476-417-0x0000000074470000-0x0000000074C21000-memory.dmp

Filesize
7.7MB

Download
memory/2476-396-0x0000000074470000-0x0000000074C21000-memory.dmp

Filesize
7.7MB

Download
memory/2476-363-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2476-299-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2476-300-0x0000000000E80000-0x0000000000EF4000-memory.dmp

Filesize
464KB

Download
memory/2476-307-0x0000000006520000-0x0000000006534000-memory.dmp

Filesize
80KB

Download
memory/2476-306-0x0000000074470000-0x0000000074C21000-memory.dmp

Filesize
7.7MB

Download
memory/2476-305-0x0000000006670000-0x00000000067BE000-memory.dmp

Filesize
1.3MB

Download
memory/2476-302-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/2476-303-0x0000000005A60000-0x0000000005A6A000-memory.dmp

Filesize
40KB

Download
memory/5548-2156-0x0000000005A00000-0x0000000005A14000-memory.dmp

Filesize
80KB

Download
memory/6752-2430-0x00007FFB4A7A0000-0x00007FFB4A7CA000-memory.dmp

Filesize
168KB

Download
memory/6932-2788-0x00007FFB4A0D0000-0x00007FFB4A0FA000-memory.dmp

Filesize
168KB

Download
memory/7004-2527-0x0000000072E90000-0x00000000730A0000-memory.dmp

Filesize
2.1MB

Download
memory/7004-2151-0x0000000072E90000-0x00000000730A0000-memory.dmp

Filesize
2.1MB

Download
memory/7004-2114-0x0000000072E90000-0x00000000730A0000-memory.dmp

Filesize
2.1MB

Download
memory/7004-2113-0x0000000000C70000-0x0000000000CA5000-memory.dmp

Filesize
212KB

Download
memory/7004-2694-0x0000000072E90000-0x00000000730A0000-memory.dmp

Filesize
2.1MB

Download