Resubmissions
03-09-2024 02:27
240903-cxwsxavbrj 803-09-2024 02:23
240903-cvjqkawcka 803-09-2024 02:22
240903-ctyhbswbrg 603-09-2024 02:10
240903-clxk3athln 8Analysis
-
max time kernel
361s -
max time network
362s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-09-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
RobloxStudioInstaller.exe
Resource
win11-20240802-en
Errors
General
-
Target
RobloxStudioInstaller.exe
-
Size
5.5MB
-
MD5
24bcceca8b115ff5d0060b2d9def17c6
-
SHA1
a06ba5c1f6d64c9a95627c4b2291806d2b5cd300
-
SHA256
c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde
-
SHA512
d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d
-
SSDEEP
98304:GylvpWmVc0qvvtCfSp1SeBg+zTqltWRBfKpph6Ubhh/a/:LpWachtCmpg+CWR4ppkUw
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 45 IoCs
pid Process 2536 MicrosoftEdgeWebview2Setup.exe 3820 MicrosoftEdgeUpdate.exe 1180 MicrosoftEdgeUpdate.exe 4372 MicrosoftEdgeUpdate.exe 3876 MicrosoftEdgeUpdateComRegisterShell64.exe 1200 MicrosoftEdgeUpdateComRegisterShell64.exe 4812 MicrosoftEdgeUpdateComRegisterShell64.exe 1244 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 4200 MicrosoftEdgeUpdate.exe 3920 MicrosoftEdgeUpdate.exe 2224 MicrosoftEdge_X64_128.0.2739.54.exe 3212 setup.exe 4104 setup.exe 4052 MicrosoftEdgeUpdate.exe 2908 RobloxStudioBeta.exe 2060 RobloxCrashHandler.exe 4448 msedgewebview2.exe 4844 msedgewebview2.exe 3924 msedgewebview2.exe 1608 msedgewebview2.exe 2388 msedgewebview2.exe 4112 msedgewebview2.exe 4540 msedgewebview2.exe 840 msedgewebview2.exe 5440 msedgewebview2.exe 3260 msedgewebview2.exe 1928 msedgewebview2.exe 6072 msedgewebview2.exe 5260 msedgewebview2.exe 416 msedgewebview2.exe 1220 msedgewebview2.exe 4776 msedgewebview2.exe 5352 msedgewebview2.exe 5572 MicrosoftEdgeUpdate.exe 1212 MicrosoftEdgeUpdate.exe 5908 MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe 5912 MicrosoftEdgeUpdate.exe 2636 MicrosoftEdgeUpdate.exe 5528 MicrosoftEdgeUpdate.exe 6044 MicrosoftEdgeUpdate.exe 8 MicrosoftEdgeUpdateComRegisterShell64.exe 5352 MicrosoftEdgeUpdateComRegisterShell64.exe 5128 MicrosoftEdgeUpdateComRegisterShell64.exe 6100 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 64 IoCs
pid Process 3820 MicrosoftEdgeUpdate.exe 1180 MicrosoftEdgeUpdate.exe 4372 MicrosoftEdgeUpdate.exe 3876 MicrosoftEdgeUpdateComRegisterShell64.exe 4372 MicrosoftEdgeUpdate.exe 1200 MicrosoftEdgeUpdateComRegisterShell64.exe 4372 MicrosoftEdgeUpdate.exe 4812 MicrosoftEdgeUpdateComRegisterShell64.exe 4372 MicrosoftEdgeUpdate.exe 1244 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 4200 MicrosoftEdgeUpdate.exe 4200 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 3920 MicrosoftEdgeUpdate.exe 4052 MicrosoftEdgeUpdate.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2060 RobloxCrashHandler.exe 2060 RobloxCrashHandler.exe 2060 RobloxCrashHandler.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 4448 msedgewebview2.exe 4844 msedgewebview2.exe 4448 msedgewebview2.exe 4448 msedgewebview2.exe 4448 msedgewebview2.exe 3924 msedgewebview2.exe 3924 msedgewebview2.exe 1608 msedgewebview2.exe 2388 msedgewebview2.exe 2388 msedgewebview2.exe 3924 msedgewebview2.exe 3924 msedgewebview2.exe 3924 msedgewebview2.exe 3924 msedgewebview2.exe 4112 msedgewebview2.exe 4112 msedgewebview2.exe 1608 msedgewebview2.exe 4112 msedgewebview2.exe 4540 msedgewebview2.exe 4540 msedgewebview2.exe 4540 msedgewebview2.exe 840 msedgewebview2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
pid Process 6004 GameBarPresenceWriter.exe -
Checks system information in the registry 2 TTPs 20 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppChat\UIBlox.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\AnimationEditor\icon_keyIndicator.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\GameSettings\ScrollBarBottom_Wide.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Lua\TerrainEditor\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Debugger\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\VoiceChannel.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialCommonTestSuite\ContactsRodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTestHelpers\Dash.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Utils\getPlayerPrice.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\TopBar\Components\Presentation\RecordingPill.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\type\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\RoactFitComponents\Roact.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\Qml\QtQuick\Controls.2\Universal\ProgressBar.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Lua\Notifications\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\TeamCreate.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\react\data\QueryData.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\ApolloClientTesting\GraphQL.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\JestUtil-31ab8d40-3.8.1\JestUtil\pluralize.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\util\prettyPrintVector3.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\Debugger\Breakpoints\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\flags\getFFlagUGCValidationAnalytics.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadsCore\UIBlox.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Cursors\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Ribbon\Light\Medium\RibbonUIPageLayout.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\InGameChat\BubbleChat\Helpers\getPlayerFromPart.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\JestConsole-31ab8d40-2.4.1\JestConsole\getConsoleOutput.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler\ReactReconciler\ReactFiberOffscreenComponent.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence-50d7e209-c2fcb3b0\RoduxPresence\Actions\ReceivedUserPresence.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\RoactAppExperiment.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\ui\VoiceChat\SpeakerDark\Muted.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Lua\StyleEditor\Dark\Standard\StyleSheetGuiState.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Alerts\Dark\Standard\Question.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\Tooltip.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppChat\Navigation.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\Qml\QtQuick\Controls.2\Material\Tumbler.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\ui\PlayerList\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Lua\AssetManager\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Localization\Locales\lt-lt.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoduxUsers.lua RobloxStudioInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\mip_protection_sdk.dll setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\textures\FlatCursor.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\msvcp140_1.dll RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\flags\getFFlagUGCValidateTotalSurfaceAreaTestBody.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FocusNavigationUtils\Loggers.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GuiObjectUtils\Dev\ReactRoblox.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-31ab8d40-0.4.2\LuauPolyfill\Array\isArray.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Locales\cy.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\ErrorReporting\.robloxrc RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Actions\SetGameNameAndDescription.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Reducers\CreatingExperiences.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AuthCommon\CentralOverlay.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Components\ReportCategoryDialog.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Flags\IXPVoiceAbuseReportReportAbuseMenu.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Locales\vi.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\NotificationsCommon\React.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-FR msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-pt.hyb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_875375453\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_775840966\manifest.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1789578570\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-ZH msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-pa.hyb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1708475745\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1708475745\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1635675577\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_875375453\_metadata\verified_contents.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1635675577\crs.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_775840966\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\msedge_installer.log setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_107490990\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_875375453\LICENSE msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_875375453\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_875375453\keys.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_291271704\hyph-cu.hyb msedgewebview2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6100 MicrosoftEdgeUpdate.exe 1244 MicrosoftEdgeUpdate.exe 3920 MicrosoftEdgeUpdate.exe 4052 MicrosoftEdgeUpdate.exe 5912 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32 MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdate.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2908 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3308 RobloxStudioInstaller.exe 3308 RobloxStudioInstaller.exe 3820 MicrosoftEdgeUpdate.exe 3820 MicrosoftEdgeUpdate.exe 864 chrome.exe 864 chrome.exe 3820 MicrosoftEdgeUpdate.exe 3820 MicrosoftEdgeUpdate.exe 3820 MicrosoftEdgeUpdate.exe 3820 MicrosoftEdgeUpdate.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe 2908 RobloxStudioBeta.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2908 RobloxStudioBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 4448 msedgewebview2.exe 4448 msedgewebview2.exe 4448 msedgewebview2.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3820 MicrosoftEdgeUpdate.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2908 RobloxStudioBeta.exe 1508 OpenWith.exe 2800 LogonUI.exe 2800 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 2536 3308 RobloxStudioInstaller.exe 78 PID 3308 wrote to memory of 2536 3308 RobloxStudioInstaller.exe 78 PID 3308 wrote to memory of 2536 3308 RobloxStudioInstaller.exe 78 PID 2536 wrote to memory of 3820 2536 MicrosoftEdgeWebview2Setup.exe 79 PID 2536 wrote to memory of 3820 2536 MicrosoftEdgeWebview2Setup.exe 79 PID 2536 wrote to memory of 3820 2536 MicrosoftEdgeWebview2Setup.exe 79 PID 3820 wrote to memory of 1180 3820 MicrosoftEdgeUpdate.exe 80 PID 3820 wrote to memory of 1180 3820 MicrosoftEdgeUpdate.exe 80 PID 3820 wrote to memory of 1180 3820 MicrosoftEdgeUpdate.exe 80 PID 3820 wrote to memory of 4372 3820 MicrosoftEdgeUpdate.exe 81 PID 3820 wrote to memory of 4372 3820 MicrosoftEdgeUpdate.exe 81 PID 3820 wrote to memory of 4372 3820 MicrosoftEdgeUpdate.exe 81 PID 4372 wrote to memory of 3876 4372 MicrosoftEdgeUpdate.exe 82 PID 4372 wrote to memory of 3876 4372 MicrosoftEdgeUpdate.exe 82 PID 4372 wrote to memory of 1200 4372 MicrosoftEdgeUpdate.exe 83 PID 4372 wrote to memory of 1200 4372 MicrosoftEdgeUpdate.exe 83 PID 4372 wrote to memory of 4812 4372 MicrosoftEdgeUpdate.exe 84 PID 4372 wrote to memory of 4812 4372 MicrosoftEdgeUpdate.exe 84 PID 3820 wrote to memory of 1244 3820 MicrosoftEdgeUpdate.exe 85 PID 3820 wrote to memory of 1244 3820 MicrosoftEdgeUpdate.exe 85 PID 3820 wrote to memory of 1244 3820 MicrosoftEdgeUpdate.exe 85 PID 3820 wrote to memory of 3696 3820 MicrosoftEdgeUpdate.exe 86 PID 3820 wrote to memory of 3696 3820 MicrosoftEdgeUpdate.exe 86 PID 3820 wrote to memory of 3696 3820 MicrosoftEdgeUpdate.exe 86 PID 4200 wrote to memory of 3920 4200 MicrosoftEdgeUpdate.exe 88 PID 4200 wrote to memory of 3920 4200 MicrosoftEdgeUpdate.exe 88 PID 4200 wrote to memory of 3920 4200 MicrosoftEdgeUpdate.exe 88 PID 864 wrote to memory of 4848 864 chrome.exe 93 PID 864 wrote to memory of 4848 864 chrome.exe 93 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1984 864 chrome.exe 94 PID 864 wrote to memory of 1132 864 chrome.exe 95 PID 864 wrote to memory of 1132 864 chrome.exe 95 PID 864 wrote to memory of 2856 864 chrome.exe 96 PID 864 wrote to memory of 2856 864 chrome.exe 96 PID 864 wrote to memory of 2856 864 chrome.exe 96 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Microsoft\Temp\EUFAEA.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUFAEA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1180
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3876
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1200
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4812
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY3MUNDNzMtMzk2OS00MEEwLUI5QzgtQkNEMTAwREUzNDAxfSIgdXNlcmlkPSJ7MjRFMTUxQkMtMDEzMi00RjE4LTk1ODAtOTNDNjIyNTczODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGRjU1NTRGRi1DMEY2LTQzOEUtQTJBNi05Rjg1QUI4ODQzOUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMzMzMzQzODYiIGluc3RhbGxfdGltZV9tcz0iNjYwIi8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1244
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BF71CC73-3969-40A0-B9C8-BCD100DE3401}" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3696
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.640.1.6400735_20240903T021715Z_Studio_2FDE4_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.640.1.6400735_20240903T021715Z_Studio_2FDE4_last.log --attachment=attachment_log_0.640.1.6400735_20240903T021715Z_Studio_2FDE4_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.640.1.6400735_20240903T021715Z_Studio_2FDE4_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.640.1.6400735 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=57f2af3bb86950918cc29b5bb59305ca86818ed9 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.640.1.6400735 --annotation=UniqueId=8883282232750373622 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.640.1.6400735 --annotation=host_arch=x86_64 --initial-client-data=0x5b8,0x5bc,0x5c0,0x5b4,0x5c8,0x7ff6d5f5e2c0,0x7ff6d5f5e2d8,0x7ff6d5f5e2f03⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2908.4340.106473185165219632703⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:4448 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.54 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9febb9fd8,0x7ff9febb9fe4,0x7ff9febb9ff04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4844
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1792,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3924
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2012,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2224,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3532,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4112
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4068,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4540
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4276,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4156,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
- Executes dropped EXE
PID:5440
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4992,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:144⤵
- Executes dropped EXE
PID:3260
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4152,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:144⤵
- Executes dropped EXE
PID:1928
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4940,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:144⤵
- Executes dropped EXE
PID:6072
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4912,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:144⤵
- Executes dropped EXE
PID:5260
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4952,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:144⤵
- Executes dropped EXE
PID:416
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4932,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:104⤵
- Executes dropped EXE
PID:1220
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=3388,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:144⤵
- Executes dropped EXE
PID:4776
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 640, 1, 6400735" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4512,i,1961288563277817486,244899047966482205,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
- Executes dropped EXE
PID:5352
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY3MUNDNzMtMzk2OS00MEEwLUI5QzgtQkNEMTAwREUzNDAxfSIgdXNlcmlkPSJ7MjRFMTUxQkMtMDEzMi00RjE4LTk1ODAtOTNDNjIyNTczODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1QUVGQjU2MC1EQTAxLTQxMzYtOTY1RC1BRkIwRkY2QjcwNDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMzgwMTQyNDUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3920
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\MicrosoftEdge_X64_128.0.2739.54.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:2224 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\EDGEMITMP_F0122.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\EDGEMITMP_F0122.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3212 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\EDGEMITMP_F0122.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\EDGEMITMP_F0122.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3F913ACD-D0CD-4A40-91FD-1B811A26DFD8}\EDGEMITMP_F0122.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.54 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6329e06d8,0x7ff6329e06e4,0x7ff6329e06f04⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY3MUNDNzMtMzk2OS00MEEwLUI5QzgtQkNEMTAwREUzNDAxfSIgdXNlcmlkPSJ7MjRFMTUxQkMtMDEzMi00RjE4LTk1ODAtOTNDNjIyNTczODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MzE5NEUyRC04QTk5LTQ3OEYtQkFCQi02MDczRjYyQ0ZCOUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjguMC4yNzM5LjU0IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDUzMzE0MTQ4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA1MzM2NDE3NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0NDg3MjczOTciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzZlMjFkZjA5LWQ5MDktNDU3NS04ZTI0LWQ5NDU5MDllNThkZj9QMT0xNzI1OTM0NTUwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWxpMENNVnoxUjE3N3FKJTJmdHhYZjUlMmZaaGhnbFVHJTJmdndPQnp4dlFwZWF5T1lMaHRDSjdxU2FuSW1FNUlSRktZUlN1b2RybnduRE05T3A1bnlBbUNhMUZRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczNzkyODY0IiB0b3RhbD0iMTczNzkyODY0IiBkb3dubG9hZF90aW1lX21zPSIzMzA5MSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0NDg3MjczOTciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDYzMDI4MzIyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTAxMDMwNzE5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODk2IiBkb3dubG9hZF90aW1lX21zPSIzOTUzMCIgZG93bmxvYWRlZD0iMTczNzkyODY0IiB0b3RhbD0iMTczNzkyODY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0MzgwMCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa1688cc40,0x7ffa1688cc4c,0x7ffa1688cc582⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1832 /prefetch:22⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2108 /prefetch:32⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2228 /prefetch:82⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3648 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4756,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4764 /prefetch:82⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4908,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4988 /prefetch:82⤵PID:336
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
- Drops file in Windows directory
PID:2372 -
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff783b24698,0x7ff783b246a4,0x7ff783b246b03⤵
- Drops file in Windows directory
PID:4300
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5096,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3108,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4636 /prefetch:12⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3100,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3280 /prefetch:82⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3292,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5112,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5056,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5460,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5292,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5592 /prefetch:82⤵
- Drops file in System32 directory
PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4964,i,8020759973671780925,7716377645438053591,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:5592
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3352
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:6004
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:6104
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1212 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693913C7-7AD7-4599-91B3-C86C8A608AE5}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693913C7-7AD7-4599-91B3-C86C8A608AE5}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe" /update /sessionid "{8FB7A987-F0F9-4EC6-AC08-57A0F195EC0A}"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Program Files (x86)\Microsoft\Temp\EUC319.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUC319.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{8FB7A987-F0F9-4EC6-AC08-57A0F195EC0A}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5528
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6044 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:8
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:5352
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
PID:5128
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEZCN0E5ODctRjBGOS00RUM2LUFDMDgtNTdBMEYxOTVFQzBBfSIgdXNlcmlkPSJ7MjRFMTUxQkMtMDEzMi00RjE4LTk1ODAtOTNDNjIyNTczODE0fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7M0U5NDM5NDgtRDA4RC00MTcxLUE4MzItREZGRUM2RjhEN0RDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjUzMjk3NDciPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNjYwNzE4NzEiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:6100
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEZCN0E5ODctRjBGOS00RUM2LUFDMDgtNTdBMEYxOTVFQzBBfSIgdXNlcmlkPSJ7MjRFMTUxQkMtMDEzMi00RjE4LTk1ODAtOTNDNjIyNTczODE0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4RTgyNUVGNC1CRUM4LTQ1NEMtQUU3NS0wOEU2QzY2OEY1Qzd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNDExMzE0NDYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE0MTI2MTUwMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE0OTM0MTQyNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMyM2ZhN2Y3LTQ0NDUtNDEzNy04MmVjLTcxNTI4OTQ5MTgyYT9QMT0xNzI1OTM0ODU5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWxVJTJmOWtUNWdFUHNsTzJaVDY0cW9ZblVXdkVLWXo3NHVtR3pPJTJmNnRWc3pIbkY3MnFlWjVlajJNbzJzZEpqczIlMmJGM2tackdXbTd1U3huODNXMkRWSkJ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE0OTM5MTUwNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMzIzZmE3ZjctNDQ0NS00MTM3LTgyZWMtNzE1Mjg5NDkxODJhP1AxPTE3MjU5MzQ4NTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9bFUlMmY5a1Q1Z0VQc2xPMlpUNjRxb1luVVd2RUtZejc0dW1Hek8lMmY2dFZzekhuRjcycWVaNWVqMk1vMnNkSmpzMiUyYkYza1pyR1dtN3VTeG44M1cyRFZKQnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjQ1MTEyIiB0b3RhbD0iMTY0NTExMiIgZG93bmxvYWRfdGltZV9tcz0iNjgzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNDk0MzE0MzYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE1NDcyMTQxNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTAuMC44MTguNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjcwODYyOTU3ODYwMjEwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjguMC4yNzM5LjU0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIHVwZGF0ZV9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjk4MDM0NDEyNzQ2NTMwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins0OTREM0NGNC1ERUU0LTQyMEQtODI1RS1EMUJDRTdDNzlBRDl9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5912
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ec855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵PID:4860
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5179438f9d59850f9810b884efaae32f6
SHA163d91c28509aca46120cebaf93903320943c9b16
SHA256b03811daebe54e9832cd00a574b3ffc52119f7275d8f56c322c199215c5a0b7f
SHA512822ef4662274de1d8f8e0eefa98878889a7747223d769584ddb898a5a8d4b75602a01719e9729490ef5dc0a7fef5f789d0d76afa1a3002fac60aebd59ec29f20
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
Filesize1.6MB
MD590decc230b529e4fd7e5fa709e575e76
SHA1aa48b58cf2293dad5854431448385e583b53652c
SHA25691f0deec7d7319e57477b74a7a5f4d17c15eb2924b53e05a5998d67ecc8201f2
SHA51215c0c5ef077d5aca08c067afbc8865ad267abd7b82049655276724bce7f09c16f52d13d69d1449888d8075e13125ff8f880a0d92adc9b65a5171740a7c72df03
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
Filesize
27KB
MD5d749e093f263244d276b6ffcf4ef4b42
SHA169f024c769632cdbb019943552bac5281d4cbe05
SHA256fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
SHA51248d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
29KB
MD528fefc59008ef0325682a0611f8dba70
SHA1f528803c731c11d8d92c5660cb4125c26bb75265
SHA25655a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
SHA5122ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
-
Filesize
28KB
MD59db7f66f9dc417ebba021bc45af5d34b
SHA16815318b05019f521d65f6046cf340ad88e40971
SHA256e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
SHA512943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
-
Filesize
28KB
MD5b78cba3088ecdc571412955742ea560b
SHA1bc04cf9014cec5b9f240235b5ff0f29dbdb22926
SHA256f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
SHA51204c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
-
Filesize
28KB
MD5a7e1f4f482522a647311735699bec186
SHA13b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
SHA256e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
SHA51222131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
-
Filesize
27KB
MD5cbe3454843ce2f36201460e316af1404
SHA10883394c28cb60be8276cb690496318fcabea424
SHA256c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
SHA512f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
-
Filesize
28KB
MD5d45f2d476ed78fa3e30f16e11c1c61ea
SHA18c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
SHA256acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
SHA5122a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
-
Filesize
29KB
MD57c66526dc65de144f3444556c3dba7b8
SHA16721a1f45ac779e82eecc9a584bcf4bcee365940
SHA256e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
SHA512dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
-
Filesize
30KB
MD5b534e068001e8729faf212ad3c0da16c
SHA1999fa33c5ea856d305cc359c18ea8e994a83f7a9
SHA256445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
SHA512e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb
-
Filesize
30KB
MD564c47a66830992f0bdfd05036a290498
SHA188b1b8faa511ee9f4a0e944a0289db48a8680640
SHA256a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
SHA512426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
-
Filesize
28KB
MD53b8a5301c4cf21b439953c97bd3c441c
SHA18a7b48bb3d75279de5f5eb88b5a83437c9a2014a
SHA256abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
SHA512068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a
-
Filesize
30KB
MD5c90f33303c5bd706776e90c12aefabee
SHA11965550fe34b68ea37a24c8708eef1a0d561fb11
SHA256e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
SHA512b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a
-
Filesize
28KB
MD584a1cea9a31be831155aa1e12518e446
SHA1670f4edd4dc8df97af8925f56241375757afb3da
SHA256e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
SHA5125f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51
-
Filesize
28KB
MD5f9646357cf6ce93d7ba9cfb3fa362928
SHA1a072cc350ea8ea6d8a01af335691057132b04025
SHA256838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
SHA512654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528
-
Filesize
28KB
MD534cbaeb5ec7984362a3dabe5c14a08ec
SHA1d88ec7ac1997b7355e81226444ec4740b69670d7
SHA256024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
SHA512008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8
-
Filesize
29KB
MD50b475965c311203bf3a592be2f5d5e00
SHA1b5ff1957c0903a93737666dee0920b1043ddaf70
SHA25665915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
SHA512bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007
-
Filesize
29KB
MD5f4976c580ba37fc9079693ebf5234fea
SHA17326d2aa8f6109084728323d44a7fb975fc1ed3f
SHA256b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
SHA512e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981
-
Filesize
27KB
MD503d4c35b188204f62fc1c46320e80802
SHA107efb737c8b072f71b3892b807df8c895b20868c
SHA256192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
SHA5127e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1
-
Filesize
28KB
MD55664c7a059ceb096d4cdaae6e2b96b8f
SHA1bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec
SHA256a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
SHA512015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8
-
Filesize
30KB
MD5497ca0a8950ae5c8c31c46eb91819f58
SHA101e7e61c04de64d2df73322c22208a87d6331fc8
SHA256abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
SHA512070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9
-
Filesize
25KB
MD545e971cdc476b8ea951613dbd96e8943
SHA18d87b4edfce31dfa4eebdcc319268e81c1e01356
SHA256fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
SHA512f1c9fccf742fa450be249dbbf7e551a426c050ae4af3d2e909f9750068a2bdc801f618eb77a6a82d13421d27949c9f2a9681a44bcb410ccdeec66b24a70f6a9a
-
Filesize
24KB
MD5b507a146eb5de3b02271106218223b93
SHA10f1faddb06d775bcabbe8c7d83840505e094b8d6
SHA2565f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed
SHA51254864e9130b91b6fd68b1947968c446f45a582f22714716bfd70b6dc814841fffe939bc2f573a257ec8c62b4ff939643211fb29cabc0c45b78a6cc70eaa3752c
-
Filesize
29KB
MD53bc0d9dd2119a72a1dc705d794dc6507
SHA15c3947e9783b90805d4d3a305dd2d0f2b2e03461
SHA2564449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb
SHA5128df01ad484bf2924892129c59317f3da4f79611be2ca29e208114e5ed2cb96a63f753511dc4fe97e281417366246f2fb576cc6ef2618a67803ae7ac01be7b067
-
Filesize
28KB
MD5bcb1c5f3ef6c633e35603eade528c0f2
SHA184fac96d72341dc8238a0aa2b98eb7631b1eaf4e
SHA256fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1
SHA512ecd79ddd9f3e6db1d0471132c453c324ab55bdead21de77392f418281bc8a2dd43e9009912896ffa3d55d4d3ef17b0aa847a084369b619eb04a2d2313641d520
-
Filesize
27KB
MD52ea1200fdfb4fcc368cea7d0cdc32bc2
SHA14acb60908e6e974c9fa0f19be94cb295494ee989
SHA2566fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3
SHA512e63b80a5929200c85c7a30a3054bd51eee2f27e603501f105073868690906f4619a27a52e58c90ac2ab5d5c34a4739dfdd2a511574afeb7d0118de88c5544f42
-
Filesize
29KB
MD560dfe673999d07f1a52716c57ba425a8
SHA1019ce650320f90914e83010f77347351ec9958ab
SHA256ef749f70e71424d7f548d5c12283be70a6d6c59cffb1c8101b74f37ecacb64af
SHA51246bfe77a49f14293988863a8e4dd0543202b954b670940d9ad5dc6d2b46e46104d8d6206be08a941f7e02b8ff3e2e2366b7b795d02352cff18971f8d0df5fcdc
-
Filesize
23KB
MD5cf91a1f111762d2bc01f8a002bd9544d
SHA1db2603af55b08538a41c51fc0676bc0ed041d284
SHA256baa9fae4fb8939e0b5fe0c7f393ab1ca40b52534f37bf2158a9a36331a221e75
SHA5129db864dbd194885b46f7bed9875f1e531e48f7644ce4494b8dc482c7516a6f783cd35129d2565b272dc674491a08c844a6da88bf9fa7843fcf89c96b4e0af799
-
Filesize
28KB
MD5ca3465347e57624ee2a5dd2299d4f4cd
SHA1551a151a8d49489c90400e18c34633aa2c2b8a4b
SHA2565b9509a1ae34d89c89c8e657742495037d28cd03e1cd48aef4dfaa7aeebe29f0
SHA512a4bdd458a7628a9f0664e1000512e056718cc924510a21704ff8c69b0b251a5a1c7f6f267d66325cadda1536aaee78440348be128d082112c71732e485ac93f3
-
Filesize
30KB
MD5269e84b82973e7b9ee03a5b2ef475e4d
SHA14021af3bfde8c52040ad4f9390eb29ae2a69104b
SHA256c3fb0cae3dc5cdd86518d60f998c3adec1c0c5804a74ffbb9a346a73d598af07
SHA512db716e2f6527af2dfeba4c22ff00e159d7cc0b482fc126e87b8b3d35b714bb382676066097352b6ebb87c8dfe7f6144e83100f0c9a9990b0d23c810b6c575c21
-
Filesize
27KB
MD5864edbc77831a64a3e3ab972291233bb
SHA1fa1f3eb3320c1b1a329cbe786abecf2a8e625cbe
SHA256aecab1eb46075d1a1432b3e14537f860a2ded49a13ca82f17fac44b40ad2da51
SHA5123d54efd01d6317fb4746b55db2c847a506f594cff055f0db84a72ede02dbe3aa03d8e65ea06c5ae365f44312a26cdbc45ad5f9a0de46d2b9c878aeeb24566b89
-
Filesize
27KB
MD57071c732cf3e4b3144cf07c49d8eb44f
SHA13800bf304b44d9d27ac26bed6ccc899669dc3b4f
SHA2569c75ef5c3f53c643d7bb8c5907a0cba6ca2d1d64e6bea39ce06b4ad5a20454b6
SHA512be3a0942e2af843adeb8e9b6acc7cd8adec956b761f71d8eb0a02835ee5be115ac064fda7088b0813d40ec3a24e7bb77816e9b67ef0cbdce1562c36880b15049
-
Filesize
28KB
MD530849a9c16061b9a46a66e8e7d42ff81
SHA12d0e86535d964acce8912c6bef3cc12346b22a6c
SHA256b8075c09d33cc6b6ff22fdb29ccc3dd319ce867f4b77a1d165f6f8d8cb4977e9
SHA512298ee10ff6cab7ff38d31e3a7826dedeab8e9ccc616eae4ca2e5ec333f42e5c6744650857031d8bf35034bd46c7c01a2646362ffbbef1f421995c73ba999ff0b
-
Filesize
28KB
MD51866ddadd9397dbf01c82c73496b6bff
SHA1b210a9df7d6a5e116fe7a9ff8d455b6cbfb5663b
SHA2569b4bb2ca3366a1935b4869796efc0601f94356b45e8613d28e023dd516f48d17
SHA51276fa5cade101d79d012e00904bf18692f85967ceea0ed7e81da4df65b85afc125a00127d9e06c8c59ffbfd2dcdc88488157b61922960559fa17d13dedca3ee59
-
Filesize
29KB
MD5064035858a1df697913f06c972461901
SHA1b6be99ae8e55207949076955389bc8fec81937fd
SHA2564850260d2cbb4b4ff3490eb90ce55a412268ad699f946b1cd686ddf9f0403bd6
SHA5129459056e919854213117b874e61b526af4ba35c3c3e195b204c5c3e59cc4dfa2b4a45c32551e1de144842844f246f5e0d025cdcc78dbf7265ba5e26e7209cd91
-
Filesize
30KB
MD57e90d4306c5768dfd1160ad9e2168a19
SHA14f7b17843ad226d51cfb0090235b55a29b5a674a
SHA2568ebe88477b1493733140f1fced91903276ec69c7302deed3281054b49573eb3c
SHA512f6d8b538915fa70bfb784ea7e6d4047759d8eecc822e4b76ac9666997a41901c8269a8185f29e5472bcfaa87e4b97483bd544f3fc8f656b60dca71d63b44d291
-
Filesize
28KB
MD5468a420700d239a0cd90b95896b0d6da
SHA1ce57e3abf57c7ae13e99546b2a5e19dec03cb9b7
SHA25624b304bd40f8e63848f8d2a1ca6ac8bc032b7a700161efad61ad445787650c87
SHA512604c4cc8132c520da70c4870514610364648ec6446afa47128ac3aa8a9157932705da93e8ed4e33d56f5191d611b26b76aeba1514e9dff1a13dd32693cfddb8b
-
Filesize
28KB
MD551230a1b9ab0dad791e583b7ee57afe4
SHA1957ba3e5d9b2df16ea3e099aab5b7e74d2055e46
SHA256a47fc6a9a75875e75f3415f068c357dd499e533849381b875272d5994c163670
SHA5125a3d754cefa1ab28748cb38021b5cbebd93fe513da0f4a7cbae98c0938acb10cdda939171d0842b09e97cb4c73f19272be665f767642ba1c5b25c709b5417edb
-
C:\Program Files (x86)\Roblox\Versions\version-a8766ccdec1d49d3\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
14KB
MD56cbd9fe479f7dd3996e5a218f9f87564
SHA1eac91757b4ac62ccc05cd08c32ec0c58ea7db373
SHA256b84e0fe17a24353bd5d232d08f14200b75e5978cb40e2e4a8a797c43b77ef261
SHA512c100230633848b84ed84f8f9f17b09a2cf385b570a62ed3f6a1d55c267d471a493399963b321425373bf8d1f37ce42d1396b43b6cfd5f43b9b516d3a85574201
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
Filesize
649B
MD5d9c9200721b69f70eeacd6fe9a710ddc
SHA115a7fe97ecf68827cc562f37bcd1362d90a47be7
SHA2565da94a8f675c03665b64a2315f9e49a68fbf1ba7de4bfd093372c88219e60af0
SHA5125281d489dfa15c5f0be9a60a4fc30856e492b2d041410c80d3ce9b6b53817705faddd02769a19cb847de01039932bf35a5880e149d012b27d9e4c32ea761bc33
-
Filesize
24KB
MD5a0cfd68682f0bd92d1b9689873decb0a
SHA1bf620e4be66e3a569138b33e6e80ab205195b23d
SHA256289241a46edec789d65dd25c1fce8adeb9de90f79c415c983479cd45e363612a
SHA512d118a88b8fb0be077296da230de01213cbe375ed5331a4edf92bc2f7c96988f24d625ebad2f913f24a0eea122d92976d4f7a9289a902a6d65919c2176ecae6b1
-
Filesize
84KB
MD540c95a200094445f3e1179e70ed34b74
SHA1b48a96aa6e96101a4924601c5f3d6b21fb4841a8
SHA256d0f37db053d7bd9e17b19f1bb3049d09e09eff3c5fccf6e7f5be1975dc39feb7
SHA5125e0600aca7327ebca8c67f876cddcf96f36a45d4301824e5c98e3936403411d78e0b81e2f4315d8aa2df91dd3dd8660b52cb1582cd54fd82b06012bf1483751f
-
Filesize
36KB
MD51b909e53573253fb54089edf4e2609c4
SHA1ff7e77bb8482a1c6e1e1c12699d1b7174a4897b4
SHA256876ffaea99e8547d741bccf0356c405918e5cd746e6a794f13a2dd7a9cd6da15
SHA512357c96f3c154792291fc22cb6952124e120f9c795c2c33e7ef41312790f70d6ea3b976e2a39370115483664dffbdc2567ea1e6c728627da614f8112ba8f16a86
-
Filesize
39KB
MD527257bc051b1217ce38d8ef3bd5b55b1
SHA15b275fcafa7be36dfc9899f7c603039c3c7e3276
SHA256609bd6887dc54654c71d99849c770394d06b9df88f38409bea30e5a67cf60a88
SHA512d98653adb9e8662fd41a249d89b53654c71e481d10cc4c208bd85a46ae9275d6ac24f50d73e58ff760e2233d929e21ca6c9b353ef76548fd2c83741ca5785bd4
-
Filesize
75KB
MD55eccf2f615051260d4375c9549c5c682
SHA1ca4c97fc8523e8783b32663906b37956647d2b14
SHA2565ee4d4592b90489a2874edee3ddad3fb10102252a6078e02c3eb57c8cb97a9f2
SHA51216c1ff84438bf29889e53141bcdc14ea278fb0d30366fff93cf9c892fcc302e3638ec77d89cdb344b9b25bfb202e41355cc2c55bedae3fdb2b2b6e190058a10a
-
Filesize
80KB
MD583f8b9ca955c854e749128c499f0171f
SHA184b29fd363bc6bdc9f214f4c06824be592a080b4
SHA2561dc02d99ddea27b9ef4dd1e2da813bae6b954f6cbb1115a984ed8cf517e634e8
SHA5128aa959509ed41dec0eef5decc14d115ffecc8a0da8d74ad160250c2ee40adb5ccb9b1eb47cb23912084bf17ecef0dcccd960e3265027ac4fb383365e1bbe7f88
-
Filesize
43KB
MD5023b0bb325287b3d9015953347b4d23b
SHA1b1143b6ff04c151f10008902f09c2fa90c5ed598
SHA2569994c4f662295b2eb8f9e8db2748627c4b0cb532c9a66eebdeeec3f57ad349b4
SHA512daba60af4515a8d8a6494f38813eecc719f03b37208953197767281cd3540beec61aa5ba393458d702413060d02df18949ec08ab512c7bd65f08566c7cabfc79
-
Filesize
30KB
MD59f4c86b252b26cd16d2161afff5ed0b2
SHA1192170b70f0d33c591aed32b07abb8266c74f647
SHA256f160ff51834ec98e028b47bc600ce47ace716a45bf5926c9d441b205f3aa2fd0
SHA5121958f12ba66a073b2e941845501ff56bff6f9a232bac61a60ac0791aaed8c0738c1c2f4576be13913740bc35ea004e0f2fce8f14a913b4eb0cc8a19c74c2551a
-
Filesize
3KB
MD59e987bd384a0832c1f3ad9925b3fcdc0
SHA18b0b69c23dcd6d6f1542fc79a1b31237b937ba10
SHA2564b184aa537de4b554b9ff36756b55519ac5e0fb05f2ffe4f5db012181119bc61
SHA51222df9407b9c79dae18948b21ab2ce271d7db9af0c7e5ceffdb43410ca85d03a973c17e245f9a19fac71f1233162f1da75038513512d5b0973226e5cf5e6816a5
-
Filesize
3KB
MD53b32ed4fa57ea7bb7be3609ad5cfcaed
SHA1c4969308ac39a3637014ca0777e9143d812cbd4b
SHA256c2f39ed7c585674118df4ba7b7e85b1e5d590987ecff4428fcf622fc339d9998
SHA5121276cf54716e4be48506d5efd069631ac0885835e297ab6084d2953e48bdf3e73e2825321f1e2f21ab7021a65bd8e969e6549da874fceaed3cda0b56644ee094
-
Filesize
3KB
MD570bc162b1600ef48daf27ae396335cbe
SHA1ec094f7ba35b8b24fe5e1cca16790642eb057a6f
SHA2560dfca1ebcf1265534f8f0d4500879a2c3e5427cfb52421530c315df6e3c87955
SHA5120e36d2233ba6a80dea7a9aed4b3cc450ef7385fe9aeafa8558f39d391f230feb8e1f971fafe39af3ff1da452dfd52b40b1537706eb27a8f482a7bac8a36ff123
-
Filesize
3KB
MD5fae73511cd83cb3041dad243842be882
SHA1a184f99578ae4817bb0b8b59a03938bc671875cd
SHA256833a7f592530b1449be22369c9e0ae9cf189f8fad12985e133329aa682560729
SHA5125e5beaf998b0cdd3067f2887805d8ffede4083c47f497788bedf416c1af5e10981b2de325ed0a875852109750a0020c1cb423b5203196516b3f22375572c431c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize390B
MD52e514f79bb6b725b2eacd84ec42cfc79
SHA108914a3dcd0879f666586a6360a434695bcb2189
SHA2568404abdf82e717ed2199496f1dcf47898cf8da064205b78413befca25b28221d
SHA5129dd501be857d5405c01c9b80861b16d34f28ebc1806ddcc3260d4ac9b076a5ee2c84e0ce63711576bbefb21d661d50b178e46ca886c1c3dda20c513e3f5019a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5ae7d1.TMP
Filesize675B
MD5b4485ca8614866c3e888faa770810ecc
SHA18e279d52471e06f5720f9364f69004d8915545ea
SHA256e511e6cb7ab8caf473a453cbdc27b14efb6b0e816002dba43003d33cd6eb3195
SHA512991ca4c402396252a021614f03fff9f3b18ae1135e6c11ee9bdd40759f46dab6bff3b02941ff1a41092bf51a6fab5c06047400cd9eb7449cb70d2dc4e7304021
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize100B
MD5863c3ef02f410b044f79d348004a13a2
SHA15915fdf35fd55655f990f40bd97a0577165310df
SHA2567a10124e19faac80e297e5f222bd5c0947753fe9333d5f70f645616437481ec1
SHA5121e514b0537ef6a8d28ccf2bf25f6a7c4afb21fd5f24f09995d286f50f7c3547eb9e88a2ca150fa242ec3eaf5ffc144c390d1c119d24569143377f5c2bba48eb0
-
Filesize
3KB
MD595ca87b663df68de4f8b028869dd7060
SHA11cc45884ef6f32014631e5042be926d344a936ae
SHA256363a57cdfa6107650b94967c914e5f1149f74d5d8e3f0b30e6ee62f12a1df39f
SHA512406095ca002322e5910d2c606da9b41963e9f30f89a6107a54af0b2dc849c6e7989f5365db4b2d38681abea42393a9770dd46ab6d95090fd4056b51973f8d554
-
Filesize
2KB
MD5b4cd0736ba97a466ba9bbfb9ea85ddfb
SHA1cc707edf0e9c5780ef8579f9de95faffae7bacf4
SHA256e80eff845d5254315d07f03051df3d420f77c053d3e5ce515385ade808f8c1af
SHA512bfad3e70bafc7b4444c524bb72d695c5b284f3235e98e5ac0780b6e60d331a901c2d1917c873e91950a827d8bda7ce244c9f3306876224ff8c206fcdfda7a620
-
Filesize
3KB
MD5cf22d130f74b31ea6684ad8c90d6b483
SHA1aac92be120cdaacaec4b1336158b32d036873a60
SHA2566d2c70dbcfa1302fcc7c5e0cb2479de5f5439a579ba75bfbd2bcb56d95b9eafa
SHA5124a56d4e42c928e8a63837f837f98d43c717c86f0a5c3601daf8994cc95c14e36ff73ab24c526e98ca4cbc4fcdfe129afa3c2604ec06e49f5611876686fecf549
-
Filesize
3KB
MD531f9eddd49e012a6432d47c8d5c8a9c4
SHA1ab42f07c99be57d06cf522b22ca0f5afdc39e476
SHA2563770e7daeed7eeb165049149adb8b3985cde211e0921b276d207baf09da80ac2
SHA5125fc7fb42ab8621beb83a80d54e2657b3b9a18b2d0802594a43f7785621c12bb216e2b45d9d7dfbd1d4c2d0f024863dedae2184549a055f39d1d1c3462eb6937c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD54600f9059b8cd02024a5678141038343
SHA1ae5393cbd659b5e2bd867a6218424579ac704c20
SHA2567dc5dbfb7802e81b3a3c3a023ffde35c0155264461cf0b1b26fa10b1db8330a4
SHA512de807b4fea6b01b2f64bdd7d8935c30d008d29254add2c90000c1ede5512bdfef9b6ebaa7eeac273b83bbfff800503ae6a525834aa17c384d911a70fafcc56d6
-
Filesize
2KB
MD52c84b04bd6310e765e4eaea98f1b5615
SHA11fa16d0e0b8a45a6bc720396f8613d653bd9f8d1
SHA256ada8be334de928de78322729caed13fded4637046270918469205d66ae4e7935
SHA512753b7554ca0644838eb8455374458be96831fa5bc7f0abb49e8f38471f3c9433a8c755e1f3defd31a3e122b7ff0e5119667e5b90abbb187b8598ece21ca21e64
-
Filesize
1KB
MD54b5736f07f9d2e65a3c88fb54a5c8197
SHA1fa703e649119adf21503fbfd810fb4930de6af10
SHA2564f1e3e25d47c95cf5f21d0e093209ed83e0dea114af9419d8b54b1de5f599ed6
SHA51235dffbed4de32d258da3ceb30a9062dd30c70f3a303b0c05bfac88124344ff16a62b843698b15ce5055ef6a354b396697a7bfee29b11f676b1ae9b27e6317aab
-
Filesize
2KB
MD56c3dd3260d080b6f4965216b656c8274
SHA1da765bc7cc0c9de7e0b85faa85bf5310b867d137
SHA256744b3d051f1cfc4c2b17fbd53e217ce276df80162ed7a685724c28257d4753b1
SHA512ea3dc9218b6da3dac24bc98c21b316061f6b0a0889083a14665c2c8d57b8a3eef4a66cf2557f05b4701145508b28b6e78d9de8b7e5ac1a8c0038cc3bc799e41c
-
Filesize
2KB
MD51b6991825913e1a4af5cdeb24bd0a41a
SHA12a1dff9b5802b20fab4217b8678bf46ef6a5fa1c
SHA256d0295100c3e3ee2df2c136353dc079ffef84d4246cce3f43161801a611beb8ef
SHA51205ca4cb967531919cebadab2161b895520ff359b01d5563d9d92ca82d929503fedbcb09100366b62d59d17e51eff061e49abfd2346887c22ebcf3ed7b8aa4768
-
Filesize
2KB
MD52f2feaaf3900b634aefca0492876bc7c
SHA1063a946141be4b1f16ca6a7ba14ea9690972860a
SHA256e2a737c28f564856d0d4432795fdda77d3fa1b2e5ae7acf067d7e6f50082c725
SHA5120bac6fe60ae651ecd2bcfe3db17ddbbcd3b3a1114c2046191fa8cbf7f84177e857879aea048ef2ffd30e38f2dba7656467837315d189003660d9ad7e53e96693
-
Filesize
2KB
MD57d40712ec8e6f6ad2ec2dde1780388f6
SHA1980033986e7c211fcd8bb515d1c421b27c088b47
SHA256aa8dcd72d48e956f85146945d87af3f9ecba101fc5341d4c6ff6f9bce04b65cc
SHA5125be14cd67a6b33b93e4c4651d1379685c1b3b9a7e05aa34d055f7b22541c5b73c8b2702f2c9a6b1117a7d0834a708e74c2fe8f5c0666d3e660219e9a874d0d7f
-
Filesize
2KB
MD5820ee6d31f185b6b3569376c69076599
SHA1faa961d5ce99958a6149d1f33fb7937d597d78f2
SHA256703540842bac7faf76bf2fd368ad5533bd61f969e2fe49c3486850af13768d23
SHA5122ce6a563cea3a3f6114152c62d1c3380dfde18d1fe93c7406a727d189f845d01dbc08859b5b9d96dc77290fd4b52b9f12411a91294d5f086c0991ad28447a432
-
Filesize
1KB
MD506c57a5c8ddbc7b20756ddb273b1d5c3
SHA1f411f2a4b9c291bc5e73f2f88fbd83a033327e47
SHA256af7f16cea88fa15013d875f9b2e6708c8f44f69071e978257cc91f205749c117
SHA512ba0d45670948a2d4e5994297bbfdcb1e178e908a9e9c071a9984b4c9b7924b468280412611ddbeb7293fe6dc441aac05203ab69d1c262ec4a4260b1d1109df7d
-
Filesize
2KB
MD5e0559b9ce65b39f5636e8f0a5ce34831
SHA1c156d99d48d2ece3bae2b10b15fd28c5093efa5d
SHA256b8a50a3b62805d3b97a953e9c99277f1e57938ec70c95cd32e96d24a7ba85072
SHA512e8aaa8cfd10cc66612fe719ab63d00d3a73d804b82c6176b3a8ae2c6a54a04cba09e36833086ddc771ffffbcbe0a65fed92b7a9d0687be4df430f3a1cd7b9a19
-
Filesize
2KB
MD5616b46cf9276eab7383cb710623cd81e
SHA1c50de0184c2556ddc0030d4f17fafbe2ca6e9172
SHA256f2b7e975e3df29536dbdf2223643423dc984ccc0fda2f3751f2a98232cfceadd
SHA512d05bb5a63fa94bc57e2b8a041b0ef7dffbea541b448232f991adf714f2524d5bc328257a5c7609b380a4c3f4c50f870f88e6f3fb5767c183823055f9d8c6cd0a
-
Filesize
2KB
MD59e58e7c429f7d7634a7d41817926e6ba
SHA1a0c885973dda0fe669ff4ce5b41ddd6dff5e6196
SHA2561bdb78e5d1a29098fb4b1153e14d62f7ec728cb7aaf14acb82b933e086a6c193
SHA5122ef1baf77aefc5d4ef31c49823c5bdea02c624cd95f75edda9f21d23a487c3d0ae06a5fe45a6a7cf67cd6caeff083c2e6c57c0bf7aa6a3da8d6257f5344f8e78
-
Filesize
10KB
MD5c6194053b57b16412b85481169fff7be
SHA10a9fb4b2c02521193494621d920355e10162b637
SHA256548a30eebc900fbf34ec1237f56e1b013f907f59954c3511b933a3dbae670be2
SHA51259769c7534c6e4c6c4a80a86f371f25ced14dbb2f94f1042838ddf898fc1b09f2ef19a1656abb7f86b25cbe9c80fba7fcba3b27706082393969f075d5d0fa8a0
-
Filesize
10KB
MD568bf2257e15e92ee05b82c55670bb7ea
SHA1dd1c37ae43d0d781c9bf111bad71d5093e85ed85
SHA256486c881c0a0c69d11cfdebecb99fd6c4567d0558292460952e352fc3a9a21a82
SHA512c79ba336b0e91c081c7525d3f44c99b0ad8d669486deb576597eaeca7697ecc20184bcabfb3305c3d5fe713bf6987b8b8711a03eafa58f07a726e0ba36c3ce16
-
Filesize
10KB
MD59e1ee6d96295f59d7710d40bdea96ad2
SHA1145a69a5b70e7597d4b3679a2c887220328763d3
SHA2569996a4f260ac6a30c371bf72ce557125fc65c0cd10be420c5a54e9e1a642ba5b
SHA512925d20ea06af7f89b0aecaad020624279b41213e843493f1dace296da7824d5bf66f60576b0fdfda4b35f1a726289cf01006c9c563bd4062859b3b651aeedf27
-
Filesize
9KB
MD5a679dfbd24d8ea49b89fb6c4015d99b3
SHA1724ecc2bab14fb4f94d70ca87afac611ff194397
SHA256159eda518b419c8f361b4d47d3451ff61e4e30fd03792162066c26605c8524f6
SHA5125e7814b4fb797a6ced7bceb0c40ac0970b08b8084c73fa1b212196e95d23851c290104d94222ebec7e5b4c3cb0bd0a0e6ce74728e5dfeb6c288ed8004917bf63
-
Filesize
9KB
MD5ba4394699f13b1b6c743dcae9445ef61
SHA1558f5860719538391960be1c59fb94dc4678fe84
SHA2563ab802e7bc284dc7c0b9fee6b29731bba4970d21f8cca86a0fff4bc2626737cc
SHA512793499db6a1f540380ab8f6788f9f83292293641aed950ae1d5af51a1f8daeb3edbfa4d78a15bc5854adac321c9613dd037a0511ae4d10c4d19d73916c19a193
-
Filesize
9KB
MD53fbbaf09e07f4c5eb9bf4b6336e78946
SHA1b8f030b79ea66b56cb519c0a07e85827472ae3f6
SHA256bcad4000d1bd46dcdd4dc6bede1e0097c3d51a64266ab5ef53980495d44b8403
SHA512eef029c70080cfc0abcc976abdae0f8f251e3b424d662f694c6d101de41c2fe2390ddcd534a9bbb548aedf1028518700dae782d53e2a43e510dc5ca866e0e4ff
-
Filesize
10KB
MD5b2c0b870a8aa15d5ef2ebd2b91dc540b
SHA199f01f0b77e0d219f9f6ed7ddf164682cbddb06f
SHA25672f1f43fa4aaba852abae672d81d94ec6aa34cc1dfcd0730c5d4707b0d87e65b
SHA512f67a0127594cdc124854f38f8684cf7b1f40952297b2acd77002f94311817e6e7faa5fc468213ecc172941440882752f2ff7d32ea0c6c25393f965a77e2c030d
-
Filesize
10KB
MD5d758cc4e3fc072d0e30444e067bf5b3c
SHA170e966609f0ecc33d93b04cefe883cfa1c38386e
SHA2566f29bb556c657d28ebac1e4c4df0678a71729cc83df1bb9ca869d52036a11cae
SHA512a4db0ce77494c72421207a36fe2768abcf966132145307658d5b0d367126506d11ca3e214cb52bf4f2eb8e48cebe5b2eaebf325246800d49826332a2cc06e604
-
Filesize
9KB
MD56dda8c01d6d8709a9015be0fd4679f26
SHA1d87e53dd8e7c672234c2c423ea326609bfde7f22
SHA25678f12dbfb18cae0954717fc381e963cdc9bf3a7ef0c3fa20594bad8621f5b5de
SHA5128a46cab04180bf456555993b91096a68654fed964ca508f9c45731062f04db82d6a868fb077d56416aeab4f78ecfc609a71f2bec87d49d065c04743355ff0d0e
-
Filesize
9KB
MD5d649145d443ff5874f418093cef8160b
SHA16d8149e7d5c0da588ea39f4c7e572c08034a9576
SHA256bf06f5f12eb35d08913edd9a69906eba2acc2d4c9009cb710c0ccec2e3167392
SHA51257b0f7b1ff2854b0d2cab59e83dd50925584b3343b584f92ef2f0913fdc87c1244ba909e8f9716436c8387629a2a384c9947d0439514eedbb4662adc1894b594
-
Filesize
9KB
MD5bf1e15d0f97c7163ee74de97b5156378
SHA16d30ee5f71528b7cdc1401aa139deb8b0fd51768
SHA256041a7fbf042604d3bdbef7adf021493c0b2bb9f715c6984bb1b642e17fb7db03
SHA5129ce29e9c6d2f24441d4a565694dddb357bc8931c4dacf0db83eb9a0e6cf77c4e2c3b42fd92c6eab123da49fb3d4d28a2a2f229b1f92f65d96291a27147bb4a7a
-
Filesize
10KB
MD51ede70b9ca03b6755756c3bb53b1d32e
SHA193cce5ed33cf965a20485d9b84c8dfacbfb396b4
SHA25662a6946fc052a181625bbaa788f2325e966b2e54e3fbaca716a05b1ee1db6fe7
SHA512ec5c7201497a09988a8038cce51be627f1442514bea5faddd0b74660219b19fdda0615d89f93f5a4ad41e7a596767ce65fe4915fdce0ee0bad4bc757914ea107
-
Filesize
9KB
MD5f499b07241156a69caec1ab9d6bb36ab
SHA14b562a1069bfbf0ac9dca5ca5023bbc8743ba6ec
SHA256c365445959f578d0b91a0fa82983570690d834b8fcc17e317b4ca1521ba5cd1c
SHA512f9d9a64c7adbd656a51e5b9efbb7b1b548ef8d1f10f61878d33d1129dd419380ad49c2a505a61f35331becaf7b251a0f7e8ebb24ee51c07d70fe04136685a225
-
Filesize
10KB
MD531f4db128fdb5546fa2dfbdfbe257430
SHA148162bbccf44a62e6316880d427d465a2fb4c2f7
SHA2563205852b141dc130f5d89193b73e18c8b36a6470119a5c7957790e31b81293cd
SHA512cc5cac4a2d653b302604a3a7ec912c7a310fcbde20c049289d35cf5c5cd65efdfaec800f07f5dca6c782a3993e67ea0ad5928164f493ab5e01bba2803f41bc4b
-
Filesize
10KB
MD5e713e381789a027b1c5f091602034a0f
SHA15beeae0e64dadd77c5b3a4ee2c3befd2fb922741
SHA2563fef37f5399f195a3b0a0fb7981c88aeb4d0faa18185998762c5d0b157b7030d
SHA512f74531010a83183d3d0c6e7d7455da7bf3f14148ac0a2ca34c4a9e25226d1ca7550006863fbb03f89e7b941fee223c3663a6395bb7acd36ed931d20a44b3d3c3
-
Filesize
10KB
MD5e039221b8b09559918ef69c7e0cfb8d0
SHA19c93c35f4506947a8f5dacb15af5458669ba2b88
SHA256bc826725ca116a0256db7106984107bd26306317e4af6337a96189c7472f8c6a
SHA512cfbd74e635341956f6c597bddc704bcaab06c1d528298e4c553a261e4c1c945193f83918389ae4c8356b0d182a961c3d4acb63b45e5d5593487917900a5f8a8c
-
Filesize
10KB
MD5e4097109760d38ac53eaf597dd7b95f5
SHA13659d3c8760965e287d918db2a4ae81bd30c9437
SHA256abbf0507ca57d06c22fe368ce5c4ef3afbf2614cc1db8af6e81f3ced29311433
SHA512df997d877af58f1075ddc3b76688861a224e46445a857c5fcea70a5099a02f15d8e21163a805fa5f2d64b1b22e2beab65c9171d26c8ddfb1afa0054526d9fc90
-
Filesize
10KB
MD5f6d8be9697e0ca57833215e6270d8f65
SHA1c10a70391ca669a235a7166bb7cab1b68077f811
SHA256826d5d10ae3c51fc7bbf2e442e24ea59e019af3617d636d37d1ed174d990b177
SHA5124d313fbf954e4f10889ccc2ab16916fe467aad108e0318565d3411c5c4257d60c270f601460636e432ce700ca06e19749fe9157e4ca58155909314d8e3dfb703
-
Filesize
10KB
MD54863d32f3494772740849fecf4b28648
SHA1e747be120fd7883229651cc4d63dbc7126b1d295
SHA256205778f7eef3133e8ad1cbbc513d21665e58fa9b3d9a08bc008d4f552e85b422
SHA512d59aa600b60b3c95b63d0bf4a09500435b34ad6decaa593d0251549bf1c928b771b218f53240e12267dc59cb79a4adbc11fb57feb6f33dc565c1cf606c28028c
-
Filesize
10KB
MD5ac3d801dfc8d350632a329337cfc5ad0
SHA19f645ed02892259a135a7023d015a70427ea276e
SHA256a69d8c9b713495fe423815e979381e18f712a1b5799faa3a865fe692ea49eba4
SHA51297554393bc7198016123074438182d3dc8df1ff70516a672ca67d2a10e0c51c576f08e9496a0f8d2032c7051f8742f75111b23df8a3e3bedb20c0ec97ba31af5
-
Filesize
15KB
MD5ac9486da9ee2259df8e3ad70e428ad70
SHA17e91bddb72dbd05821e26158a4a3bdba08398d65
SHA2563c27761574c883efe73085c6f17745ae8a721d1b8154f91d8e53b3c21d1fbc4c
SHA51269a431fb5a7430c6a5b925f31cd6c279049df676d55aee62d3d6faf66e3bb6f5414929cd763edb5fd67c776c52cc3c400f43e10f7c8ed05b9dc2c427383c478b
-
Filesize
203KB
MD5c5ec59a93de8bcc8ee4a4d70fe7b3980
SHA11617f2ebe083d9bb48623ba2c92cdce00d6d5bbc
SHA256c598e9a2125b4789e04dd4906a2c4b5dea2a7bf1fc82a98ca018cd5e8b65e65d
SHA5123ef2ec9cc4ae1df34ef2f77403f079967e29361806894c17823a6bacac18a864ddf3f4ef39132b04b0db1e094a58b285ec179ce5e8b2cd872932991b9274263c
-
Filesize
203KB
MD5ca13f22b51da76fa20242247bac254b5
SHA187bbdd8632e38c5de711adb1f8b226b6a477fa3c
SHA2567049896c016028406fe7edb156704d416940e8524bb9892911a720982ba7a2b3
SHA51221be85face0fcb9ef76c58e6e987fd6f6c3d376a5691b86afb67157d02146f3f3b5d51856086d4627be20a7c6f7395a17312a3b1d0a8686843e7aeecc93874ab
-
Filesize
203KB
MD57725034ce209749d0f3a95be858dbbf4
SHA1e11346cee538d83f87bc51a25fadc37b946152e2
SHA256192cdd73b88fec56dbd5725f8c6e1accc8db5ee06a6fbc4efd314e66a111a225
SHA5122735e916b7ab2edf2dbbc24e6f3606c16623c7e532bb00545fbaf0049a537c7d099531b0322ee2b0e72ab078362da5c8629ef6d1eb12a38a15ff21bf930f970f
-
Filesize
203KB
MD552ea475b93e10f16ad0b0301f2c96d4e
SHA102e083bcfdd4592a242636e9dd96ee6e1e209cf8
SHA256a93813c79703f7163d383a0ff291385c173eb5cd1fc1ddb4091c7ef52dd86d96
SHA5121410d15ea9ea5cb716921b2dd4ed22c1eea0e9b46852724f6a652783b438ab4d007493c23d092124aea479c72a9fae84f1079b9e0d1c1129d0f55d6a058f8bfe
-
Filesize
5.5MB
MD524bcceca8b115ff5d0060b2d9def17c6
SHA1a06ba5c1f6d64c9a95627c4b2291806d2b5cd300
SHA256c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde
SHA512d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d
-
Filesize
280B
MD5273a0af94a42e95c97d6db396aaf3f66
SHA1496f2bf9bc378859cf5082cd0a527dfb70630d54
SHA256f3bd049ebcabee51985315767d323d174c8bbbef13af0e5e1da715391c6ceaf3
SHA512b32c1bb5679deebe5fcef8f59258f5b5ee7c4d5a2bb62ad10bdb78dbfc154579ca1cb03e89b08d5ba93bee0316b8a1eb3d21b1eb798b4f9635ecd3cc5e7597ba
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\68c9558b-b7e4-4345-8d89-84fd9be6b7b6.tmp
Filesize6KB
MD5bfd8f6bee8e4611b2e44b71af6dffe13
SHA13a76b12130bcb9766ae8dcf1cf3e396fa873696f
SHA25655fd7fa0ea92c26304bf56f1009382f3b9f6b880953e22b5b226be60aa78e028
SHA512bed55c79ca8b982ac1130708a0236b7db8464cd5d572e36e9e22913ce5be3b11fd63c8d902fefe94f2eb859f3befb1cc58d68d428b2e2944f2916b255a772a36
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5825d327b0e8f9738f03c443a39f66e3e
SHA17c2013cd0d167a5e142c6ef20deebc856cde0791
SHA25678aada01d5a41fb84acbb8b6e9a33642bac34f70b8e99a4f23cda6bda81163f8
SHA51258bea98fc2e097ba3625cbc259c1c08a23d61660abd668aa4ceddd786080d34761cd5da7c8fd57e08b37a1f4974f25de3852be18181aa99809b95bb4825d0c98
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d874.TMP
Filesize48B
MD56e64e338ba76ab6dc3eb707c9fda94f1
SHA17e58f8f6e1b8b83b3624e20ad944e86feb0c4387
SHA2568602c4a00256907b3ecdf3ebfd85f13747a089cbf875f059d7da99d71f940609
SHA5128a210d33101c3ac12d19ba530765570b6f9ea9d9210ea8e97723a79764a9f1fe6e7598f3101cfd0457da72c9150a845cabc4a5a844cf02e72003a8a66d4641a3
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize1KB
MD5ac9c0fa738eb5359daa1811da55b37c7
SHA154b33e55695b63ad3a71653784313ad570bf7c54
SHA2566a25a43113c28b839143ba19ccb3897f465dfc8f91bed288072baa12adc803cc
SHA512c91729a6a6db432eedc643f1f94af8b01965ba68cf84d5e12fe5374b40ca60e366f966b0d6a6f5061c5c644e8fd62d2c1d431aa6ccdcc396a4465b4854316284
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize1KB
MD5e6a03497295fdf420d71347594260e43
SHA1a662f22b3442e96b64f97e4152a846c33dc64b7d
SHA2565ea9005df87384677acd5f6b31fc48d44ef640844cc1b2cc86991822a9e49035
SHA5121e91cf1d64a325a51af0ef41ae502337e94285189471b74a05647c8f9862c515abaa994cfa98e2c6d3c26f5672c6dbb5bde37dafa4467703e9fee8c1c72c7f17
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a81d4.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD577d94757f71ec0a2ff585c9651e78473
SHA1cdba5e920d169b0595c9646a3924a23a48493b40
SHA25644af12685f7cb1ad052b87be58f0b2b228eadf7b1912a7b43ec15075c6112664
SHA512a784baef2677af11cd97b494181ef31dbc93f1bfc9f147a3f15899b4c9364e714f83b796910428c9d93b1dee44fc4b506d25cb7af8859a6202a4bba4a4895dca
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5e4bda83e9bd7c919c63b5d7f0f68d43e
SHA19afa3898cee6b5e51c8f16b1c0dd5dbd9017e7c7
SHA256c6e530aaa33f9448c5dea97eba8ebce18f75d331da1cdd64bcce7f4d233589d2
SHA512a9750b65ea0fd216acbee6eb385d3a8b9755c04b6f5dd2e5b25f8b06db489c5d4f0a9d3c7493b6370f1dc3668654c88b0a8216b448c15cccc878166fa7a5250b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD54d011b35b36f53db51ed757e4e285662
SHA11b2bda338ad33615c4797bde30089c971cfa0ef5
SHA256424e9518501b25d9c02964cc2ed75fd14be44af39281a2b454c1e9236b6818d2
SHA512352cb04e061392a1b6ff7ff0cfd97a3d0c1b06bfde707e8dca2e4316c6fa0bb330869e126c8b8d3542154c94e4a7cc09a65ae2cc1f0a22b8e21947d42ea65e36
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5e9977d922a3ac29a3df454beffb140eb
SHA183cefe270328d2eb201fadc738c358cc6e9c58af
SHA256e3b1c9535351ae01fd9aef69bbb0a5c40ed7112fadb8e40eabdc22bd28fd4790
SHA5129ce1e3f4a80cea6c6ea8ace0ac9faeaeaae92ec115c2f16afb74e7077e5304955ab133b1e6161905d65320563cde16ea1ee98058b71cf929370304ccfb39ef27
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5c74a73d11d686ea4bc56ef6a9262f727
SHA154a118fa28df9fefb760bbe4e6106c3b5882caf0
SHA2562a8cedec2e9f39093eee0287365bfa3f48754a1e91bf733ff9389b7587035189
SHA512251c35ef94e9c2cd899056f9d4550459feff9096025e7f325cd7f79f886018d967ea7f2ce628f823382356643564fb1b4cb1a08e3b73c998b0d91dfbda57509e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD515c436e6dbf9d409622d7a0a3ced9605
SHA185626101bd70ba51a06fa68901b09e1c50a1edea
SHA25646f7db48655b6df1692528e0cdc817ef70c36bd9ffa1e4c5f08a3076dbaf3fa4
SHA5129445bbc744eb584df6ec2d7083324ecf35bd0d42a83573f01e2760bd459d7ac925200de069d2e9a1009c14c8a7c76b173e4d3e2965a621b71d6a60fddfa5f449
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD52eaebbf86d21487024e2e5baca3eb3cd
SHA12b672970e7688e8ff999a6509675a40d8e9f4f74
SHA2563fcd9238f5214f04eeda050be1678be45acbdcbf1a5aa1649e1bf0acf06f67a0
SHA5126e358447771977047a65bace56839d00220107d0c9877337e61f12901d04a275acc6f9dc25df76fb0168f96cf7ed4dfc6cc86abf01acc88f7d41a09f7dfe08f0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59c21d.TMP
Filesize1KB
MD55ac19505610029b2283dca34e7b8ca1b
SHA1bed220930440a7effd255a19b7dcdcb594559be4
SHA256b9e0669448bbaa3ac20242c514b560e36dc4a83477dc6fe9a4bf5d5dc1d4b678
SHA51212e49631991bb486fa79ad6facde4a7dd965087fb0bbb1a018fa354583bde787e4c7379d0dbafe9cdfa5fabf1b84f431d0a965345c1cb117c7c615fd97f990f8
-
Filesize
6KB
MD5cd6c69baa4f4a5de0878146c9d17d352
SHA1e957937810b7879a12512da63f0aa8979a839876
SHA256bc1e737133b40aa02509b8f85fb8c91999ea3231f82f81b4d06466998bc25640
SHA512d1af9bf557a0036f7fcde95ef390d00cfb85bd532a4e8bf34967a1ffdec9d3ccbeb1a3abade976e288d3da8bc0ba7a788255421321101e0931910005c5428da8
-
Filesize
6KB
MD56ee4d6f4d05711dcc9f390bd94ae684d
SHA1a35af162f44fe80363291f2cb122cc1e6d60b47e
SHA2567425f15b30fd2d2b5fb8417ac4ebfe60df83f83705dff381431e24bab9858e58
SHA512207224bc7c81ef3fa801d4dff303fde02b0267f9237adb02a5967cc79a48ed348c521ac29d8649313a19498f0a6287f34c0eb3809fb44d5d5cdaa643b0fc4bcc
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
2KB
MD53df5247f4f8a7595167e14d629248b0e
SHA1a524d5373825711750edc9b1c23209555a871cda
SHA2567fe8aa0bb7960a351b14d8215b36a7d6f3cfc846ec21103b2767c68229b9ccf3
SHA512fe249d4de0fc2d71ac352e823b8e060f3ded6dfc58a67703d339dd374a53b39eac41c8d02f49651f4cefe1bc207afd065e772d8b953e53d68902b2cc9186dd95
-
Filesize
15KB
MD59a1cf6c81cd0fdf77375c1ffbdfe3b7a
SHA19986ede4cf0381aca96b3cd3ff8c45a883cc8336
SHA25673c5d7a2ba06f3f2c67699ed57a395673ad697b9e0d35a4b7c8f65bf53a0bb72
SHA512d72120b30c7796491225a62e796d5c1c4aab6e12257213686215091d910a32a0b83b509bd65623d9cff9b3ad578aa28a9cfdf9cafd7f0afba7a95991073d9918
-
Filesize
1KB
MD5f706483b5b2c27f9c9241284ed6d708f
SHA115acd85239d355243b0d472988b1f3674fd29e42
SHA25666e5ce72fbceb9319ffe5a92c70af731957f548a8c01f29ae06d768a482f403e
SHA51216da6a311249d0cace2a4261f271b308104bac0b57cd9c73f9a8897747920a34666bcaac7ea4bf75f856d1dfe46c20aab74b5b1484075bf473427d776fdd3cda
-
Filesize
3KB
MD5016fcde3b075d4e8c3c45319959e2117
SHA1b413357d8a11c9d095a85909233a69a95bf3065b
SHA256a4b3a800c357b3200ac14a380b4e6fa9f456eec852211085a9434d0a88b7c294
SHA512373cd8780b3fead9c68930dbf18c12667b9c45314ef5ae743f913900f2ec476295d73c2064f584f91c16c568273c9a6878091b0758388baf03a5963ce663d71e
-
Filesize
18KB
MD509d1a7ef84cf7bfe712930264c2bab64
SHA1947117428a811606ae062fc78f151541efeaa65b
SHA2565c70640bdb7b7966aaadf391cdfc32a98bf1e03129b8ebf96f8ba04f7e77d253
SHA5129b8b86b869af1c841ccd82ab5f9bc7e95cffc9ac417d8115dd52ff46adae5b846e5e35e09c466b183d4b8881686c4299a55db8d7e3eab4525ee454fc171a73fa
-
Filesize
17KB
MD5b741a7c538f390226da49ee500852fbf
SHA16bab1a9e9658689962b13b23c5016aba3b35adad
SHA256f53580eda337f4138de442a6c57c259aacae327a324850ea1e1c229295333714
SHA5125c2bf53486003cd28bfd457880f8e10e71c9d360adacc1b504c496131c3663a603c64f8be883e80a12cda01872502e1d38984d91593804032000ac4a83cba268
-
Filesize
1KB
MD503f5e0c73e6bab2ab12068ade5177bfb
SHA151c7e1594399ca44c9cedd1edeca4ee55caca0c1
SHA2560d0bce8b894e02fa98e8af9038b121447f0c6d1485294d513f0b0576d6158c96
SHA512a352ae5dd773703bc3a1ac41252c1507d84f5f1fed84c421f9705044300c3f24e9732566f4f3e210001408e260911ad48b6b4559b2451fd5caed7aa4fd43d91e
-
Filesize
278KB
MD5981a9155cad975103b6a26acef33a866
SHA11965290a94d172c4def1ac7199736c26dccca33e
SHA256971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d
SHA5122d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb
Filesize7KB
MD5df3d937079b894c891f9b0b741874928
SHA1ed93fc386807b3a28fcc7988a88ae4741bfe1b15
SHA256c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4
SHA5125728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb
Filesize11KB
MD5d43d041e531dc757a69a90cb657ef437
SHA109138b427565bc276cfd3ba9f59b0c8bad78e91d
SHA2569431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb
SHA512476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.54\Filtering Rules
Filesize1.8MB
MD5a97ea939d1b6d363d1a41c4ab55b9ecb
SHA13669e6477eddf2521e874269769b69b042620332
SHA25697115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f
SHA512399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.54\LICENSE
Filesize24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\TrustTokenKeyCommitments\2024.8.31.1\keys.json
Filesize6KB
MD568caa2bc2d6308107c7a6356939ea839
SHA18878538976f72b3eb8d1b8c81c508e35f8637c1b
SHA256517d54d6dd4e7cd61f66d239235bafdac7fce8ba694135b4a971b0894452691b
SHA51200277e1feef1c883787ffc49859aebd826dae277614d80a830257f571869b77a899955f58f07ce7e78ae297696cf05288835de71fc86d35f5294da9265f357c4
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
280B
MD5b2862a4dad666a7da9e63c2390b0a069
SHA197d725247f8111dff366c6aaf8bd6075a4a92f65
SHA25624e84b232b1c7f69b4256a87b0c1e4c0fcac89cbf9687f73bd654bdc26841932
SHA512535abbd273fb4562ee64dee7df63f1a5d5117ea24a4160a46a243256befc420f10ce03b28a873242e6fa4fe7ee9cdbdb20ad72229db4217ec47f1a5edb0e257b
-
Filesize
2KB
MD5f5c93c471485f4b9ab45260518c30267
SHA1ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA2569aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
SHA512e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
-
Filesize
116B
MD51b8cb66d14eda680a0916ab039676df7
SHA1128affd74315d1efd26563efbfbaca2ac1c18143
SHA256348c0228163b6c9137b2d3f77f9d302bb790241e1216e44d0f8a1cd46d44863c
SHA512ab2250a93b8ec1110bcb7f45009d5715c5a3a39459d6deead2fbc7d1477e03e2383c37741772e4a6f8c6133f8a79fbabc5759ff9f44585af6659f9bb46fbe5d6
-
Filesize
102B
MD58062e1b9705b274fd46fcd2dd53efc81
SHA161912082d21780e22403555a43408c9a6cafc59a
SHA2562f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35
SHA51298609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
179B
MD5273755bb7d5cc315c91f47cab6d88db9
SHA1c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA2560e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
SHA5120e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
-
Filesize
76B
MD5ba25fcf816a017558d3434583e9746b8
SHA1be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA2560d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA5123763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
-
Filesize
79B
MD548ce6b89cefbd9d4360134c30a88642d
SHA1b23e8b41f46d9a4f4c77ed094c951582ffad8336
SHA2567fa42296578dfe11aa64a821f3d9ba5e4c8339450614d9c476f7796a4480c375
SHA512f7c03a0d1fd3995888ece2bd9aee76af03efd8f6e9778b74fc716f60db135f81e93e9b63273e51f36abf88ec903227bb0aad8324e262108badeffcab05d854f6