Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/09/2024, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
BootStrapper.exe
Resource
win11-20240802-en
General
-
Target
BootStrapper.exe
-
Size
149KB
-
MD5
dd742c42283806d63458be56a64ea254
-
SHA1
bb252ef14c278321b1a6f474a686e224269dd457
-
SHA256
cf4afbbe58f7a6d7f1888b0a0e2da4f57da6d3ea329dc577c230b806f74aba26
-
SHA512
7b3a2ca8518f5cd27de93733bf20958053fac4bcd00039f8f73979fcf8fc2e6393dcc7f10bed0971cac15d090375b7292ad9fcc425e29687b04f8b033b197121
-
SSDEEP
3072:+czkitvo4BpYN/6mBPry8TXROLdW5m4mURp9OOGF0kmGwY:+A4NCmBPry/N2NOOInw
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 18 IoCs
pid Process 2208 FluxTeam.exe 4800 RobloxPlayerInstaller.exe 2536 MicrosoftEdgeWebview2Setup.exe 5484 MicrosoftEdgeUpdate.exe 5772 MicrosoftEdgeUpdate.exe 4664 MicrosoftEdgeUpdate.exe 724 MicrosoftEdgeUpdateComRegisterShell64.exe 5416 MicrosoftEdgeUpdateComRegisterShell64.exe 2968 MicrosoftEdgeUpdateComRegisterShell64.exe 916 MicrosoftEdgeUpdate.exe 400 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 128 MicrosoftEdgeUpdate.exe 2592 MicrosoftEdge_X64_128.0.2739.54.exe 5884 setup.exe 2352 setup.exe 2344 MicrosoftEdgeUpdate.exe 2304 RobloxPlayerBeta.exe -
Loads dropped DLL 21 IoCs
pid Process 2208 FluxTeam.exe 2208 FluxTeam.exe 2208 FluxTeam.exe 2208 FluxTeam.exe 5484 MicrosoftEdgeUpdate.exe 5772 MicrosoftEdgeUpdate.exe 4664 MicrosoftEdgeUpdate.exe 724 MicrosoftEdgeUpdateComRegisterShell64.exe 4664 MicrosoftEdgeUpdate.exe 5416 MicrosoftEdgeUpdateComRegisterShell64.exe 4664 MicrosoftEdgeUpdate.exe 2968 MicrosoftEdgeUpdateComRegisterShell64.exe 4664 MicrosoftEdgeUpdate.exe 916 MicrosoftEdgeUpdate.exe 400 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 400 MicrosoftEdgeUpdate.exe 128 MicrosoftEdgeUpdate.exe 2344 MicrosoftEdgeUpdate.exe 2304 RobloxPlayerBeta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 22 raw.githubusercontent.com 22 pastebin.com 87 raw.githubusercontent.com 93 pastebin.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 129 api.ipify.org -
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2304 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe 2304 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\particles\fire_sparks_main.dds RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\DefaultController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\Connecting.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\fonts\BuilderSans-Medium.otf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_loop.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\Close.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Settings\Help\AButtonDark.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\models\AvatarCompatibilityPreviewer\headPreview.rbxm RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\DeveloperFramework\UIOff_light.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\XboxController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\graphic\Auth\reversevignette.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\msedgeupdateres_eu.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\collapsibleArrowDown.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AvatarCompatibilityPreviewer\test.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\MaterialGenerator\Materials\Pavement.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChatV2\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\identity_proxy\dev.identity_helper.exe.manifest setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\advancedMoveResize.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\TextureViewer\refresh_dark_theme.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\animation_editor_blue.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Emotes\Small\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Menu\rectBackground.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\PlayerList\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\MicLight\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\Locales\kk.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\Button_Dopesheet_Darkmode.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_lock.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\DeveloperStorybook\Banner.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ViewSelector\left_hover.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\dropdown\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-back-android.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Trust Protection Lists\Sigma\Analytics setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\9SliceEditor\Dragger2Right.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\StudioSharedUI\spawn_withoutbg_24.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-alert.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChatV2\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\MEIPreload\manifest.json setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_control_reverseplay.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\MenuBar\icon__backpack.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\PlayStationController\Thumbstick2.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\XboxController\DPadLeft.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\TopBar\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\DefaultController\ButtonL1.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-48x48-dotted.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Locales\fr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\Locales\km.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\loading\loadingvignette.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\MicLight\Unmuted80.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\fonts\Guru-Regular.otf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\img_timetag_border.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\PivotEditor\SelectedPivot.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\dropdown_arrow.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\category\ic-popular.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\msedge_wer.dll setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\TerrainEditor\volcano.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-notification.png RobloxPlayerInstaller.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\msedge_installer.log setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Windows\SystemTemp\81708b68-25e7-422e-93a1-44d0aae604f1.tmp setup.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier msedge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FluxTeam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 916 MicrosoftEdgeUpdate.exe 128 MicrosoftEdgeUpdate.exe 2344 MicrosoftEdgeUpdate.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133698386225319997" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ad321ed0d27f48b2\\RobloxPlayerBeta.exe" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\FluxTeamB.zip:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 497138.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 3908 msedge.exe 3908 msedge.exe 3196 msedge.exe 3196 msedge.exe 4896 identity_helper.exe 4896 identity_helper.exe 5480 msedge.exe 5480 msedge.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 1568 msedge.exe 5612 msedge.exe 5612 msedge.exe 6132 msedge.exe 6132 msedge.exe 5140 msedge.exe 5140 msedge.exe 5140 msedge.exe 5140 msedge.exe 4800 RobloxPlayerInstaller.exe 4800 RobloxPlayerInstaller.exe 5484 MicrosoftEdgeUpdate.exe 5484 MicrosoftEdgeUpdate.exe 5484 MicrosoftEdgeUpdate.exe 5484 MicrosoftEdgeUpdate.exe 5484 MicrosoftEdgeUpdate.exe 5484 MicrosoftEdgeUpdate.exe 2304 RobloxPlayerBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe Token: SeShutdownPrivilege 1576 chrome.exe Token: SeCreatePagefilePrivilege 1576 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4244 BootStrapper.exe 4896 identity_helper.exe 4800 RobloxPlayerInstaller.exe 2536 MicrosoftEdgeWebview2Setup.exe 5484 MicrosoftEdgeUpdate.exe 5772 MicrosoftEdgeUpdate.exe 4664 MicrosoftEdgeUpdate.exe 916 MicrosoftEdgeUpdate.exe 400 MicrosoftEdgeUpdate.exe 2304 RobloxPlayerBeta.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2304 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 3192 1576 chrome.exe 85 PID 1576 wrote to memory of 3192 1576 chrome.exe 85 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 4604 1576 chrome.exe 86 PID 1576 wrote to memory of 1980 1576 chrome.exe 87 PID 1576 wrote to memory of 1980 1576 chrome.exe 87 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88 PID 1576 wrote to memory of 3892 1576 chrome.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"1⤵PID:4112
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8608ecc40,0x7ff8608ecc4c,0x7ff8608ecc582⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1836 /prefetch:22⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2100 /prefetch:32⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2172 /prefetch:82⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3112 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4372,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4856 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4964 /prefetch:82⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4564,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5112,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4268,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4520,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5304,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3228,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5448,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3260,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5684 /prefetch:82⤵
- NTFS ADS
PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5056,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3276 /prefetch:82⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5208,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4940,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4592 /prefetch:82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3144
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4808
-
C:\Users\Admin\Downloads\FluxTeamB\FluxTeamB\BootStrapper.exe"C:\Users\Admin\Downloads\FluxTeamB\FluxTeamB\BootStrapper.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4244 -
C:\FluxTeam\FluxTeam\FluxTeam.exe"C:\FluxTeam\FluxTeam\FluxTeam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-hub.net/336183/fluxteamexecuter3⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff85c2b3cb8,0x7ff85c2b3cc8,0x7ff85c2b3cd84⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:24⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:84⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:14⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:14⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:14⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:14⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:14⤵PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:14⤵PID:5876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:14⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:14⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:14⤵PID:724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:14⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:14⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:14⤵PID:5688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:14⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:14⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6704 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6860 /prefetch:84⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6876 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:5612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:14⤵PID:5612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:14⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7172 /prefetch:84⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:84⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:6132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7396 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4800 -
C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2536 -
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5484 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5772
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4664 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:724
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5416
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2968
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3RjgzQzM5Qi1BNTAxLTQyOEEtQTk1Ni1FNzRBRUVBRkEyMjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3NzIxMzAyNzIiIGluc3RhbGxfdGltZV9tcz0iNjI2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:916
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{05905CD1-9733-4C68-BDC4-3C10F49B29A6}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:400
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 05⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:2304
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:14⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:14⤵PID:5148
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-hub.net/336183/fluxteamexecuter3⤵PID:3028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x104,0x12c,0x7ff85c2b3cb8,0x7ff85c2b3cc8,0x7ff85c2b3cd84⤵PID:3036
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5528
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1840 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRjYxRUQ2OS0wNjJFLTQ4MjMtQTcxRC02NkUxODFERUVCQjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3NzU5MTYwODAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:128
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:2592 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5884 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.54 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7acdf06d8,0x7ff7acdf06e4,0x7ff7acdf06f04⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2352
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNjA3N0EwRC04NUIxLTQyRkItQjg5Ny1DQTQ5Q0JEQzlBNkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjguMC4yNzM5LjU0IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NzkwMDkwNTM1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjc5MDA5MDUzNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMDU0NTMxOTgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzZlMjFkZjA5LWQ5MDktNDU3NS04ZTI0LWQ5NDU5MDllNThkZj9QMT0xNzI1OTcwMDI4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRhRHhuaWVUVHJQY29NUXgxeTNDT1BzUGdWJTJmQlNMUDJONVpuNVNsMFpZVVU5ZHhmOUNBYTRoS3FTSGNqaktSdW1TSWxWWXBnOXNBNFUycEtxS0FjV1ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3OTI4NjQiIHRvdGFsPSIxNzM3OTI4NjQiIGRvd25sb2FkX3RpbWVfbXM9IjI1MzQwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzEwNTU2NzcwNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMTk1MTgwOTciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1NjIxNzQzOTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5NDkiIGRvd25sb2FkX3RpbWVfbXM9IjMxNTQ4IiBkb3dubG9hZGVkPSIxNzM3OTI4NjQiIHRvdGFsPSIxNzM3OTI4NjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MjY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD5b6e04da5eede61b18938203e5c46a5d8
SHA1a7d3bad06862f78635a78e6298f0a0507234bcbe
SHA25636fd27ba0feb91f99c1fc416d5314f5b52f2173615037064da6106c53233a4b6
SHA5129f432c830c82ac1a4e3ae2a7d975060be21209bafad82243a86e52cda3ce5f296abdf93bd727f263bae7f9f64cae87ce3c354670726f5e0a6256cf77069d2c16
-
Filesize
184B
MD513ff21470b63470978e08e4933eb8e56
SHA13fa7077272c55e85141236d90d302975e3d14b2e
SHA25616286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a
SHA51256d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8
-
Filesize
3.8MB
MD5846a7e5993282e220b26b82e7a39a40a
SHA1e37fe15d2fb33753c042e16d1d008d412e7d99e7
SHA2565613682635617cd43720807448f69b10090932e8571a358b92361d2a2c7a4597
SHA512fcf608391d7f8406bb538aca0e9dafb804cceda6c590dcd98d684645bc3bfc0c1d43455a74854988b4b30e56a68ef8be886e92e993f1504b49f0e4baa1c0cc0b
-
Filesize
1.3MB
MD5750c58af2e56b6addecffcf152520ab8
SHA114995e7f1d12498606d9d209d78d55fe6fd87802
SHA25627c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
SHA5122179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
-
Filesize
7B
MD5260ca9dd8a4577fc00b7bd5810298076
SHA153a5687cb26dc41f2ab4033e97e13adefd3740d6
SHA256aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
SHA51251e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
-
Filesize
6.6MB
MD5179438f9d59850f9810b884efaae32f6
SHA163d91c28509aca46120cebaf93903320943c9b16
SHA256b03811daebe54e9832cd00a574b3ffc52119f7275d8f56c322c199215c5a0b7f
SHA512822ef4662274de1d8f8e0eefa98878889a7747223d769584ddb898a5a8d4b75602a01719e9729490ef5dc0a7fef5f789d0d76afa1a3002fac60aebd59ec29f20
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
5.5MB
MD524bcceca8b115ff5d0060b2d9def17c6
SHA1a06ba5c1f6d64c9a95627c4b2291806d2b5cd300
SHA256c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde
SHA512d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d
-
C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
14KB
MD5a7b323ff78530599ef1d1f2035290af2
SHA1a4c7a628906f0ca45d7196f6c62f42b2defd7ac0
SHA25603b843e98a23f4d9025aab8c5ebeeaaba6cd7511ed3b2dd0fe6f2770fdbdb596
SHA512e3fa82c5c9cebaa9cf84be1753ec7e07fd9c3f76ccc2fb6279f272d6bf9543572399f97a1de0a821b7befe762bb92787c400543a119d1e32421c1c3c930494d7
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31e774db-5f0a-43cd-a03b-42580144c165.tmp
Filesize10KB
MD5ea1c768e7be5102cb05b783b050eb091
SHA1fff49654e0b084b597cc9c95aaac679bf01819fa
SHA256de9a7844a3a7901cba02c12104cb53725aa94b8c23b064262cf6f7b964e51419
SHA512909f45dad8e8d355435ac246bf1057570a5cf13db266d1aaebd88168a66dc6e5325febf78f6c2bc2eeee29db07d358c0130151564f69738c4782560941a81f8b
-
Filesize
649B
MD555efe65492d212ff5919f009589120cb
SHA19cf890e4e2d5631b614e11fae1c25692d9942bf7
SHA256ed15f9f58f860efcb6ae104c21cf9d31e533c2f1b5491458c7f09a80c6e9bec3
SHA5122311878bb26835492d2efbaa8f09a99a2629734898787f88dc613a040cbb2cc7ff1419a6e89497f0d1a3cff27b7a0e5c4435dc0b428f0d6e7b3aa509661c4dd6
-
Filesize
51KB
MD5baa5818fd1e51dba8b6e55992e5358be
SHA130ccb7eab50b4623eac05ae86c1b38b6957fe8fc
SHA256f21051e384e080852e23555a0b3de7ca37f5786ccb7b30ab197c3ea5f0a1bb93
SHA51202ab1e65a9d93396f07c62de811b79f0ee1d7826808050f0d451388420f77e6f33de56eefb4df5779bcaf952aabfd192ef69d6bcd50e6f6e8b6e4a3a1562577e
-
Filesize
3KB
MD5edfcb2ab656ba6a7bd36d40a1a10c43b
SHA1a363862baec978f01ecf9f8b42dff75a0883040d
SHA2569d60abd2e08f1ddbaf44789dd67176790c1b1dfdee4edcecd7c9d601a16cef13
SHA5122053e6172fe3880c6d824904dc43c1e7f8f9295c18c0ad31c779c8608a072e4af9efbc0d8322b4f09e02cd2f4a3c841d19d0243a3950adc8496f34ee0f0701c0
-
Filesize
1KB
MD5b9a7bf2ec8e4ad59d4b3c1215ff75bde
SHA1931d1e883337bfbea5839f5a37362fb0b6b4ce2e
SHA256a81b87911c9ec1b8ade0013dbe3429a988dc85f86a4fc07a84c5441784978810
SHA512439f12a8557edfd1d48d68d2e1023a493237662dd6596fd28f0d15a703ad213a01e08208fa2cca53b789ab40fcfea28fda2b5820ed871067f4b6fe3cf425ee54
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\32747b4d-97ec-4d8f-b6bb-62fb7a0f2ebf.tmp
Filesize9KB
MD51e3ba500e2a61075f0b9b953e5acac34
SHA18967597129991e9c1ecfea69c683c35ec08b063a
SHA2562b54917e50d6fd4bee2c2c05885c8b14f4558ba35ae9ec097e68f8d9217e64d6
SHA5129f0206d9cf7c719aa1b5891593d913a06497b8bd8c746b7a152f3490df6ab1c45fdc4afaf3c0217f1970c1e892d948babd2fa654cf5a811d08c7ad92c220757e
-
Filesize
10KB
MD572022557a659e17b68226ffc6b5d030d
SHA108039f53b82b64221a3bd58d8267940716633926
SHA256c9d07e6805b7d964fe8f6590dd41ad7d3ce91f614e1b3a8ff401d01564ece1c9
SHA5121b2e67ee709258b3d9310d91b6f05c3ba2b3bc6068a7c984a33848aa0f683391fae91ab3ca17f0aa701715e73ac9401162e73964f22b53bd006428f4ff2712f3
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5422e2caa6236f14fec4fb90abfa9bcf6
SHA16604c9fa5cd122cfad413a3d86b2012252a978d3
SHA256bd70728f26486eb5801c0fb17b918de04c477121ad994e3f3e1519a764e910ac
SHA5126cf843fb26ae2e56216be5dea76bdfec13a98fa50ddc81a8864cb7e91df367c9d49d94ca57dd8922b806105f766f4a5aa0360e824da7b9b8d594e58308863bc1
-
Filesize
1KB
MD53936189c6b75a0251778d0b80239a22a
SHA19c269f9df1c23703219c8087f65db64ecff4041c
SHA2567bcd1568e3f0be455ce7861fbd1c65f80d86cb78ea319083762e27a04373c5df
SHA5125c6175c2f84b41fdfcd6d5b5c113129c7563832d01b658eca29df1cd94439c4dabf6e24f546e8a497cde60ecda45a5df6b92ea3d284c930aa994f2d3a3b49b03
-
Filesize
356B
MD51a97f375ccadf0a25963a9a27f6a8e80
SHA1c6b682da7e9e247d381a2cc94f9537525ff7beb5
SHA256b88c04e95c853ed40d9b747a859fdb4e891870fc9f021a34d108d7dac81a98d4
SHA512ce103b68d2f570498f63ddd48d21e47c91494e74ae839a528dbce40b3a653540b51668c227aeef6b5c27d54fdbf232e9048215b54a278b446fd4588100169dc8
-
Filesize
9KB
MD5b7b6a994689de468cdd26e5ef22a4ce4
SHA1c2e2ba195713afb7198a523e0ecf94e840d00046
SHA256bd7deb1bf5a337e777e40ac413665d6248554ffdb62f885cea332bc7e91e720b
SHA512fa5190494b077b769ef4f52f31f708558dc1311d2c3783139575e4f097402cea2692c58e70c5aafef01bc94882490dd8eda8412dcc5588fe5aceea701c3b036a
-
Filesize
9KB
MD5cf3b083ed33646ea0a1d844100ea36cb
SHA1be203cfeff7626c25deaa9369acce9c37834065d
SHA256af3623f76a82dacdfc5d703c4d27c412e9f7dd421b41e7e86e1b5d309897db11
SHA512f523e6ab3a283afbc443233a019fa3fe26cdf4760d4740b6747d509e0e3461a6b749d3feee4940d5fa4e185cfbb381cbccae7db4dfa1b2f669540bae3788ba06
-
Filesize
10KB
MD54f7574bb89f01486beeea2d0ea46e52e
SHA17ddc85cd1fd7f647fa30fd581ef2d3443df50f38
SHA2565727835488872b65c851922fd2cd5e89354cd08fe426be6076c7103b887b589c
SHA512e823e297d2b6b81c8c2645d2c3900d5b756c26a2f12a0ea2d35ba9504be662febdd1754c4429c84f402c4505546ff034b7a8678752b8bbb8302ee5c7f6b41d54
-
Filesize
10KB
MD5fd61eef8fdec0e7e01bc2cd62fcb31ec
SHA1bb1af80e89c7b53b9017b86a591224c1f72b2ae6
SHA256bb220359456b946acc4699dbf114de286c301014938942d0f1bfdf0cdf4aaf64
SHA51208397d616e26e10295c4146392b85d80fe112c1d7d3521a25de66ee795172ad32c3e755ab7b77f76fe0b080d59c1d329df473318aa6f36460efb61e5706840b4
-
Filesize
10KB
MD5abb33370d5291dc1abf2cd3caa12f406
SHA194c97a0d33f45d0f7d909d919e4cac8af9498ab6
SHA2565b31b2ed04c7d11875df189c8a9ffd52cc4405ca3d136cd13eebf2d1a23d3077
SHA51264098d2d6cc00ae992ff6bfae51c4e8e0c8baf306b3c68168d811a17ad4719b04599d9102e55dd83f509367d9c44be3c61dff0bdd38ce1e17316f0354e7612d0
-
Filesize
10KB
MD5ab1f2e9d8b79ffc6ea37a5294b7896bb
SHA174c189bb5e08a74e190837adee6439251ee84938
SHA256bc295b5b5b87d9e00c47649b2fb13aaf5634c5f12593ea0d955733a254c2b8e9
SHA51268d7979239168ec766d9c6d49ac395d3571629c5ee3f410f53e7d8f78b023680ca54c18e533ddffc31650b9abd04aed23e6088116daf3a82de64163719f8a110
-
Filesize
10KB
MD579e5b0ef8e931a4b7f26795b1ba3c3f0
SHA1297d30f3f738652939f5a531acc0e1ff85c545de
SHA25652a8232c69110b7829e1b82020a73fbbeb94019aadc8505b96040f4e5ca32159
SHA512c6fc518adbd8f673fa5582ebc79eeada1888bcee567cdcb4c112512dbda55eb5a84ca1499de9167ceb3825197303e5726a17b6138bdbecccccf1a165a6a48d9c
-
Filesize
10KB
MD5dd1ae3fecdf598ab0de441ff25a91b47
SHA1812a69a1dde6af803c7773aab8d7e57330171c1c
SHA25657f02429c3af461aaf5620bbc1b4c03e1a3d07240eb99e7756ee84c9f8185ff4
SHA5122f5c0c0cfcff9bb476c4abf2a4cf3e7527faf1351069ad77410cfbbe7b1fef5938fdd180b26563719e8a163ff769b8dcdfe1839c5ad7c6a03008a673b7779565
-
Filesize
10KB
MD50a28b9e3850cc990d89dd83ad11aea75
SHA1df497f0af9ee166474a6587af14cf4e670db5379
SHA256812b7f002f86108d61ae529cacd45a4070ed4487c361a183b33f53cdedfa5b9c
SHA5129dca5b74bcda449ddae494136ae41efb57bb99c16e367945f6504fd078cc969fa172da710182eba0173ea03483e456172857d644a1621d9d82b54f863ebc6bb4
-
Filesize
10KB
MD5bda7ff06598fcaa0c2483ae8c5e200a5
SHA1a6e7fb6911f52889153413f94bb4a88639295a04
SHA25661067182b649e8e6f2db1a069f48417a8e022b203082b5d90437872b60d608b4
SHA512845c2dbbec7db81828a892c623c8ba667a455942ec05e313653b0f523d699dbdaaa3b683ac617cb3109a61d035e925f770cad5b2e0cf414684fdde6f1b30c785
-
Filesize
10KB
MD59c4dcac0cebe682f50290a15002d8365
SHA148e582dc23c91ec0e847a6e74512a6ada2962773
SHA256ff2844a860a09d5bf62cd835c995e1f19db0c0625339889466d0c7d1ced4e750
SHA512bf3ad6c35e55b9f44eac4ec126c99b47e1aad7ede3ebeac0557e62832eca6b2a8f5c20e8876e717a48622e5169221a71642f7304406fe28ae23588342d056b49
-
Filesize
9KB
MD5046e30430d1ec43105621e9918aa270c
SHA1e20c6d112fc789c74acf45356c096e11394e62fe
SHA256a49a5d798b94679658a2a9e3cf84a2c65f7429867ab50aa49c75bb6979b9513f
SHA5121bc3fec46dfc7b4d10cbc77373fd329505e4c8b91e40ed2f6dbc4c4e9b7ee9f9ae8ec9a968926de0fd7f6f36d0105181e61b5b3505440fcecd325ca38b4b82a6
-
Filesize
10KB
MD57dbe6c73e04315c405c3b44b71f76197
SHA14792136473a5bd4875f52188764a4552ec01b610
SHA256b4abaf10582fe2a1952a1834892e0010d53bf04dedbbbaee50bf5ae04fa2f367
SHA512981187fa6e64ea377ba4e5e71ba1f2e6fed3eb579482787159af0bf80d7a736f78f54b2d783826a71352f96df247c8d13e2eae416f0af22f6a4829e3215bda96
-
Filesize
10KB
MD534319c7daf5a0aa7edf53d14ca5cf7d6
SHA141c90af2107692bd5bf001cbfeca23a34103a419
SHA2564dbb34651634d27aa0d8de129e1fb92639b858bc5d7bcca18cda75caa376d940
SHA512bdd4d30a44448731afe6438f730b73b34606b1fe9cf3ce0f471daab32262a3f4d43d203fb11bb727fc7132c83062f0d0c5dd922cb8aea7992f429439b761c6ea
-
Filesize
10KB
MD50de2dae8915ab7af813961f845ca80b9
SHA17fdb9a774aaf0b3bd3daf36ffcd287178ca9fd6d
SHA256d972a41518aff813f9bcf2155068797126eff7f613b68ec1e58eacd5caf3e7f5
SHA512f12494fcf062302763be4845f837ebc3c47b9c97438f85d64ddb19c1aa106cd39824ff4c8a8a9b3332af8cc6e654b439151a34035ec97d1d10a8eb6f70377d5c
-
Filesize
10KB
MD53e6ea74b54fcd7c7c6edab9fef7e4b88
SHA1ac22034f60cfea1f0cda67173dc7e8d222d73b77
SHA2562cf33af01a9d85127109a6b4670257780856a819339dcf02fb253de5291bf4bc
SHA51287eec13c62fe17745f428722d093289c14be90d3a38ff6f7b02c1da4e6a746fe8039bde87e304749886306090e09ee85329362150d9898f830c91f4d22a25ce5
-
Filesize
9KB
MD5c68c7e84076dfeed8c739b606b492952
SHA1a1ac5b9412eb1a97b52f60dbdc1ccc75099b79fe
SHA256749dc9a17d0fe39f266a9cd6014aaab0bcfe709457567c230192dabc798c2749
SHA512cc57fe8c73d29d66782ad87b807d8238792eb37cff43fe551336994555639d7e7a6d36710093c257a6ba0ffb46bc300b1894ff723b200a201520b982bb320c11
-
Filesize
10KB
MD56ef1f04e11ced53328673f7bb1db35a1
SHA1d062d780d17c3fe89eccd0e44b8d10e70e2515ef
SHA256122e446b29964faa702043aa7f5dcdd1775d83a67c78e36c8c555eb2f045bb17
SHA512e5ff9a248532e5751901315724efb881b70a22ca5a92e6d3571e918ac50edc876be59a67fa3ad4784e1400ba7dc4af6e1d1d612980970411296a8ea312d366b6
-
Filesize
15KB
MD5b00ef1a4555d6a7030cae208303a33a8
SHA15b197f6a40c1a6bfa7ab2ff70a02c323bb945eea
SHA25636ec23ffae3a9295eccfd5574007c017b8b53bbec80cd4fe6e243807ef278224
SHA51203fe78c1ed641465fc673e5eec4b2d3293104e4d9f25fabd3958a69dd3b2ff0b633eec612ae61b01033a1e047d559f1eebbb96f4a61e7108c5ecad0fd4e74ccb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5a0e766fcd61eda26acc87a237d3294a0
SHA153b767cbf0e5c06ffbc910c5780adbb6525f3499
SHA2564ce8c7005204be6aad3822a5e869ab9408a8fc0561127e37ea29bb926e22d091
SHA512cdbf9bc8a560c860b92481303704eea8cb5abe1e2d6e848c1110524589a71ae14822ee324572dcc24fdc85777c8316ca8877b5e6b17c6723fe97e82e00dbb7de
-
Filesize
206KB
MD5d2e8e697460b3b99f97fdc6931272bb5
SHA158afb08251d6885dda1a6279f343d76af4ec3459
SHA256f3671cba2281a1bc0f8f5fd7f3430c5b4bedb1da9360b8668b7aafe3a955b160
SHA51242b13833430301687a2978d2f256bb1b293f4ed342b974e7e12ede9feb24c73cd3766f1358a58e1796d5867590079df6be27427663107bb63b57422d440b31e6
-
Filesize
206KB
MD5f9b6fb6e6b4c057df62f3a8fdaebe1b3
SHA1fd8eafd36803e8e40475bec6c2748e1241d3e9a4
SHA25663d81450b74475f184151bbd479770fe0e699ede2bd228230e69ec60d7c46241
SHA512882dc0bf7b560b92bc212302c203275f3e2e15d74ba8d376ea8868c07d47a6fd90bc125bf205a4df9d5e5d3b87b1f4fe7effa463437a17b30c43f746811290c1
-
Filesize
235KB
MD53159011007cfdaf4b608ecc016a59e35
SHA14e8f43c210c48564923c267b0182523d453de86c
SHA256d8718812a9d37f035e444ea7507297a783f911183dd3bb4744c5dad1b334ee50
SHA512ad69ba910b382cf0156df7b9ee4148ac6e8a5db5e511e1f26a05c63db48bdf87578ba0fb2a3adf68d2c9b538297cfac23bab1ae56a08c6c740cb6f5da4423ca9
-
Filesize
206KB
MD5707e4e21fac3d7cb632d99fb45b0c9e7
SHA17012d60d2498004c18875ef129bcd21a2bf2a4b4
SHA2566c20651ca80c03106e7f19a25f9838b2126c4e8efc358e23230782cba077cff5
SHA512d0dcfab62f2cf28a53040026d44c2e6b7b2f0c85d3655fb1988e1bc13b22d6f94ee0ee1da0874ce3e6ce289f005576326fe99fe4d2314f3ed54d0be613ed0bf0
-
Filesize
206KB
MD50d9bc33bbdced34205ef1488b4f0d452
SHA1c5ee287ef6c6cba1a8d667c5cae34cad8b1a4407
SHA25624807ab75904397be4f9ebf8658a805afe005b3ee16ebb72d4d7981e5fdf8d73
SHA512b860e14a1f61987b7ca45508a14473d9f40ad09b36cc5bfd698bd8ada62dd532a43b8b1f1803ac4f0ed691baf8939082028a9f914cc664e40ab1b24de848d80e
-
Filesize
101KB
MD5bfffe990732a00abb58de91ce7c0f8ae
SHA18b7bc68cc88dea534e5032843277b49734c64813
SHA256a66fbe6c9db6d42a1bce23762f92d4a54f2429fe189dc769a21fd36fe087d567
SHA5125d5e6d6353ea9cd4189a96f855fd9b543d7b79c07ea4f6c5dc466d5a02f55c07fdd29b7802a77baa58fb4e9b14a10fb5d0511c2c68e360febfaf916c88443c25
-
Filesize
152B
MD59f081a02d8bbd5d800828ed8c769f5d9
SHA1978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA256a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
SHA5127f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
-
Filesize
152B
MD53e681bda746d695b173a54033103efa8
SHA1ae07be487e65914bb068174b99660fb8deb11a1d
SHA256fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
SHA5120f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
-
Filesize
50KB
MD5cd2f3074326840d55a3c3ea1e99e83fe
SHA13a2e1d1a93506526ae3ed2b44d584af7771ff8d0
SHA2569ec9f50ac6a5dfdf7ace0a047ab4e86a7f8ff297030f93f9b8b4e27c57fdaa51
SHA5120685f7e50451e87f8d7d47f3373d653f7d6163ffa8ccd143a85b179d2c5c51cf494e8b5f7e561436c35bfb8ffb9304f0c49962a8bf7065830f0cc95281f4ae6a
-
Filesize
20KB
MD5050d96fd978cdf15bfb99fe5b858f749
SHA1a3e5c4537dd46e93ac08368a57ccc48ff8d3c692
SHA25670ede7cab9dee3aee40f5bd309f0f321fef66666bc5527ea5995b8665ac29ac4
SHA512456295c8a20a6528699e5f47afc42837953b3f8b84c235c5e5daa8e30fc9ca6eb209f610d2635d1492b85cda051c7abfc0723422761423f936e84fb9e839c62b
-
Filesize
100KB
MD5fdf09c3c067041ffdefcc9e1bdea9718
SHA1e31cf28187466b23af697eedc92c542589b6c148
SHA256144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da
SHA5129e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268
-
Filesize
51KB
MD5588ee33c26fe83cb97ca65e3c66b2e87
SHA1842429b803132c3e7827af42fe4dc7a66e736b37
SHA256bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
SHA5126f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD56b531e5534ee2b1d2d848c981084bc20
SHA19c78c95a118dc191162fe51658fd0e5ec5a927bd
SHA2560fd3cf55a59568941cd1f8a083b26ceb464541987bf8ceb4e040c22610cf54f0
SHA512dac52ddfb5f6b548535395bf261bf5f6ffc05a52a99db452c294d21b5bc41f0c5f596afd9a465b4ff3aa840babd5675ad735d86134062eda657eea7870b803b9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD50fed0aef7f1e44596d421e573907aa6f
SHA1f7d40db0dc154db7398e8e35fa0aafce137b1ad2
SHA256bb12b8f1777b0de753ecca52ab0b0bc785a8977aa232532f44fb01ec5e977e5a
SHA512e6d572f8ccd1f236e4b14f208e977ee4f07ed62f85e9a1367ea063f2d5e2330cccb3410fd8b5f55e74cb088e6db3e51fc1d6b2199cd7e7a6021f9e279137e069
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5e9d49294ce690745be37d0422a06cf80
SHA1b351edab43358ab314da3715436548afd575b239
SHA256fbc19efa18d4477cd6b66ace66f80964d79507ad2141d034e7de9cd3c6b88b1e
SHA5127bb59ea1b45f2ea4c17c127331d61040a6ec98d5e542dbfa1082a6caa1474f0ca88c4c0923c63264e316f92e621cc59d27cd2fd6f621862d98ae75ed76680c82
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD59dc313b8975ab5fad7a311395cd2a4c2
SHA12c73fd2b65d1c9b1b46e046e2ae6a0f636f3a003
SHA256582488b41636128e538285ce2161af2f224277cf3a90e8794fea117fe75bf82c
SHA51202127fa9a63710ef044da6992ef965a688c4233003d7aa6f7bd8b899e6228b7eb47d1439b93c5b35cd9f957acc865b1adbfe742c230117373907d4290bef6242
-
Filesize
4KB
MD591e35468c7e3258c10b564f77f3d8a55
SHA179f37dbe3a029a1dd980a73812397afcf807998c
SHA256a5bf400f813eecd0a7ee0eae4af83ff0bd6a93a0573db117afc35b11e8a49b36
SHA5128c3656ee3464ae55b48372c7d13db62491f24a015134dee762676d75da3851ced11d9ae8feefb51732f0b6b6be3f49e1e2594b1893f292055dcb289cc41f7595
-
Filesize
3KB
MD59efe5bb42642122c665d4f6437a845bc
SHA1bbae1554ad55e161adedaecc5015501a8f056da0
SHA256bf41a0b9f247e3c3304b2a3bc5f4e503dc922b658f04e4431d8bd79568d287d0
SHA5124dcceb7ed5ec0dd84c7f0a899e89f0b98fa5bd6cd8f704d80908a696f0ba43f853a5701dacac7539f1f96f6d91cf370ecbd180899a2a37fb75faf5157291b15f
-
Filesize
5KB
MD5309c11bbfdfb143887ee0dc8167281a5
SHA15a3d8b31fce44009eb84fe3b1ef0fa32c9fec883
SHA256a9de00aa5e85ab6a5ac3cb4559d82099dcabf5d9f9853181f70978ee2029f97f
SHA5122c6689151e81454150bb08dfebc856923a0123df51bd5eb4ea963598f5c46ac11a05886ac5ff2667b8f621589fe5be575aacc9959044c22ac9d0dfdb50d300da
-
Filesize
6KB
MD561a6a17da5f288fbc4fd0c99e955f741
SHA144a3cd76f1e3907d98e89e7e78198738d4ccfef2
SHA256bb32c646f20dde1876d06b9bfe8dfa6cb78c6a47fc1e8eff89c541de87b6df38
SHA5123bd5b4dbb2a82306e39c144ecbce78e40d0438bb0e42f5e8cc4ec2f775493b085f73cf3472a6a3d97a0f237ba433869d3a660e47cc215b21535981729598e19b
-
Filesize
6KB
MD53a103e9d0c897cd3b1647f4a8015a324
SHA1d45cac72cda1c3350ee8b6d350916c38995470d5
SHA256b28399e305c23744fe5ed460543ad833147d38d7a65170412d7d09d9d036bb49
SHA51295d80f6bbf2fa3129be7905880c7904409efd4add60909b4e728f8ad463a4055d1dac5665d7cceb90770d325c6ce7b518115e93d3ea07b457ca4bc4e93cbd00a
-
Filesize
6KB
MD592b3010d46f44264b057e4785b7ccb0d
SHA180e55dd9aa42a2a8f202c02e0a8e25e0a71be589
SHA25692264a449fc5ef28072fd924c3be6be301c566e5f572c3378da6489e074e9349
SHA512906749da146439b1252f52f40b3260b7faf38d312a804961631c2dc53fed7eea3c5a4fca6e32575378ed414da12582eaf1cd874e23f772182e27a76110b1c790
-
Filesize
6KB
MD58f770e25442cc20fecd8ae944c0039d6
SHA1133c38009d7e2deb36a967e14e582f038d28f9a3
SHA256a425cd63355f85daceb49c08f9c8637ccb58599ec0fcca88e114422d44956539
SHA5125ad7ae941f2e9a3f453f4c231d7578ac697d0a5cff0743e5cf59a9bdac0e36e5b83b699069d771d51b3879cb013c76b009173256909b7df790d6a12419263c27
-
Filesize
2KB
MD57030eec555d0349f19fcdfa5c1ff7ec6
SHA179712eb190c82d60ea023b177f343b2f30c6e838
SHA256b27bab5afb91bf1e75d5d716429eb7e96a893ae345f2438837fcd4edb69a5b4c
SHA5122016b42330c7d4afe2df5e3b33cc7242403cfb9542a7ef1057f358798d1092e04aa7431983d68a2e275b7d6f66679f24bdacce09804a9f6c4fcdee297d494672
-
Filesize
2KB
MD59aab5d908981dd0b277ec816b9af2a0f
SHA125de6bf4e93373dcd8b9ed7032f850599bba184c
SHA25690d41944cdd5d37b650c2c4f0ced1396137fdca763d4268efd318cf96faabde2
SHA512fa77fb5d63b532ac8fb9d64467ddc809271804c71354b486ed2c8b793d0b958bac7957f5292b25bb897265609682e2b85db45b16d646d0bff3a6b0722fe163b7
-
Filesize
5KB
MD5f3dd379c8c8ce73d495db38f6ac3e666
SHA191f89e70ceecc4093b4669a952b59f03d39a5407
SHA256a0dfa2e0f915e6a5b25f51eb1c0d242cd54ea34d31fe785ee6f7a512aab1a19c
SHA512d7854a32af8c5cfa87b5d7c3bf1c0b1ab952b2ee946b4d4422b347b962d08de5c4720bca7b1f9c9dfa0c120762cd6bdf3932f5a65131fa4671fedb3c26333054
-
Filesize
5KB
MD5b1a8fb39776411595d213ed3ea7b8d3f
SHA1ad11a930683d9c4f4ae738b41cf14cd69eaf8ce6
SHA256a927d0d4184f9c043232cf96e4d6335d1f3d1a902338551043ecb5a9c68f967d
SHA5127d61ae7d7af1eb716b7259cfc30071ee3bd1db65e074dda3a3d7240229f1164f21f613f66c253d3b7020778d71279b5666addaef01198baa1d7d8927faafa983
-
Filesize
5KB
MD56198e9c73fcf4ff01b3b85b7be149db9
SHA158f3560770a2633bb62b6d74d21ada373c7b7bfb
SHA2567f8ed61564047d9a1695d29a0c1d8f570fb72e1b1247ae0c3957d86c81467f00
SHA512c9d635af67460802a192451e9dafad8e713ca4c205ff2f03e22bb3f6f4a967eac22215c3b4641a30ec4edcfc7c34a6fdded729243b61a8bc278a24bb0cf2eb19
-
Filesize
5KB
MD5c262ff7f4a340139d0a018c15e128e53
SHA16c8ef401126f5dc8332486156737e1166912f8f5
SHA25684f3198a91e1e8f9b0b6af6502d41dd970a4ce5c1c1193023ccf49d543b85e64
SHA5123738ad84069bad8d1f7217e7a89876c6ca4d4b2841b25ac648a50934a6154148e035faeb5e4dd53430a81214b9d455e042af7fb72e360e7edd172a1462959f70
-
Filesize
2KB
MD5be0a650664feb44cdfdfddda2b5a2c3d
SHA19bed41db2eb00438db37a240acb4b2a3b93782ef
SHA2564a6a81414bdf7d2178711a36f05872123d3decea4c71cc232e792ae9fe821bf9
SHA512e935ff34253f5b83457c055edf3f6235177bb6bb1e806be4fa5053ee41b4655091af07bdd7a6b56c0c59dc2cbd9a0b659cfd01b756245109d594382dc38185af
-
Filesize
2KB
MD5336465c6e0aa196abaa002d79c2df8f9
SHA14b9e796edbfe412f7d163fe560aadd141e34ed8e
SHA2569ef0912d8bb0bbb663eb86b1e3c07b3bf086aacb9a08e258ce4878fc572500b4
SHA51203a1e905f047183504fbbc7a2ba1edf2207e05c7a6bbb2619077725cad03774c7f8ee6248bd23a08ef405fbad4816114584086a39a06af68e0c41a472dc5a259
-
Filesize
5KB
MD53f29af8b1f0c07270c464e4a3ce91f7e
SHA1f3cfd258fd5cc6bd735848e7ca11557ef31bf5e5
SHA256c4136680f2ba3bd49d7a7c9acb4fbbc3cecd330cba9049dbee30af8c3e5770f7
SHA51206fb9c4cff74d5f7882b67f30dc48cf6152cb5b37a6861c86b66eab9466410f04510f8680cd6441329caf6fac2f95b9052e548e01863a6b61784791c0de0fb3c
-
Filesize
5KB
MD5bbafe993d3226957d269a205c316a3c4
SHA16eb84cd284a647b960028dcdd30aeaffcd69dccf
SHA25653dc7cbf96f140527436178183b4f9a3e9cf2f653e27e9b170c62ff4f2c97f9c
SHA5127f4c4425a7f85c7190c7f66d4106c968c5708a135a9b5ce7df33b28f57d716c45dc4f5174b0d72a9f8c5a02026c15058f921f9527fd7fe6d915ca13af33a2b1d
-
Filesize
5KB
MD5aa5468f70be5589d43eb74689247161b
SHA1381acd2006615e35a0255a9e91e19d4f653372a3
SHA256164196668c8df8df01bd106914852a4e755b84237f3a019426e5bf677e16dc08
SHA5126cfc16fcada52f5a56cc3fcf56a3b1d37261c6bdce13af26514fdb04fd733e83cf6ea0b73e82abbc6551c22bfae0aebfce80777bb5a0c4109e137b84ef1297fe
-
Filesize
5KB
MD5eda5ea20759d282a1ab5009dc8413a55
SHA1504780e678255a78e62be249dc67ac05b20728ae
SHA2565ec91f89bc9b3c5050ce632ab066a7dcb620b329f46e05492bb07d52b695337f
SHA5121e4e28888a0e14c45fa834aaf8d260c6f22480a48adc9c4b2e96a2ae6076d3af478606379dc482ee2e18a6cae5b7b10e97066d0db9e3aca0b76b558abf8a9202
-
Filesize
5KB
MD5737f917c6b35746431ac30b2bdec6ba4
SHA1c0011b438e97fcfa7eebeec61782c7ad5b4bc885
SHA2566d422aefcf703db1416c9a70b077d8baa60d13c708d62cf6458033814cf59ae2
SHA512b09631197725fa6372811fc2892ba6ae68865e29407de21ab0d5050feba516783bf911e918058caa1e5f6ac3148fbcc02268a3f6463416245d9ed98787458f02
-
Filesize
5KB
MD599af647e4e302aba28e6d75c571f418f
SHA10ab1fe510950229e0f16c9569e8d07cb8ef696dd
SHA256ab669b77a3166ef0fb3faf8115740fb4d05d2ab51bc422f566acb7fe46b59dd4
SHA512bacc825634f5dfcfbf687f551e33427ad28584f21a734aed66978c96596584c3f90f927d90d622a69ef48d38fb799895b4b7ae73082dd81796ae66ec7026f5f5
-
Filesize
2KB
MD553eb2a0a5d16e68efbf4bee0fa22d3ea
SHA1efcb01e32a2c2cb9078c53165a5d4e0197ba69e0
SHA2562b6d4a7bacbb789af07044640814a3c47254a89e54f3dc4fdd5fdef39205c87a
SHA512549d6a1d5109989b56a6d79e06068599fb27c8f04303ae1160184ff134b29d15b19a4d2fc12b2d29ac5339a5e9168c76d868ddc830f50907dbe23548e43c7eec
-
Filesize
4KB
MD5fc15f090eb8be9d5f072536d108e378b
SHA1a76ebf5fd055d51ff6b29bec8e4132d94e003802
SHA256b81c7cace487da54c79349b250775bdfbde1262c5414a3a92330bd6683486d72
SHA512c5eb2ffdcc855ea117bd430b41b650757455f06a5c556ebe30cb919bd8e63c936bfb3940b1e613e150667f46da4768559419bf3c38d58d267cf5886717564bd7
-
Filesize
5KB
MD5b5a99c92ef68e0b9a9052b9dee1c7120
SHA1562b82257af6c9a4558168ae9ef60e9e06e22dae
SHA2568730411d092c39ddccfba206bee4f93e73817fc6c509bf342e68b387d966d3fa
SHA51218a24f29708c3e5f8e32b6ad73dd11db8f3a576946ebe0edcac4e20591034f885efd24be20b238c628fa4d6af4d5a04f1030d859c0fb7b975c27defbd4e5cb21
-
Filesize
5KB
MD536dc8c4b932093d3086b4871fc14ad67
SHA12acb260b1d506b215205c811e85802d78a7bee9f
SHA256b3063deb360b1823f94224ae4bbabd2cc82d8506e47cd2645b498ae2139e378c
SHA51222a40fef0b74eb7bffeb556aba8e9f79dee7d946431629ed98e70e3906b9a15092381de82ff3e3cd4765342e07faf3c5806fa380b4b72941ef555bb57027b217
-
Filesize
1KB
MD5dfe9b26879e188cbf0f79341e75c3315
SHA1ae15ad0a19696c564d7bcbda803db7fbb59a308c
SHA25653590c78817ae33234e408fa492d0f47979af4f87645c7fca32bb83aa59acf6b
SHA512bbd80ab9fbea9d20e93d5b65a7490e876bb83fc17bb5cf12185fc3646786a3f6ed37785b61e32a24c46c77a6f19edf7836e10effb4a1d5ee2064e63fad93ff6a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD51ef8b749701bf348a6c9d8fbe2eec423
SHA1e5ca597355e872d2f1aeaa530a291fa0a32b05ab
SHA2569b6225c6d7a363b2ccb0778d54dda1f3e127de6506344825088794e6bab194f8
SHA512fdbeaed8cfcd1f841b8bded49ef9dbd365f9539acd71e428ceee734d1003053639d29c332b0f83f3012e6d38070570a9767cf7c60a8ef34996c0a572969e279b
-
Filesize
11KB
MD5ebd27bc97ab361757a844d507ff4bfeb
SHA1c1a6ab98c2efab542dffbfd909954398c8beedb4
SHA256c79dceeb39315c470fea2e22cd11445910f34fdb4613d59adf957dabf101e4a1
SHA5123bed304bd8e57eb24d47efb48af6612056cbeec5fd38a5987da43384937ffbc5c8b68106b7f1895325a5867c150e6444391754648888cb5d2f1bc7c282b3fa9c
-
Filesize
10KB
MD53fbbef83ac003f20c0c8c5b74b6af91c
SHA1ecfd3ad8d8106e7d2263064f50d5a32e6d4f93d7
SHA2565828699535608ddf5d0d86ff0dc1bdc0e53c45ddbfef47c00e2438e8f179b546
SHA512c9107be4abd737a5290190762d1d231bbf5b2e6d484b549826733c8fe3a6a0d90b927eb908b38e78b3b30cc20da15fd28fdbf3275ee4d0189a856364c957116e
-
Filesize
11KB
MD5e8571a97b279d707c61a794c09ab23d4
SHA14dc1a1b9ae0444d60f3ed58c7f46110e61d3f9f9
SHA2561cc02390f32b292e4a8a47cd59ef1bf5c5e1d2d3d06d238609c345dd6e3bc638
SHA5122079457c409fb6e1bd9d339ff8c680dc97f240c8154df21ac876dc5b45e2389099bd3469852151542a5b44c36a672701da86e05ed0efdcfe5d348c67aed32a46
-
Filesize
5.9MB
MD5b0b307510d9180d47181fb70a3320cda
SHA14c3093324dc3123a90ae94ae60ca12026f7f4885
SHA256dc6a0d278e85bc6d686b9bae15b668231257e744455b3a08c700a1eac4c9418c
SHA51278750914832e1e54234c2bc80ed9dbff554ef1c95738a1f6f6d8cff86fa79a1aa03df23cde6a0c3db68cfb8b139a16b3b3b0ebe9acdd0844430abff9031d3ce3
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
71KB
MD55b983519f5d1ad44ed85f8eb6c010bc1
SHA1e86f542b1b5d172bb78819232119d80b23d24f54
SHA25664cb9ff36c82878a84768c6eb138d2e9adf8ed9df0eb58cfe44ada8bc56f6060
SHA51249dc71aa6b3fc01a825f46d3c39b8de1cb22cf06c361a56aa2ad5e82c280d5687e0ed0d2e308cb1130143ca617f56c223af2b450ae87dd312d5226e583042916
-
Filesize
153B
MD5f7cfee2970d106ba39ceb2ea1f874a67
SHA1eadd5d8785601c9957d31cf6119ba2afe0d48044
SHA256c68495dbfab5c08c7e248f390e5bfaa24d414a259f20ab89e8d53c4fe981f4f5
SHA512a56a548751be26cb83dfab97b653c8f6d48d62649b0a7f2dd247fe1612e233146df527c6c526493d5ff84bd5c77fedf9c19f0cb1e6957c28710d7a41e5dacddb
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
5.5MB
MD53122273f77f8646e30e99312483a4721
SHA1dfc6e6fe4402ade089bb8475f3d8deda2ffc37e6
SHA2560d62e2125931315906d78ccb427320235abf64bd50ba70a596d39715b6aa6ee0
SHA512b0710efc7679e0e1ffafc903ab87bbc95150282fecbf241330e6d071574dbf50397756df209d42de3eed63085bd69479b227ace5f2bc10b3b774f37a596ba1b6
-
Filesize
280B
MD5bf39068166582472f173281b149df160
SHA1eb0e92169d472ffade9c477b48d873b01c1ee7c1
SHA25608f0be8230b517bca1d8deeb938c764c6bfb448f2c497f9ab5bf69043e01318b
SHA51285016bb25069cb76abdccf51ab083c4778a990dd5335e444817f1ec0b40d33ac2a396bf967bfca83564e892897c28bf9f62b5e8712665c5867b3dff117df3d37