e9d133913687103c5244a5ba256eaaf2d908abf9d9545bd49944f91b3409edf5

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Size 1.1MB
Sample261009-pjezfset5j
SHA256 e9d133913687103c5244a5ba256eaaf2d908abf9d9545bd49944f91b3409edf5
MD5 afa72211946a099363aca8586b63e293
SHA1 75280dcbbb1a9527bc34a69c2da40e1f3ffcd32d
SHA512 2e5829b220889d0aa6f9e0150137d868a448dfadd429884fa8f0b1345628c1db8cbae818bac353d25c02c51ebd3f27a3584f67492943b53e51c83eec8717b0ca
SSDEEP 12288:f/F05vucSkrT8EQRHzwdc/p9q7iQkrTsJECMw9NO+5As+LZvY7CZZjCS+hEc:m5vucSkrT8EQ5rp9r/rTBNZjx+hE
TLSH
T1633549A2AD5F94F9D57111F0D425825978AF2CB0B521A6C363C237CC8A34D87B729E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	2204	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Settings\MenuBarAssets\MenuButton.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\ingame\ic-up-black.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\ingame\img-selector-box.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Category\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Clothing\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerNew\Connecting.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\Log.dll	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\water\normal_23.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\SourceSansPro-Regular.ttf	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\ingame\img-selector-box.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorImages\Stretch\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\newBkg_square.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Settings\Radial\EmptyBottomRight.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Category\ic-recent-on.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\icon_friends_16.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\sounds\swoosh.mp3	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\CloneCursor.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorImages\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\SearchIcon.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted100.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\water\normal_03.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\woodplanks\specular.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\sounds\bfsl-minifigfoots1.mp3	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\sounds\ice3.mp3	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Avatar-Animation\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorImages\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\TextureManifest.txt	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Shell\icon_forum.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\slate\diffuse.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\headF.mesh	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Category\ic-all.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Settings\Radial\Menu.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\Unmuted80.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicDark\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\metal\normal.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\water\normal_04.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\RobloxStudioLauncherBeta.exe	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\ic-rewind.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Clothing\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\particles\explosion01_implosion_main.dds	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\PlayerList\TileShadowMissingTop.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Settings\Slider\BarRight.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted40.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerNew\Error.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\CompositPantsTemplate.mesh	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\CompositQuad.mesh	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\advancedMove_noJoint.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Settings\Radial\BottomLeftSelected.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Shell\icon_friends_on.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Shell\icon_inventory_on.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\sky\null_plainsky512_up.jpg	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorImages\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\TinyBcIcon.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Shell\icon_blog.png	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\humanoidAnimateR15.rbxm	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Avatar-Animation\[email protected]	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1680972968\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1680972968\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_830479881\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1568626033\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_58215841\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_830479881\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1568626033\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1568626033\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1568626033\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4532	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30BCAEAA-5276-4B1E-A5B7-13E87B6CFFFC}	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30BCAEAA-5276-4B1E-A5B7-13E87B6CFFFC}\AppName = "RobloxPlayerLauncher.exe"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30BCAEAA-5276-4B1E-A5B7-13E87B6CFFFC}\Policy = "3"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30BCAEAA-5276-4B1E-A5B7-13E87B6CFFFC}\AppPath = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\better16-studio	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1874ADF6-4C57-4CEB-AF32-B0E71AF30066}	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1874ADF6-4C57-4CEB-AF32-B0E71AF30066}\AppName = "RobloxPlayerBeta.exe"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1874ADF6-4C57-4CEB-AF32-B0E71AF30066}\Policy = "3"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\better16-studio\WarnOnOpen = "0"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1874ADF6-4C57-4CEB-AF32-B0E71AF30066}\AppPath = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\better16	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\better16\WarnOnOpen = "0"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\ProxyStubClsid32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\InprocServer32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\TypeLib\ = "{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher\CLSID\ = "{76D50904-6780-4c8b-8986-1A7EE0B1716D}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Better16\\Versions\\RobloxStudioLauncherBeta.exe"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\0	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\TypeLib\ = "{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\shell	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\0	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\TypeLib	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\TypeLib	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\shell\open	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\ProxyStubClsid	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\URL Protocol	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher\ = "Launcher Class"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\Programmable	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher.4\CLSID\ = "{76D50904-6780-4c8b-8986-1A7EE0B1716D}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\ProgID\ = "RobloxProxy.Launcher.4"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\shell\open\command	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\TypeLib\ = "{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32\ = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\RobloxProxy64.dll"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{664B192B-D17A-4921-ABF9-C6F6264E5110}	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher\CLSID	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\TypeLib	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\ = "URL: Roblox Protocol"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\shell	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\ProxyStubClsid	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\ = "ILauncher"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\ = "URL: Roblox Protocol"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher\CLSID	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\FLAGS	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\TypeLib	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RobloxProxy64.DLL	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\FLAGS\ = "0"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\DefaultIcon	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\Programmable	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\ = "RobloxProxy 1.0 Type Library"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\ProgID\ = "RobloxProxy.Launcher.4"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\shell\open\command\ = "\"C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\RobloxPlayerLauncher.exe\" %1"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\shell\open\command	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\shell\open	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Better16\\Versions\\RobloxStudioLauncherBeta.exe\" %1"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\InprocServer32\ThreadingModel = "Apartment"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\InprocServer32\ = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\RobloxProxy.dll"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E9600BE-5654-47F0-9A68-D6DC25FADC55}\ProxyStubClsid32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\RobloxProxy.Launcher	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F0898-B7BC-4DE5-AFEE-0EC38AD42240}\ProxyStubClsid	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\better16\DefaultIcon\ = "C:\\Program Files (x86)\\Better16\\Versions\\version-478697a0a9b946b9\\RobloxPlayerLauncher.exe"	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\0\win32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{731B317A-E2B8-4BF7-A2C4-B47C225DDAFF}\1.0\0\win32	version-478697a0a9b946b9-RobloxPlayerLauncher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2204	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
2204	version-478697a0a9b946b9-RobloxPlayerLauncher.exe
5576	msedge.exe
5576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4496	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 5612	2204	version-478697a0a9b946b9-RobloxPlayerLauncher.exe	90
PID 5612 wrote to memory of 4496	5612	msedge.exe	91
PID 4496 wrote to memory of 5112	4496	msedge.exe	92
PID 4496 wrote to memory of 4532	4496	msedge.exe	94
PID 4496 wrote to memory of 4484	4496	msedge.exe	97
PID 4496 wrote to memory of 4484	4496	msedge.exe	97
PID 4496 wrote to memory of 2820	4496	msedge.exe	98
PID 4496 wrote to memory of 2820	4496	msedge.exe	98
PID 4496 wrote to memory of 2820	4496	msedge.exe	98
PID 4496 wrote to memory of 4840	4496	msedge.exe	96
PID 4496 wrote to memory of 4840	4496	msedge.exe	96
PID 4496 wrote to memory of 4840	4496	msedge.exe	96
PID 4496 wrote to memory of 3744	4496	msedge.exe	99
PID 4496 wrote to memory of 3744	4496	msedge.exe	99
PID 4496 wrote to memory of 3744	4496	msedge.exe	99
PID 4496 wrote to memory of 1664	4496	msedge.exe	100
PID 4496 wrote to memory of 1664	4496	msedge.exe	100
PID 4496 wrote to memory of 1664	4496	msedge.exe	100
PID 4496 wrote to memory of 4952	4496	msedge.exe	101
PID 4496 wrote to memory of 4952	4496	msedge.exe	101
PID 4496 wrote to memory of 4952	4496	msedge.exe	101
PID 4496 wrote to memory of 4400	4496	msedge.exe	102
PID 4496 wrote to memory of 4400	4496	msedge.exe	102
PID 4496 wrote to memory of 1624	4496	msedge.exe	103
PID 4496 wrote to memory of 1624	4496	msedge.exe	103
PID 4496 wrote to memory of 1624	4496	msedge.exe	103
PID 4496 wrote to memory of 5056	4496	msedge.exe	104
PID 4496 wrote to memory of 1996	4496	msedge.exe	105
PID 4496 wrote to memory of 5056	4496	msedge.exe	104
PID 4496 wrote to memory of 1996	4496	msedge.exe	105
PID 4496 wrote to memory of 2036	4496	msedge.exe	107
PID 4496 wrote to memory of 4216	4496	msedge.exe	108
PID 4496 wrote to memory of 4216	4496	msedge.exe	108
PID 4496 wrote to memory of 2080	4496	msedge.exe	111
PID 4496 wrote to memory of 2080	4496	msedge.exe	111
PID 4496 wrote to memory of 5716	4496	msedge.exe	113
PID 4496 wrote to memory of 5204	4496	msedge.exe	114
PID 4496 wrote to memory of 5772	4496	msedge.exe	115
PID 4496 wrote to memory of 1416	4496	msedge.exe	116
PID 4496 wrote to memory of 1416	4496	msedge.exe	116
PID 4496 wrote to memory of 4256	4496	msedge.exe	120
PID 4496 wrote to memory of 4256	4496	msedge.exe	120
PID 4496 wrote to memory of 3616	4496	msedge.exe	121
PID 4496 wrote to memory of 3616	4496	msedge.exe	121
PID 4496 wrote to memory of 1976	4496	msedge.exe	122
PID 4496 wrote to memory of 1976	4496	msedge.exe	122
PID 4496 wrote to memory of 5576	4496	msedge.exe	123
PID 4496 wrote to memory of 4776	4496	msedge.exe	124
PID 4496 wrote to memory of 4776	4496	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\version-478697a0a9b946b9-RobloxPlayerLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\version-478697a0a9b946b9-RobloxPlayerLauncher.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.better16.xyz/download/thankyou
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.better16.xyz/download/thankyou
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7fffc8a3c188,0x7fffc8a3c194,0x7fffc8a3c1a0
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,375681091378730785,18285948223016392894,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:11
      4⤵
      System Time Discovery
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17993437872615235003,14275256646451814430,262144 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4661935632926692035,14304785127812828033,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,2266023602723331596,6690466601604161542,2097152 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15681233821205108936,15862250816456048391,2097152 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3724086258292824579,12707402874830881797,2097152 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14355709347016211231,11959818568201245998,2097152 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,11844673442600261819,4451026192855741333,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5224,i,921858964605242174,9663316637938707659,2097152 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,12326020354919263618,653372694892717997,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,363609739588990982,9611128425462540642,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5782424973360793498,5520992444382007963,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5782424973360793498,5520992444382007963,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11790743625340172451,17456490293147127038,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1635627412312873079,11346852566499381814,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,112948654835529560,7672777380175948357,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17638000825995994332,16253750972875616183,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,11002633534827285912,14004961450657517359,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,17524814188775306310,15523374086842742228,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,6021379409978652577,10172053706802941649,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3558297229623893810,14697800922279854796,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,7393905400473332515,15065363463044524032,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3572,i,9706497567435560111,1539390326547136068,262144 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,6619243206156392401,11478347406268665830,524288 --field-trial-handle=2360,i,4995576253449241597,3698348378407909868,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioLauncherBeta.exe

Path C:\Program Files (x86)\Better16\Versions\RobloxStudioLauncherBeta.exe
Size 1.0MB
SHA256 3abaac2e68e6e68aca3e76c4ce2a16d1d209025f3a19e3e188b8eebcb23812eb
MD5 72abcb4ac46f5ca56c1986635f7e6917
SHA1 89e12674895d6462035ad9ca09d67f4653c49e48
SHA512 8f89e735c8865dbcd8ccf50c0c9a147707eece709b440eeb95029ebd3f9860259c2861da58e8867488229c00e40a04fcd8e1ed180055835949647933b04137a7
SSDEEP 24576:dlRqs5YP/yDmWJjdqYO6ANL+gGIZ5ceTtUzQE3VaF:M6AjueTWQkVaF
TLSH
T139253852BE8F94E9D03112F1D525869860AF6CB1B72185C3A39537CD8A34DC3BB31E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.dll

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\Log.dll
Size 14B
SHA256 5ce074767e0cfca85035647afabdd31dc7e3539107ef058b608e33c62b2548af
MD5 2562732b5a6b25a0e13b741a8ab983cf
SHA1 1c0698a87e54a12a2b4b6ef9732bc1fde5456a14
SHA512 2038a3778c3308c49a4e68de3b95bdfeeda7832328e3936e5948adafb86e50b0882b678e00534c9ebbe75592b7c697496917a4de64f20b0361715285f26522b8
MD5 SHA1 SHA512

Submit Download

normaldetail.dds

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\brick\normaldetail.dds
Size 176B
SHA256 2a51ad9239a2102af2c08ee23e18407c3500770a931332a722c643ffca90a60e
MD5 620e055b9e500e85a131d8be2a65c11e
SHA1 d7fa8af56bfcfd48f38931e3ef8606585664a248
SHA512 551a93a5cffbc008f6d6b122f4c45d686faf1ef5a90975b8b2ef906123d7981e40efc644494957544832f5f605dac434714239a17baea97fcb38175d589d8794
TLSH
T113C01102E08E03A2CA0E0E38822A3308C2AA00220A23880A0BC02C83330B030CAA2C80
MD5 SHA1 SHA512 TLSH

Submit Download

diffuse.dds

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\ice\diffuse.dds
Size 152B
SHA256 8552dc6e0cb6d92005d531258fdb0648f943c720eafff55b51659ec80b7c3e3c
MD5 b79e6464c2a4e060275c1a947d2c46fc
SHA1 cbc5d75c02e4613e9002e39e9ef1d00d63183fd8
SHA512 79f8c6437f1e73b2b130fbdad2e4890bd0510cc47cfa77fa96f44e1ff4dcaf7718a7677df929e423f5623d59a94e1876d72be73c0be411128b29702237c9d0fe
TLSH
T14FC01102EC80000ECA2A0A308A222C8CC02F00A2CE8288030A0028080323020AAA20A0
MD5 SHA1 SHA512 TLSH

Submit Download

specular.dds

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\PlatformContent\pc\textures\pebble\specular.dds
Size 170KB
SHA256 454ee746e774d4a1611cadb2552eacc28167ff3f3306018198a8e203274ccb47
MD5 a4dcc342dcb963f298003a63d488ab76
SHA1 e5656b38670fae67de13e70f09ed6258aa365289
SHA512 6074081ad0cdd4f69d3ded98bd34f7c7ecb91dbb92e3146ec4013156e4ee2c728ca00d3ce5f45d312438df2cbe5a7a09dbab2957489ac4ce2e7af8a9408c19fb
SSDEEP 3072:RNApC+S4OrN/jj9rux75WtBCfNhV9rZa/Z2gylLiE/enWHO8nlFIYx/auvLkBwI:zAp/S4Or1druDFnLbZDWWuHYxpYBR
TLSH
T19B04E1C99F779D20AC225AF0C92F6E97127C52D9E834606348ED88C6B4AC355CF634BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerLauncher.exe

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\RobloxPlayerLauncher.exe
Size 1.1MB
SHA256 e9d133913687103c5244a5ba256eaaf2d908abf9d9545bd49944f91b3409edf5
MD5 afa72211946a099363aca8586b63e293
SHA1 75280dcbbb1a9527bc34a69c2da40e1f3ffcd32d
SHA512 2e5829b220889d0aa6f9e0150137d868a448dfadd429884fa8f0b1345628c1db8cbae818bac353d25c02c51ebd3f27a3584f67492943b53e51c83eec8717b0ca
SSDEEP 12288:f/F05vucSkrT8EQRHzwdc/p9q7iQkrTsJECMw9NO+5As+LZvY7CZZjCS+hEc:m5vucSkrT8EQ5rp9r/rTBNZjx+hE
TLSH
T1633549A2AD5F94F9D57111F0D425825978AF2CB0B521A6C363C237CC8A34D87B729E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxProxy.dll

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\RobloxProxy.dll
Size 130KB
SHA256 3d08726371e0660985cf866315a290464326f0a23cc2437a9f5b13bf3b415dd3
MD5 3b6b6c6e4ac111a1f4eb7bcdaba313f5
SHA1 452ef61471326b714c3ff136d4839d35091abcb8
SHA512 9a9c894c9ee6210d01c4c469a31642b98999a5fa1ebbf414541803efb95961b0d7161abf98ba6502229219ae03bd8dc37f00dd95c6840880feba2e26f13db3e6
SSDEEP 3072:qi4Cfvncw3xhfUpBuWgzxmobNRJyVLNFcbltbHei13QOhaqQVqeiGwO:qi1ncgCuWgzxmobNDuNFutrei9haqxmB
TLSH
T1C0D35B017745C1B5E4AD02B96A78FB65936FBE70CB9402C3BBA92B6E1D701C25F31A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

humanoidAnimateLocalKeyframe2.rbxm

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\fonts\humanoidAnimateLocalKeyframe2.rbxm
Size 22KB
SHA256 743c10d343ff5cd404aaafdf8afff8a832f131d8878432d20f3140dcef791af8
MD5 41aa17b2c2b4390034da9e3de391d16e
SHA1 7ef171c537aea18bb0e0dd985cc9ed7979762138
SHA512 518e6dd64a1858717f659310a25df1a613b690c73c883de5ecf835042f1dba584643b4e06ab223a17dae7d939eb90a442f459dedc6c8130da5b78ebceed48510
SSDEEP 384:bd/CM4pRgITcI45p4aAT+b3XB5CtUW/mGag3XB5CnHQWScpD+G0iPr2L1IAKjMrw:1PwQIaiURgRi0iPrkCjMTRZA
TLSH
T1DFA24111BDF21AA50ACFF7638436034BE97B1B20123452F4F5EF7A9E10015D74E6B66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArrowCursorDecalDrag.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ArrowCursorDecalDrag.png
Size 283B
SHA256 f0e82a0c5d05ca94dd997e8c3a55dddf43754484e93d8ab36941a5279bcd8c78
MD5 b1f62754035b8d2f1326af35263155a0
SHA1 7d54aafa89cbe40ac25008bdace179f0fca0a809
SHA512 815eeeb9e15ab9347c18cc5261408ea6e9b28ed747b97395a43fb754056c36ab710a2652fc0347309351c965b4cc5f7c8c3ab4a2186e705c1943fa2f1bd6e09a
TLSH
T1D3D02BCF87E57477C7483FB2931618F44D272D3EA117E8C925E598182D7419971852D3
MD5 SHA1 SHA512 TLSH

Submit Download

ic-scaling.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Body-Part\ic-scaling.png
Size 255B
SHA256 d76886195f38a59b58f58ae95a1d45a5b50d6fc6a485b0fa22859859ab570300
MD5 0d2186761b226c02ce250a4b3788a1ee
SHA1 340e8d866c59888bc34575fb309868cd107d6425
SHA512 3491fc889a73e6f79500e30afff9d00c6b383748bd167d198050f1fda8aa7770085d1482431eb07aba68b26bbc75caf001ce1513282776383617e51b2a0c0563
TLSH
T1A2D095C51152485C7CD8A1E11039CDD3C13F5DE58377B81F3D25702242114448BD0315
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\AvatarEditorIcons\PageIcons\Body-Part\[email protected]
Size 375B
SHA256 2a05eb6a166b67b8f373fd562df499c534c0f2138849d87af3f0a69b6e68599c
MD5 4357c2b932c6733cecbbca780306721a
SHA1 556f9f9c86fd6df871cf04c7c3ed3617d967f13b
SHA512 eab40d1c1afc5827c6b50fb99cb7953ca4545c8c43a58447f533be8c1b2b17a323625a522d36db2df5cad8380115bfa085fa2e8106afb5d0158d007194cf5e74
TLSH
T135E0F8E251684CA888342873A67F810C9B38313E1806603880BE28E299C3080D02EEA0
MD5 SHA1 SHA512 TLSH

Submit Download

Exit_ovr.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\Exit_ovr.png
Size 3KB
SHA256 0b54cf53004a2efbeed2dad4344b0745f3b15488ec1e8505e437308c599f3184
MD5 d36e2398b06c451a10a9f0d0fb57856c
SHA1 f5d0d7f8715df7425c5cc91d0ed1e0116bad44dd
SHA512 bffe5dc56ebacaf43b069212d4e17317b48ea4771b6a82ca39fdb871fe0ef3444555d580f0ad5a79f6d1837b53e473eeab589e9af55f1ec5c5d9a8a3ca2affe7
TLSH
T1B2510840FA05EE01C56CDA9324FC4016C9B75FC1A9E8A8B12CEFF11554681F28A675CB
MD5 SHA1 SHA512 TLSH

Submit Download

SettingsButton_ovr.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\SettingsButton_ovr.png
Size 3KB
SHA256 800cee001c48f5cd749929bea4c6b782becef96fdf7072b39a515082b6925f15
MD5 172789ea92d3e10366147165933c7913
SHA1 f81fcad555b52d5322349eda05ade9a89d5f4da9
SHA512 72e0a776a9d21a696854db9a54e16a9313ece1cdf4d23236efb281551e85e171f4578e3b10c5a48ec8a7c7ca236b90cbe8186f99ed63e740389c3e7e6d4e3d94
TLSH
T17B616BD4FA40FDC51E1CCAA63CE7C321492709A08430E9F3BDEF09B9E5A40E06208DA7
MD5 SHA1 SHA512 TLSH

Submit Download

cancelButton.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Shell\cancelButton.png
Size 3KB
SHA256 a6200e93b8243029b1845c542403c03c5e21126728e9d1091fecd872b244cff6
MD5 60095260e0f0582f985bcd8c690ee958
SHA1 338be68b66854e218059f137e9988b290bb796cb
SHA512 de1891ba8239cc3d69fca080e088c769906bdc57093104f26ab819e20f1c152f1f662e7eb6592040ad8b738bac34d65ab8989d113e4c2de617291b8c215a49b2
TLSH
T1A8614D2EE7C65C425687C1934DC5B823F13247506E55E8F7F88EBCC62D600BB90286EB
MD5 SHA1 SHA512 TLSH

Submit Download

Slider_sel.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\Slider_sel.png
Size 1KB
SHA256 e191ccaa92c0a1366673d6a1c7374dd7e5fec2a9c39980b17584398492a22af7
MD5 1b1d274287e578b30666e664eb8c6466
SHA1 fa5283c6c56ac54e4fc8f4239e8b3dc82bb700cc
SHA512 8b1b6365838dcd2c05e874ae27b99cfa1fc2bb13807840c01f75c9f0673372c913ceae8f8f269c5276971869a8216ce761959929629196805bd3820c72566cc9
TLSH
T17321428DFA41FD43915ADBA619E50127D8970640E980E8B7ACAFC45E88261FC8A1C6CB
MD5 SHA1 SHA512 TLSH

Submit Download

Connecting.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\Connecting.png
Size 713B
SHA256 f46167eca0486c0c3b17101a7867473bc7267405a7e52ed1cdb9fbd284488917
MD5 3bc4f0d4d99962a43837d553dcd119e6
SHA1 238c6b3e8127f4d8757f706b4a8881dbab5b6b71
SHA512 c62ab6306733e7f897cc671a8406d957959945e02793869ad876281e482243cf47fb72073ff297ed4cc2a6c44e934cfad3ff1b122aff215f1beb3f8b31ab7891
TLSH
T16C0194CC47889537D10DCE272F196F947E23CA0B9B2784582E052906F2CDE94629438F
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\[email protected]
Size 1KB
SHA256 5450e55928730fd87c2959f86f9f8384a9a42f28036f060a1d9a8cf427a5f89d
MD5 7b52f8ee3c3c25bfa48533bfe09fe9d9
SHA1 4cf4761b5b87779aa551b9f0b79d5e7ae7b2a9c2
SHA512 f4f9738d3addf3d345f2129ad63d8f7546e9d5cb6f0047c127151746e29f26fdaaebd3099bb699067e26e1723a9f79b8334ae09f59cc6a6ef8c3368a789af13e
TLSH
T10731EAD1E316398D6A6F46A4823C3D25975B79B5DC531046922023C3CC19235E2CD4D4
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\[email protected]
Size 2KB
SHA256 a9f9ceeedf429938128730da7ce7ccc205887b2f60d7525d7cbf4e47b904059c
MD5 2a0b8f4c96098ff969cae6dfab8ff235
SHA1 74e40bedc43b8aa580bebfa50f90fe9ddc8d2b25
SHA512 509f5c9e6a4a932462cefa1d034f2400fb20b3b4812e5fb8064dc5156a3bf7c8d5c09ac0a971664a8fcffa709b05673f4fda078652e92ed870d26367425d9da5
TLSH
T1C3514B1C8935177E999E865AE1BC31106B81F8820410A987CC45D17DBBC7349BEB0E93
MD5 SHA1 SHA512 TLSH

Submit Download

Unmuted100.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\Unmuted100.png
Size 333B
SHA256 c3ca19bafb19d7c2162815f16c1374eba1c84be6ef3d79c022a85d61b8707ea6
MD5 fb31bca429d72a0ccbd62408559ceca9
SHA1 faace0c928e3417bcb32771fa893beddf802c1c9
SHA512 00d2bca5cc358a2c88124b6a7dea56276c9819758aa34e29aaff6ebaab847ceb97cce8edfbfee3f1896dfb07895af34b83677e471332f74f12095342d073fef8
TLSH
T16AE02DEE07408BF9830B1332068E603087D90D761EC1911220D3D05629C188322DCE14
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\[email protected]
Size 503B
SHA256 ed2d87d790044214f2e25e3f6365738a22165a6cc792bf7b3807145cf3948d1c
MD5 1cd993c408de2b6d4fffa9ec0a981054
SHA1 06882ef7dbafab44002830018cea3ab6e4b65f8d
SHA512 c906cb2a2ade48833a1bb2290313d452b815896f56a673419fad46bc690d50c34fbc2fcdb4b5a65bb8e79f49ea4a2433a14328f91dcc88c483e359c5cab24190
TLSH
T15CF00EE7CDE017BF61179BB722E192305BEC20FA2C892B0049F38CD445129C3B08CE25
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\MicLight\[email protected]
Size 662B
SHA256 5223a1dca781e5be2d4f847449df4878f789fd312d9d81354f9d2790be2994ed
MD5 4820a932e132212ac02c8b8a7c9efee3
SHA1 28341fd9b5cd2c5ea4feae5b19dcc92ab9843444
SHA512 beb1f5e147df4f20a6508c974ed8248631edb1d3ff2da3495338af0dcf11b8fba9d0a18f8ca3351c22cbcddcba9abbaa6ff2699f833f4167621c2fc647d8b4f1
TLSH
T17E0123C681258BFD95930AA5A3901772DB81063CFD89761C1EEB01F7445D19472E0D78
MD5 SHA1 SHA512 TLSH

Submit Download

Unmuted100.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted100.png
Size 334B
SHA256 59a305c4bda7c2720715f70ca2092f6084596b032e074d95442715810f62c28d
MD5 3b8317d59ea63575062dd1c4b32b891d
SHA1 f6afc5f3b43e2328af9c01d4ae15b50c19a4cae2
SHA512 b156cd716ed35d9c1f62655dff945d124703f09a95d345c12ef47464a0b7d401bfeea3884f058c02d5b19a75416d2797ca545177b082bb7456c9024974d69c0b
TLSH
T13AE026CBA391287EC21819EA436D10A4CC6BA92E268495564D869820CF869005CDCBB2
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]
Size 453B
SHA256 7beaa78eb4b94aa5f2f6400ae5aad1329f41d63e1cc6b1a2edc136072dc0c74f
MD5 774db4404f0fe4451c1ac224badbea83
SHA1 54c58badcf367d260e11f9cd3d681b0eff323fe9
SHA512 fb4ed86d0afcb4dca89e19bfc4c5a230db32c24bd2bee55d9b6422afdf8dbeb0da4b569efcea5298a809584cca64edf7adbd81f0b5f61e481afcbfef1c2f16f6
TLSH
T1AEF0D4D7BAC20C7D902E55EDA5085257A09F701D6AF485D45C3A40271C378101D3D922
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]
Size 582B
SHA256 30d1af1a08278ade6a4cc1bf12e7e33e521960cdb2af5c6ecdde74f12637c52e
MD5 ed1f5e299befd291b87c57bd05608726
SHA1 66e58921bcfb8145053e31da21874fe962dc2719
SHA512 61ddc46c77eeeaab2d38517766846b89f3859b4f7c7868750c45019b92dab24b6a3712582da8fd210098324f5399c43b7398c11a1cf82573f63fbd78186006b6
TLSH
T107F0E15F6A9B1558BC14057D1312E3DBB98F4494488596EE2E89C021D4479996CF2733
MD5 SHA1 SHA512 TLSH

Submit Download

Unmuted100.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerLight\Unmuted100.png
Size 276B
SHA256 dd52798a4274b9edb87de01f41c6b33cc520393edc4e363fd403a5755c0ef737
MD5 8bfdbb7491a33d684d34232cb6705424
SHA1 5015769d98ccd3b7644285d058754cfb79567665
SHA512 1bd91af3722eebf6b9222c21b88770ad10c70fa9fab6546c46b16a521ee53f1224d82a522f6724b02095c68d921be74952fb450da35bee8712b50baba7a6a601
TLSH
T17CD02BDE4B666B7BC308965E80554370CB9B353A6E11510844D39075281719A7194FA0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerLight\[email protected]
Size 393B
SHA256 0bc5c352ae4670dc38145cafaf7b0cddbae6a3f063623bd183da4faf10a447fa
MD5 585cc5eec345569f6081f19c031b015c
SHA1 63099f8809d30c47ae15d5be13d2c3b1af0e1834
SHA512 ea2aa996b15abf05d4cc21c433c4c4136fcb5d39f2656bb2e0ebc932e50af85cb6fae6fa45ecb2dae388d28611a51af30cca08a419da0efaad066ce2a54e58e4
TLSH
T172E0F1D71A852FFB83038CB791845147DFEA04795DC511440BC388081D705837CCDD70
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\VoiceChat\SpeakerLight\[email protected]
Size 491B
SHA256 fc3b733b7c9191b777bb8b8be5580fba7b00f305369f7ee112751b1bf78387bc
MD5 ea85095542d42a07b1b00cdba0fa18b3
SHA1 8c795ff03fe7e00644f8618c25e2b90c0799ca47
SHA512 2ede483942daccb60c1a97ddd88c3cf5fb7d3765cdf485b1bf377865abe34920f8a49227e6e1747ce7330f1eaedbcb55fdeb1ca5df351797fd71ea4be6a1bf7f
TLSH
T179F097EA5450A7B82A8282FA7DC6A630CBCA04353A2C7A8C1CD742A58A954C764D5FA0
MD5 SHA1 SHA512 TLSH

Submit Download

scrollbuttonDown_ovr.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\scrollbuttonDown_ovr.png
Size 1KB
SHA256 a6198e5b99c10db095aa2b80251534f670425a746f0ab0f66b0f458b9ae5b7e7
MD5 4b1ea5c4ab2e2ef715d4df68ab39165f
SHA1 e8859bdbda1e297decdc35d7ca34820771a31221
SHA512 641f9cbe0bc221491592ed2a86f21940a7de38cf72f55d614dc3bf6f705c4a4c7b630e5c72b78ccc9cdcd1eef553330951d9221700d8bee0fad4e2443c13da6d
TLSH
T16411634DFA402840D18CECA13DF3A42F98620A8089D0E9667FDAC41A0CB26B4984D9C7
MD5 SHA1 SHA512 TLSH

Submit Download

scrollbuttonUp_ovr.png

Path C:\Program Files (x86)\Better16\Versions\version-478697a0a9b946b9\content\textures\ui\scrollbuttonUp_ovr.png
Size 1KB
SHA256 2dec5468ea7310616708b7f8a6224f90628035826a3b885b622d1b1ae124d29a
MD5 8540a19e338e00a7e1184cc8d3f7048a
SHA1 911168941080c7a56a5c96e2e523c0c73e9d30ff
SHA512 e9495b3ad4b62961fd26262e687d02c62355838f48511facef731abcc4f880c167489140c40e4715c4b408f0ab0a625cba76952a795591177edec23bb4b33c50
TLSH
T17D11864EF9006010929CEEA23AEA603F9C264AC089C0E9B63BCEC81A0CB0571C8499C7
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 24579cec9bc50f0f4d4c912cd0f1ef70f4f050619b0d07051f1c198da0efa585
MD5 08ee3bcb32c8a449c286cc1bb4920727
SHA1 cca4ee7b2981c407621bcc5ffdb7152ae9ea9bac
SHA512 c8edf0348be9524af6fe71b3a813afc3e6adbf9b647cf8c238435550c4d16b215520b65caf246d3d1889d66b2d0e6fee47de929253ac10303355850f16ff800c
SSDEEP 96:lC6ZId+hK2ilc3fBgqho/LCwVRDotok5gREDmB6iGyvFEGwpFbmWaV4a:lCTL2ilYgm0eiDUD2y2yNGWFbvO
TLSH
T164A10A32E5A999BB54F39584B0427E43CF64B19B55A29F84E9DD2E0C11F71FC0342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1edc6ed2-4f8b-4abe-960b-c6900939583a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1edc6ed2-4f8b-4abe-960b-c6900939583a.tmp
Size 34KB
SHA256 db964406904f5cc4779a23af2c4a878a4097818d883c7646dc8ad7a7c1e2d9ef
MD5 21c4322d73c885871ebca06c5140e40f
SHA1 d1940839425a1f48ffb83f26eecd955f6c35a43a
SHA512 425ea5443d03dc76a7be9ccb0d12c05c780b21f0d7eb296e12e27884d1f9ca138e7b64207da14f97213b59d283ed4479a48590f9e62c6b9fdfffc81c38fb3b32
SSDEEP 768:hY39uBf9cPftIqsyEMbxyJugQVTJ7vvmeXlxTS:hY39aqsyEmxyJJq17vvY
TLSH
T191F2BF31A871CC7398F7C1C57686B647AFE4416399C91B84D4DD6A0E068B6AD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c2d0aa5-1f6f-43ab-b4e5-103c063e95de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c2d0aa5-1f6f-43ab-b4e5-103c063e95de.tmp
Size 34KB
SHA256 688145b5af7530c1bac74bba5e2b59d49ed13cbcebc27e39692cdd9106985bc5
MD5 273c743c4007955d138a323d4432043e
SHA1 bd00085030ba3e209dbeffe6d73d7cc4b362edb3
SHA512 36046ce7039bdccd6aa44f554186921b3e562707e2aa1d505730b61914b18f3406c92e3d1000f97970ed0d01328668e20901d3847b108f45f0df1900d836c5e2
SSDEEP 768:xY3IMBf9cPftIqWyEMbxyJugQVTJ7vvmeXlxTS:xY3IYqWyEmxyJJq17vvY
TLSH
T16CF2CF31A871DC7398FBC1C57686B647AFE4416399C91A84D4CD6F0E068B6AD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

1ff79ffd-edea-452a-bb36-9bc2067b20c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ff79ffd-edea-452a-bb36-9bc2067b20c7.tmp
Size 11KB
SHA256 c5a8f0daf56316db32cd886ae8ec2755fe2fcc9bbb8ebe7a0ee76eb19b245131
MD5 555a18e9b48092ab122522a395a1a093
SHA1 92df750adc85cef1a649f83ae35eda358040e7ef
SHA512 5af7205bb44970805f172e5dd4ad102469899bfc92c39f93596eb6459fc8af6200bf19ee81292df8449490595811f0bfe713ed42bcb07b43b1a110a3e0572f40
SSDEEP 192:sxR5tlhRksC0lZ/feXsxhZQ++XlGzoA8pE5p/g6+WNx5bItW/YFIkDzGIocIgVyJ:sxRDWY/fMsxv8K/5D/kI
TLSH
T10A32C715AD28A93B8CC7D25DBB66BF53D3F91032A1D51E48A6FC861C15E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27e84a3c-30c0-4bc8-825c-3984aebb286e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27e84a3c-30c0-4bc8-825c-3984aebb286e.tmp
Size 11KB
SHA256 3e08e40cdf2f93b5bc440494cb700ed306ff9d33ccbc10cace338d1e5ab2895d
MD5 06c5b37b7dee7f78859837fca1748e3a
SHA1 755ef37dfb2d102d4ac3a8fbf131668b901a8cb3
SHA512 f4129d98a491035037c3b5a7e757bfe0081959f6140c0e007bd579e6c6e1e27f3ff6be81b92647cb58bec02bc4b09c72c7ba6209381447bc7172cf3f926c23bd
SSDEEP 192:sxR5clhRksC0lZ/feXsEhZQ++XlGzoA8pE5p/g6+WNx5bItW/YFIkDzGIocIgD6O:sxRMWY/fMsEv8K/5D/kl
TLSH
T16E42D815AD28A93B8CCBD25DBB66BF53D3F91032A1D51E48A6FC861C05E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79737fda-3619-426d-8794-ddb5f5c3ceca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79737fda-3619-426d-8794-ddb5f5c3ceca.tmp
Size 29KB
SHA256 8a02d3fc564c1f6ce6dd176afa3539aa2f9b2794cde294ef3cecffd57ddaf990
MD5 ed976582f0be0abdd5b9983801a6785b
SHA1 7613c721d8a2bc994203a5e8025aa1557c3e6cad
SHA512 41e770e6f675461bfb75ddac1b102c773e30697845d97039130b0077c55476f4845da9d4bf76dccea81fa23d52b9b74c6ccc9cfc644d71d230f0a9cf0033cc03
SSDEEP 768:+l2Pgq7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVihI0a0pro+Pzu:+l2PgCEbDKWgwef4eu1jalhIh0C+q
TLSH
T1F0D2E97B640CCA7F4F904ADDA8297E9E6DAC02CB9698C94047FA841D03C77EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8178a564-1805-428b-b171-63359db9ebf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8178a564-1805-428b-b171-63359db9ebf5.tmp
Size 11KB
SHA256 402133d5cd1dc1ebe4450ec739b73cf3917092e8108ebb8b969bfece008328c7
MD5 db8657a40d6a7ce2a58e8ae8e5238f39
SHA1 c27c1d965ff0aa51b44a1c7891f348be93d10ab1
SHA512 90d55abc19d89c99017a44b1a2d854c607a139ceed2e8ee5e0cda0f71280f0c3b9960e0b5e8be0be8a4af9b2a414b12c3144eee175f0fd325513241a9c8e8305
SSDEEP 192:sxR5clhRksC0lZ/feXsvhZQ++XlGzoA8pE5p/g6+WNx5bItW/YFInDzGIocIgDgO:sxRMWY/fMsvv8K/5D/BX
TLSH
T15F42D715AD28AD3B8CCBD259BB66BF53D3F95032A1D11E48A6FC861C15E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b7736553cd5dedcf73a7bd5da8621e0aff86c40d878a520448c974302456f394
MD5 fc242e280c9f6f2557f05ba8e2be7d1b
SHA1 7dafda8ca707ddc2821e85511e325d6c5e18adb1
SHA512 481807661377e0ccce388a26094951c66cd21eeabcc48799e041868e7214bd85e6e5eff18d09d4686710c0a013b2be3ae20a7603d31c500f7ddc7246fc43a38c
TLSH
T1B971B486669D93F5FBD8403198E35E8F3AFDCAD319832FD301D2E776A8463694055C08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91fb46825ab28efde114f14bf0b7f33361b3e063f862b5cb729fade833fc77d1
MD5 6df184fb6119bc7fd6c738c0f83e28be
SHA1 651ab73ef292d6996ce3a7dcdc8806d4f8ec2e4b
SHA512 4b93d3b3295aff78134b623b443efd350597fbae7633990ac66f92e921ea32c31c184a455c0f2c0fab23b845e1b56d66748dcf1df8c265fe89f4c1d4e46d4095
TLSH
T1B361B386665D83F5FBE8403188E39E8F3AFDC9D354872FC301C2E776A8463298065C48
MD5 SHA1 SHA512 TLSH

Submit Download

d7e0995c-b933-4455-ad07-cee4b8e49cf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d7e0995c-b933-4455-ad07-cee4b8e49cf4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2be905d5-4788-40eb-8f94-3aed858c5565.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2be905d5-4788-40eb-8f94-3aed858c5565.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9723819c-eeb1-444c-8b14-1e12beb7c14b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9723819c-eeb1-444c-8b14-1e12beb7c14b.tmp
Size 3KB
SHA256 fa5c7d16508fbb24fe4e46886a49f36910b3e2855f3247e0dc39679bfb1ee457
MD5 d8c74bd74ea10ad2e96e9c6204996889
SHA1 9bd73cf2ff73a95e44cf71f3214e8266dda23573
SHA512 af16802c1325930ad9cb3e28356d37ba47ada57778820a24aeb57180666deeee2d6474806a1afb271d596d29cee3e3cd659cdf404d1c83c6839c442a44c4ff83
TLSH
T120719FF7C3E48A2D8D1156F0AB187E2BDE1D0915832C3D5AC8D5DE1BA3E2470D24165F
MD5 SHA1 SHA512 TLSH

Submit Download

e9134aee-2814-4c90-a460-97952cb4d0c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e9134aee-2814-4c90-a460-97952cb4d0c0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eaf2c495ba3130a3d0707eff9820c5a1143d0d4b656d5ed0a9a15516294ad705
MD5 86dfa306a8a2c5718c5dbebeff2a2f40
SHA1 ff638318c9261fd898484786111eeea103896808
SHA512 2062a9cc90ed4f0918d3cb077cfd125e2a250929a217d7745762db97b2c578711ed1b27b273c07156c4ea17e81eaf352f8b2ecd05e1605d2dfb3fe909d8e77cd
SSDEEP 48:KgZIZKyM0Dyt2pimMQUkkQ3PI3ukK6BC0keG05XMG5y1pI5Ky880:KgZiKyMKfv6KoMmmpSKy8L
TLSH
T17291626671364240387D7A0C40A8E72ADA5231BB3119E5AF77EB41A24F6BE049CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef307355-2695-41a3-a471-b5dbe5b6e0d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef307355-2695-41a3-a471-b5dbe5b6e0d9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26263fe6-344f-4555-8822-7dac2c5f8c4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\26263fe6-344f-4555-8822-7dac2c5f8c4f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af35458b-9bbe-4b20-88ff-80a20895b2e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af35458b-9bbe-4b20-88ff-80a20895b2e3.tmp
Size 37KB
SHA256 2abc5eb7c92d3dbce34b1d59be548d7fc349d7cb0220b350fc98277e22d39f88
MD5 4087e6b261c770472356c5c0380ca7b4
SHA1 80f69f547ce12f23240b5adb85ccc0fdeba2c830
SHA512 9f548eb444fc3c07726a2c22358657e6120cfaf9288577394b4633a1e94b927e8f97485aa99bcf88818720de5197c034776b7fd7a877861477a80678da241e42
SSDEEP 768:p/UxvxjgC+k3fff9cPftxyEMbxyJugQVTJ7vvmevuSHtBk:cZj3+k3FayEmxyJJq17vYSbk
TLSH
T1A503C036ACA59C7388F7D2843649E787EFF505A384C62BA485DD6F1E128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2491cf11-0b5a-4de4-be98-a023289553ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2491cf11-0b5a-4de4-be98-a023289553ed.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

2fd3c21a-b9b0-4b23-99e7-df0a31109740.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2fd3c21a-b9b0-4b23-99e7-df0a31109740.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a98785a2-eb9a-44ea-af59-bbd98f89b784.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a98785a2-eb9a-44ea-af59-bbd98f89b784.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

faa4aee8-4a04-4c7e-8adc-e763a88bc5f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\faa4aee8-4a04-4c7e-8adc-e763a88bc5f2.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

da2b43de-4580-4b67-aabe-06e4d9097df3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da2b43de-4580-4b67-aabe-06e4d9097df3.tmp
Size 42KB
SHA256 1f1624107916ea32853268430e26bd8329aa50560f2aa1f3d3cd1dd4ceb46283
MD5 8335f3ceb6c2a0ec6eeee8a3a033a8e0
SHA1 2704dc4c05ddb761cab6f9fd88a931e84fc10170
SHA512 0c6a3c657d5a27e0fce894f7eff8c3edf21edf77ccd557ae61d44af8c28a5f5e9c1f85414891accc3dbd3c5bd4111d6b0e71fe56a4f2717fb38769c256a55668
SSDEEP 768:EFQx31wgaeOhi9cPftIquyEMbxyJugQVTJ7vvmeXlxTS:nx3+4quyEmxyJJq17vvY
TLSH
T1A21338F298E38977D8AE8783677D6E469AFCC163B5885584B7C81D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18125cd4-67dd-4b7f-8ae0-857b3711de1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\18125cd4-67dd-4b7f-8ae0-857b3711de1e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

63fd4e2f-5ca7-4537-8773-1ac4b619efed.tmp

Path C:\Users\Admin\AppData\Local\Temp\63fd4e2f-5ca7-4537-8773-1ac4b619efed.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71af9f1f-d4c7-4c7d-96fd-e28df9c6efe9.tmp

Path C:\Users\Admin\AppData\Local\Temp\71af9f1f-d4c7-4c7d-96fd-e28df9c6efe9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4496_1127795251\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Better16 Player.lnk

Path C:\Users\Admin\Desktop\Better16 Player.lnk
Size 1KB
SHA256 d1a11b3c4891eb03a31c7fb5b676c7d4ed226d7fe16d42c83c6151a2187a69c5
MD5 18c892c61b49dece4e16c5145753d1a8
SHA1 4f998827b305374de6865742cc0a16a6a2629d7d
SHA512 52f9a9ac6809d89890e503856095cb82529211d32daf0adfe4b146e648d6554d0f9b3fe014523d3dc64db4cedb87a03f4f8be40c59056cccbd511e343c70a049
TLSH
T1EF21FE250FC1477BF6778372947A1601F2627C02B9551F2D1094424A45A124CECECF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Better16 Studio.lnk

Path C:\Users\Admin\Desktop\Better16 Studio.lnk
Size 1KB
SHA256 5c2344c5c6b3c19bf707b5754f24514fa32c0eed4af727bc6d05f10f9e6ddcf1
MD5 80954d1b28b0968b666ed52f15248514
SHA1 b33d05c2b4ac10521ea81eddbcf39b6d0cb30344
SHA512 ca9b7ef88749ba53f7d23f2c6d6e6fdb0ea384a4442c9fdaee85b90413391ed987245288128b4b938b2be4a19b98f2d2eec427f74bb6bb7712c09113131592a8
TLSH
T16021EF540ED1076FF2B3C672A8771614E6B3BC02E9565E3E00D4038A4BA2344A8ECF6F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1568626033\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_1680972968\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_58215841\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4496_830479881\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download