hxxps://www[.]roblox[.]com/users/12903506/profile

Analysis

max time kernel
1048s
max time network
1050s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com/users/12903506/profile

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Executes dropped EXE 29 IoCs

pid	Process
1836	RobloxPlayerInstaller.exe
4512	MicrosoftEdgeWebview2Setup.exe
1392	MicrosoftEdgeUpdate.exe
3096	MicrosoftEdgeUpdate.exe
1636	MicrosoftEdgeUpdate.exe
2076	MicrosoftEdgeUpdateComRegisterShell64.exe
2332	MicrosoftEdgeUpdateComRegisterShell64.exe
1996	MicrosoftEdgeUpdateComRegisterShell64.exe
4232	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
1728	MicrosoftEdgeUpdate.exe
4452	MicrosoftEdge_X64_122.0.2365.66.exe
4932	setup.exe
3416	setup.exe
3088	MicrosoftEdgeUpdate.exe
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
3352	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdate.exe
2548	MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe
3760	MicrosoftEdgeUpdate.exe
3372	MicrosoftEdgeUpdate.exe
3584	MicrosoftEdgeUpdate.exe
3984	MicrosoftEdgeUpdate.exe
3532	MicrosoftEdgeUpdateComRegisterShell64.exe
3080	MicrosoftEdgeUpdateComRegisterShell64.exe
2824	MicrosoftEdgeUpdateComRegisterShell64.exe
2440	MicrosoftEdgeUpdate.exe

Loads dropped DLL 33 IoCs

pid	Process
1392	MicrosoftEdgeUpdate.exe
3096	MicrosoftEdgeUpdate.exe
1636	MicrosoftEdgeUpdate.exe
2076	MicrosoftEdgeUpdateComRegisterShell64.exe
1636	MicrosoftEdgeUpdate.exe
2332	MicrosoftEdgeUpdateComRegisterShell64.exe
1636	MicrosoftEdgeUpdate.exe
1996	MicrosoftEdgeUpdateComRegisterShell64.exe
1636	MicrosoftEdgeUpdate.exe
4232	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
1728	MicrosoftEdgeUpdate.exe
3088	MicrosoftEdgeUpdate.exe
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
3352	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdate.exe
3352	MicrosoftEdgeUpdate.exe
3760	MicrosoftEdgeUpdate.exe
3372	MicrosoftEdgeUpdate.exe
3584	MicrosoftEdgeUpdate.exe
3984	MicrosoftEdgeUpdate.exe
3532	MicrosoftEdgeUpdateComRegisterShell64.exe
3984	MicrosoftEdgeUpdate.exe
3080	MicrosoftEdgeUpdateComRegisterShell64.exe
3984	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdateComRegisterShell64.exe
3984	MicrosoftEdgeUpdate.exe
2440	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{983A8821-FE45-462A-919F-41A3B80645B2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 18 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 42 IoCs

pid	Process
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\Trust Protection Lists\Sigma\Advertising	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\fonts\NotoSansSinhalaUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\xboxLB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\TerrainTools\mt_terrain_clear.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\MaterialGenerator\Materials\LeafyGrass.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\particles\fire_sparks_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Translations\UIBloxLocalization.csv	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\MaterialManager\List_LT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\VoiceChat\MicLight\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\InGameMenu\gradient.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\StudioSharedUI\audio.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\StyleEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\AvatarImporter\img_light_R15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\TopBar\HealthBarBase.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\fonts\RobotoCondensed-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\AvatarImporter\img_dark_R15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\MenuBar\icon_maximize.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.66\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUED34.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\TerrainTools\mtrl_crackedlava_2022.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\ButtonRightDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\fonts\families\SpecialElite.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\AnimationEditor\button_control_record.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaChat\graphic\gr-numbers.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\Trust Protection Lists\Sigma\Social	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\TerrainTools\icon_shape_sphere.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\TextureViewer\confirm.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\DefaultController\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\VoiceChat\SpeakerDark\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ViewSelector\front.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\advCursor-openedHand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\GameSettings\add.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\GameSettings\delete.PNG	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\Cursors\DragDetector\ActivatedCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUED34.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\CollisionGroupsEditor\unchecked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\InspectMenu\selection_regular.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\Locales\tt.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\StudioSharedUI\radio_selected_disabled_dot_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{983A8821-FE45-462A-919F-41A3B80645B2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{983A8821-FE45-462A-919F-41A3B80645B2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{983A8821-FE45-462A-919F-41A3B80645B2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{983A8821-FE45-462A-919F-41A3B80645B2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.21\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{983A8821-FE45-462A-919F-41A3B80645B2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 652960.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
2848	msedge.exe
2848	msedge.exe
1652	identity_helper.exe
1652	identity_helper.exe
3420	msedge.exe
3420	msedge.exe
3752	msedge.exe
2604	msedge.exe
2604	msedge.exe
4036	msedge.exe
4036	msedge.exe
1836	RobloxPlayerInstaller.exe
1836	RobloxPlayerInstaller.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
1392	MicrosoftEdgeUpdate.exe
1392	MicrosoftEdgeUpdate.exe
1392	MicrosoftEdgeUpdate.exe
1392	MicrosoftEdgeUpdate.exe
1392	MicrosoftEdgeUpdate.exe
1392	MicrosoftEdgeUpdate.exe
4604	RobloxPlayerBeta.exe
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
3352	MicrosoftEdgeUpdate.exe
3352	MicrosoftEdgeUpdate.exe
3352	MicrosoftEdgeUpdate.exe
3352	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdate.exe
3372	MicrosoftEdgeUpdate.exe
3372	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1392	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3352	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1632	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3372	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	MiniSearchHost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4604	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3628	2848	msedge.exe	78
PID 2848 wrote to memory of 3628	2848	msedge.exe	78
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 2560	2848	msedge.exe	79
PID 2848 wrote to memory of 1828	2848	msedge.exe	80
PID 2848 wrote to memory of 1828	2848	msedge.exe	80
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81
PID 2848 wrote to memory of 5108	2848	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/users/12903506/profile
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7ffa13953cb8,0x7ffa13953cc8,0x7ffa13953cd8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- - C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    PID:4512
  - - C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1392
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3096
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1636
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2076
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2332
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1996
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQzNDMwOEMtMjRDQS00MzZGLTk3MUQtMTRCRkNFMUVBMDk5fSIgdXNlcmlkPSJ7N0M0RDQ3MkYtMTZCMS00NTNBLThFMkYtQzA3MjJERkE0QTM4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyODVGQzFFRi01NjM4LTQwQzQtQUEyNi00RDQwNDA3RkMxRDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDMuNTciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzQxMTc4MTA0IiBpbnN0YWxsX3RpbWVfbXM9IjYwNCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0D34308C-24CA-436F-971D-14BFCE1EA099}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4964
- - C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe" -app
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9849361896158870227,6704908381048052082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:Ati-FT76v4l1uVLDj1Yeb1xzIBEKLXY4UKwaXdVm__Wama6JdtYKRNP4HyGZF6ljBSdrSGW1DDwkBob1mWFwSutUxj_uVuDkUbVvPSxuRhfsyzikY2Dg8xj28zq5b6a1oR-e1Ff3A0b2QIIyYStLJ8az33Jzyu_8vhiRQ98xUsDoF0sXUiNExrpv68wqALVL39IOEm-32spLMKma4Bu6qr2BzMlg5gYrXVeVDg7oxvY+launchtime:1709767064631+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D220180560842%26placeId%3D155615604%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D5a928a60-c21e-4047-98f6-f07fbe787b93%26joinAttemptOrigin%3DPlayButton+browsertrackerid:220180560842+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4124
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQzNDMwOEMtMjRDQS00MzZGLTk3MUQtMTRCRkNFMUVBMDk5fSIgdXNlcmlkPSJ7N0M0RDQ3MkYtMTZCMS00NTNBLThFMkYtQzA3MjJERkE0QTM4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEOEZCQzNCRi1DQjU2LTQzMkQtQjA0OC0wNjYxMkFGRjg0NjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NDU1NTgwMzAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1728
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\MicrosoftEdge_X64_122.0.2365.66.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\MicrosoftEdge_X64_122.0.2365.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\EDGEMITMP_981D5.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\EDGEMITMP_981D5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\MicrosoftEdge_X64_122.0.2365.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:4932
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\EDGEMITMP_981D5.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\EDGEMITMP_981D5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.95 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9625AAA1-55D8-4CA2-8CBE-965BD885DCA3}\EDGEMITMP_981D5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.66 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff6da4f69a8,0x7ff6da4f69b4,0x7ff6da4f69c0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3416
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQzNDMwOEMtMjRDQS00MzZGLTk3MUQtMTRCRkNFMUVBMDk5fSIgdXNlcmlkPSJ7N0M0RDQ3MkYtMTZCMS00NTNBLThFMkYtQzA3MjJERkE0QTM4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NEY5ODJDQy05QzIxLTRDRjAtQTk2Ni1BMkIwMDFDMzBDQTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIyLjAuMjM2NS42NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc1NzI0Nzk1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NTczMjc5ODkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTUyMTE0MjE5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wZWZkM2I4Yy03NjJmLTQyYTgtYjYzNS0xZTU4MzFmYzA3YzM_UDE9MTcxMDM3MTY4OSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1UQ1M2Sld2Nk9vTyUyYjhYSlkxWEhRZmlsZkNVY0pFV0JJSWFXM01ITTB6cENZdWQ5eURJQXJ5S1c2TDl5Q3VkazZDeWExMXElMmJSbWZzYkFOTzl4SFV3R2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzE2MjI5NjgiIHRvdGFsPSIxNzE2MjI5NjgiIGRvd25sb2FkX3RpbWVfbXM9IjMzMjk4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE1MjE4NDE5MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNjU5MTQzNDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2MDY2ODQwOTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NTAiIGRvd25sb2FkX3RpbWVfbXM9IjM5NDUyIiBkb3dubG9hZGVkPSIxNzE2MjI5NjgiIHRvdGFsPSIxNzE2MjI5NjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MDc1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:3088

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4B2CEF23-CEE3-46A8-A000-719DD7996356}\MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4B2CEF23-CEE3-46A8-A000-719DD7996356}\MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe" /update /sessionid "{3825E0A5-0789-4857-8A97-26643127A8F7}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2548
- - C:\Program Files (x86)\Microsoft\Temp\EUED34.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUED34.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{3825E0A5-0789-4857-8A97-26643127A8F7}"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3584
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3984
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2824
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzgyNUUwQTUtMDc4OS00ODU3LThBOTctMjY2NDMxMjdBOEY3fSIgdXNlcmlkPSJ7N0M0RDQ3MkYtMTZCMS00NTNBLThFMkYtQzA3MjJERkE0QTM4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RTVGNzNEMEEtNzU4Ri00RjMxLUFFM0ItMTlGNUU2ODE0RDc4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg1LjIxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzA5NzY2ODg1Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjg0OTE1OTY3NSIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:2440
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzgyNUUwQTUtMDc4OS00ODU3LThBOTctMjY2NDMxMjdBOEY3fSIgdXNlcmlkPSJ7N0M0RDQ3MkYtMTZCMS00NTNBLThFMkYtQzA3MjJERkE0QTM4fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDNjFCQUEyRi0yOEFFLTRBMkYtQjU5Ri1GMkRBNkM0RTRDOEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODUuMjEiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTY5NTg2ODEwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5Njk5MjYyNTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyODM0MTAzMjI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmY1ZGUyYTEtNWY0ZS00YjIyLWFkNTEtZTM5ZDIxOWMyNGM1P1AxPTE3MTAzNzIwMTAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TnMlMmJ4U25DbVRvQUVRRlB5VjJER25GY3NiWW1DcVZaRmZ3WjcyNzRpYnBYS2wxdlNWWSUyZmRLY1VkRSUyYkpROExtYllSUVlzTnRHbyUyYmVNV2theHNiaGF0QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxNyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjgzNDEwMzIyOCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmY1ZGUyYTEtNWY0ZS00YjIyLWFkNTEtZTM5ZDIxOWMyNGM1P1AxPTE3MTAzNzIwMTAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TnMlMmJ4U25DbVRvQUVRRlB5VjJER25GY3NiWW1DcVZaRmZ3WjcyNzRpYnBYS2wxdlNWWSUyZmRLY1VkRSUyYkpROExtYllSUVlzTnRHbyUyYmVNV2theHNiaGF0QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MTU5NDQiIHRvdGFsPSIxNjE1OTQ0IiBkb3dubG9hZF90aW1lX21zPSIzODIxNDMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI4MzQyNTk0NzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI4Mzk0MTYwNjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzU0MjQwMzYzNzE2ODcwMCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTIyLjAuMjM2NS42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIHVwZGF0ZV9jb3VudD0iMSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0iezZFRjlFQ0ZCLUQ3NTAtNDREMi1CQkRDLTVBRkMzMTI5NDY0OX0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\Installer\setup.exe

Filesize
6.3MB

MD5
4d0d3f350b97777ae93793b5433c4ef9

SHA1
6313f217e55140d799352c049d304aef90a55211

SHA256
9ecf16cfb71281a7f81cd8bc7455bcb2220f4cbcfbe7601b209a64a63e57409f

SHA512
d38ee6da164c0f73d6d03b2ba2a778c9687bee94193457b9414f5cdebe2fe0886d83075c94b64b5cb688245d97706ba9040ef47f1b41e85294cd5f735f708482

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.66\MicrosoftEdge_X64_122.0.2365.66.exe

Filesize
27.9MB

MD5
ce89e77df891ee4a3dd89564a7087783

SHA1
384cd80b74cfd8a012b83e00439a79619dc8f7e0

SHA256
5a098d717cee345f86fd957d262f2eadb9fd1d65e3859c20b7ba7ff6a0e34ec3

SHA512
83649fdc4ddca5604f3f5d629578bc8fd7dc0f75962bde8678550255c4460ac54eb1a551a3f305e7d495de366656e79840ce289b0e939962de0d737d36fcc4bb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.21\MicrosoftEdgeUpdateSetup_X86_1.3.185.21.exe

Filesize
1.5MB

MD5
631a39288f922faddc8602ddfe384fce

SHA1
cdc494459d946206275ec8e36520553be902f3b2

SHA256
d278b57be269d3839548445e9546b14ec44cbb12c4db37786b1703917e7f886e

SHA512
11c015fba63ea7ac9e73681e0b3518559d610655aef45b0bf2885c950f0112ca12c4995582a25b21cfae0a6c9a74567d6154df2acdd3e6e14f94b35d81223e27

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU143A.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
4.5MB

MD5
6b231402f8c77196ab1714f53c70f572

SHA1
5eba295371e092709aa3f11700ccb92403226f13

SHA256
21cf6605a0f76ef3dedb1a162882d1f3daa753e6ff916fc54047264587cf18b8

SHA512
2637fe428e276c28e9965e4138e0232a593e2eeb90ccf597eb2d15e3241f384169fa083d39c6faa17c77d54e6870d4d4c74a366d134becdd19f2026c580786fa

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerLauncher.exe

Filesize
1.9MB

MD5
e8adb088f45b6ae427c978468106500f

SHA1
3d9046d72252697df072605db1f45ce15c7716bb

SHA256
13469fb08fafd48cac8bcf2e211e9c0548059d0cfe9fd7768953f60ebecde993

SHA512
d18d7c4b347de73179a0f63081df7314b7e3717adf3312dcb890b31812dd2c8d1144c8d188b0dfda2317c3b124bbafb9df1b0a4d7a07531525044a530e4a1a55

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
16KB

MD5
51036afc2d4cba6291005e5dc634f262

SHA1
f2ab1f89d59a4335bff306533becb07ea1afae82

SHA256
fcd697b3c5ac49b2dfa92b6ca28784bf33c518b5e3b01f345c93748393747561

SHA512
9b808ca746bab93860e18df797149ffdb9bea6fdad7aec6c315c07606b04a4f0747454d668a303d2b4dce3cd0735536e348a74a30f92372681757f32d861128b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
94ffad494c38a0b7c05781391410dece

SHA1
5d3aa124c899e2786a8fcbc3eeecbf52630761c7

SHA256
8032a49c78337d1813d1a72862a2c05da4c5c12d624c087d0c53e481f06e382c

SHA512
fc2a4446076f7a06704edac79700ded98dcbd4b387746a27d43cb0e32b5cc4f05448f267c5d5279aa64b817bdc90842dd050b92090644b295f10c50c7bbafd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
86KB

MD5
4923a7479f3522cbe9389d7a4862ac07

SHA1
1bc1eb916c29c8cb05f5e46deb5740b2c5e992ed

SHA256
6d83cc91996c474cc23c3a20d6cc27b91e34117d0e15277512711efb9a6080be

SHA512
3d0dda89630f837e20956edd8ec1a083c79f5934f10adfffb116dc499d3b78418929f5c557c395cd78ef58d8a23ed2ce3af302a549a9d2aabae333c3857c8cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
49KB

MD5
e82b9b583fe62ad9743f5fa28958772b

SHA1
3ecc5b3d6364475b1ec6fd5e9ad31bed8dbe0f6a

SHA256
655b52cbfb11315bd64012de6a64ab901e7b53441a413f82d0c63d926ef66154

SHA512
5f7a17813f318582b8ae3db3a68ca170c1b92480d28754db14ff3ac50ef08c14a73284aca94fbe23eee10c8a49f52496608d21c6d7b0c04aaf59e5855075620b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a05047b6daa215500c7d75c7de0b430f

SHA1
049f3145d55ba19b3d57530cb210df9b04df6d71

SHA256
e5fc426ae738cd258c0b1dac917ad617eaf9ccb5fc4bd39fe68aad13da1ea2ac

SHA512
7f60db1d7c24394465231ef695b8046efc83860cdf2d1cffd3f8ee7c546ae851781f6a27c37c63800a35ceb0c498a30754fc86abff1f6208f963b21de8bd2fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0f623b3a79a082e53f9f2abd332a1103

SHA1
b6a348b608d53bce953ea2247d587be8a99fe0bb

SHA256
64bf3ebf9445b32e549b0bc1e4c7d4607ef986ad343cb8d7b2bbd802bb071916

SHA512
5236d6150894d4209c48d640d81b4799b253093344e094816acba0071245794287ccef01f977fdd0ac43f55b63d96d787cd7d256f9313182ef162980a56c5c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
748B

MD5
9c269aea2710aec6819f3352e89d914e

SHA1
d054895e2399d821a191b5c94a5acd2eef15acb8

SHA256
97add75a1516729191401d218e8bbc689cd9d7664afcde1961c247305f885343

SHA512
ec250892b739f036f4e5eb27402a5e5a5aa51f1b201b5479da03727e6899b66a4380baef72319633a104205d570926824084f8baab35b02bf4f58bd716ae7198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe580460.TMP

Filesize
611B

MD5
4b5112bf211a41cc4fde2d562144274f

SHA1
6a019e797c902b4a4e02cadcf0a56dff562635e5

SHA256
b73543c2df665b54f02b7f1164d4211ecd191725633e75d2581c372c8b4bc717

SHA512
c9c50f858d5309e95c2980817de2f79ddfcc4973ce807cbb88bac08f69490b079c85bf363997841c4b484f7d3c8c5a52299bf326aef5579ee4a1ff665acab129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
579c39179765e42a75ecb361c24fa1df

SHA1
c9e30c4e2f90d2421bda114f6499026cd7b9d86f

SHA256
391471f25aaee4f0d6944556795c1e7cce8e05636b98835f0dfc51c65846efde

SHA512
9bffccc6ac30e3a9e599c4665f3b870d256bae7e4b03f83188851186d9d91f43a2c80b5a68e89ac9c439b7ab8c3987cd3ea8cfa7894c3cffc009e351bae54277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b864bae81ffde71784904d1d9e4ca08e

SHA1
c397e5ec55491e4b3dda5d91332ab49d2d1df2a1

SHA256
e657e9252544e1a766f557f4db09206fe6df249908ae5db74124d684eaa42662

SHA512
ad547d15c3ced61d9a16f55fb8b6e0d3a3ba94bb386815978a70228daac86c4a9d560cd73e0d725ec070a59a21b3db653cc0054d080f89a93cf560b96a32ecb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
61dd50d40428d1b999561d12544277e4

SHA1
21857add4d9824b19bb31e2f9fb6e0ecfabbf875

SHA256
f07c6267831f094fa4965c94b7e3cf208ea075931074250b6db332aa720bd4ab

SHA512
fed77bf4c5b44f6eadbd950b5f72b0cec3c65ec0011f86a81a36eb32dbba6e44b558ab96624ce2bcce072191ed892e56279f4299d25e1d9da062eaac80b3be0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca781de3991a22c770c32bfdc3c72346

SHA1
e6aa2a6e155e31d03b9009f4ff47749c02074c86

SHA256
17d905a94ef6acdf4ffe9121d95b5cd3199d3db6a42b6aadc6d408851f48036e

SHA512
cf4c19ca70043f515d70bbe6a14fa66721cba1ed5660c777007dd8510ff9126eff52e0ceee2e8af068bd19eec488ec0ca72ef4593595e74aeecd1d22eb626404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dd5863ceab5916c454008cf10f0092d

SHA1
dc2f596fb0d3b925c0143845579d5a8d50fe9e16

SHA256
43f76d15ad1adbb366d279f90bc98da9cd7c91ec489a56778aeeb8edb73fd30c

SHA512
ff2e959bc4bca37b006d2d608ab066d26de13eb376f5ebac7f92db9cbeb24793c229f4f08c615e75928a09fe57b2287b3ab607d54ccbf59f76c2b85247b0fdc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95644c9dceddfc7914bbd72bd20b96cd

SHA1
4650a8b2c4f60389b7e73c04267cb15320b2f843

SHA256
0cdf4a03c420a50b201e00213430d3b5951d62e28f3cf4eff7c7b6b636c10955

SHA512
07d35e7e99025b4d0dced6963ae09f29782fc1ff20183126fb40f65af36998c155aff31976ea4fd7974ac0b9394c94caec013b1a33d1b3d48908a18a6451606f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff96f225574bfc38debe066067352573

SHA1
8db0498e5365348b22bbf7da1bd82bf19e631883

SHA256
f03859b99783965f8e555a4d28aefe033113e4cb2651c76e0feebb1b6e184204

SHA512
9810730a97c51ebc6c5082f708ce0e1e1a66947a3686f94d900687934b04d06794bd60ea19750a6bd560cca5d16e83bb3f15ce409b9cc46dc0d5858d84434f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3430c5a53babfa3e580021c18c34ea9b

SHA1
3c55876e63c84090710f313c45f64a3c1436a901

SHA256
86148628cf3c24182adaa001a92f6339599ce73f80c2e73560602440d8faa86f

SHA512
1818a90bb6b718839aff625bc35300d22d17029d80bb48519521f52817d3a2af36d1e8b998f367e9b5f36100769109b9269ebd07beeaa57ac18f68e8d4082a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
763df27fe6c4873ac948e4b633ff57a8

SHA1
7195b9cf1fa48a56a93c5dba01b2dabb92e99cd6

SHA256
4c78db66fdb01a5cf4bb3ffc5585e8e848183e1393fe0e0795323308efa6735e

SHA512
21e60cc7fa4cd1749380635646fcdae6d81f473cb510b8c9a568f484a4945c6792b4fd58b608a55497e1936ece6e0551a84978c6a84b165786f48e2ab4244a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
af0a0b3aa8cc24808e0adb60699a66dd

SHA1
f7798d0283490e4460799c7978a100682340f214

SHA256
05aa75e88ab80fc95515df237ffc38b6b2cd536a208c2cb9f0762f3fff94af6d

SHA512
42f03d2fb76605a3c28716c6a710b23884d0136ff63c277185b3cffff01bf219629403fc41a90305eed30e95a6c59024470f946d1988702f2aa61f5b6cfd884f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9c371e3f373e0282c8d863bae79dd879

SHA1
10dc3872f0d7a47720349692929bd9177747ceed

SHA256
ed714814cc1e1032736a45eda57b1aaf8c86e1b471bfea1be780cecf7bc85e15

SHA512
5093dabdf5db95fa4a860dc1364622b85989bbf5fd20ce2bf5ab50e13229f51dca9875c0e8a1c4a48fb0e76ec15ff5600ed54fc7dfc936b97abc6963565c1afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5dadd289fc6ab20a79521fd7acea1a25

SHA1
c231c078bd9807bfd32122b38b743fc7f503814d

SHA256
6e9cc5d233db53506d67de0b3173eabcdbb2339e91af817741a35c15ae8d3c42

SHA512
156a8dd84b9fd21797154b1c170f09886f26d1035461a72305a0da533afa49c8d1d2077260b4c65f375492e564a3f69e09aebcc39108fa16eb45a8bc589f1485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
03d6912ef359501ee7f52510e7fd2ce1

SHA1
c8fedfa9b12b8688cafb24df1b52033a29ee8c5a

SHA256
c28dc8be0a977178466993b7f79e136c56d7410849fb9bb7692e71ec7c6fa11d

SHA512
804bfa9ae07f0e51bf0562f1b3c9e23d3332e5d02f595e8ade5cca2222dbc25c7f798251c43e020facee9e9441711c2a9bc81680bdf995e87d790510adac0c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
368d148b092a23f4c07523174f80fdeb

SHA1
84f984f992e659a2000862b1aa6bb5c2315c4b17

SHA256
880f31156413406a8d35fa428d68429b2a932f6a3ec1a0dac58ad7270550d0ae

SHA512
f8dfc9b50d817186fde10ba8269f2a082901ac391803cd005b6baceeb3b3b2d398beec2eb280167395638b3216d07c33e996b82c8e700089348f9c9290110115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
07b8afba13adc1f17b6303e74b846090

SHA1
1590c059a24000ae5fabcc2044fd58a03698156a

SHA256
543fb8124cee2f134235be8f67fbe1b0a31e093e1eb87c7d8de2d8abfd5c02c0

SHA512
6f788d351c08e2070af3750db9b011f771b6467cebae610ef6c6650ccc172b8626411ccf7df0825c90454cca483d2cf565270a8c9edb83387c46dc0b3df0f233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b5830dd81fb9dbfe57eb0c596cbf0c56

SHA1
19e69b7b85b65b83a0d07206c01f8163698b8360

SHA256
8ecfcef8085abfd0e8e96dd4f73b3739ce97423b9623c832e8089a8d8b56c24e

SHA512
e4d90865eda039204f608a8b6d6c65073f0d9f3815def2a5b230181155b87fbb3a54fd60e73919becb178b93c490fec523c7da5aa819b06129a511bee38cd14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7a0f4e5d9934328a4b79ef02af8ba9ea

SHA1
abae068e15fed33038158e8da53893a17deb8d66

SHA256
adbf7ccc0c0393a7e26fdc975fec80e4c11235891f1c4d4bf4a7e9151ef753bc

SHA512
f5e5c8c359b15c1c8d0b34436f5e330aaad4952c5f3599c1ef3264f17718257f03dd8da39be8801291fb96f192c9088bb8c7147b79d97d90e23a3e8a6068d7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f3ba8fbbfb91f3df06af8d756e1d9ff9

SHA1
1af4c4a22a80f73983afcd0eb3bec8575f865405

SHA256
170943f9fa07c1d64bb07d4a4e4dbbb9b6a082332c2219a730b4e310f66d9cce

SHA512
286f812e7157a0261bbb3a4cee488c0153cf31bc27957362d86b7919f8a98c391bc5cc426356cef34a47c10762021508dd7e62b567f61a345a15801ce77091c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
aa5e939588f31732bf67feb8a00577be

SHA1
dc163644910aa08fbf71486e8bd91b286b9c6a43

SHA256
0428a9be9b508de83b69d5687e0ddbf3a0bad07cef376d17815199247d2439ec

SHA512
255f2302adcc628e8c7cc42a314f5b54e65fb6f05b5beb67a533d7e33e892c8044edd1dde6c80e07b8c22457a643f1521be4210a6625c8433e8a6113c6ee156a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3c7c029e0205b5910feb95504bfe30c5

SHA1
cb03438abcf4777f3738d9c14f8cb5517396c0c8

SHA256
7f1b60f47fb18661ee321b62f48527bc3e0d3ee62bde9078ea9bb5b584ca709e

SHA512
02ef56e3aa5bef8ca4bfb612c7c451c6782df4830a298d559e6b8207bedb7bd7183935f1ca1655c3addcf46fb4e932834f52f8ea15a75e377daf1f14bedd38bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4672dc33c2cef9feb169f5635dd8a6ac

SHA1
a40cb6ede268cfd4f7c43ead6af02925ed91431d

SHA256
ff923c7ffad1ef70fdb5569c9ffec27955d62aea68f356bb8a175c5ec9e3845d

SHA512
233ca7fb47fd40ae40f4699e0b582a3b5fe6cac149b3c2d398104aa3010c97ef79f47729c06fcc0e81ab7837756512221cc63172886fc13f9e74b8f13596e1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bdd6cda9f9325152083b80d4f664ce42

SHA1
603daee1e0ca8d75b9a673663004633c660b0d85

SHA256
e044cc0001c5bf90d75a6d271d1c01fbc9d8675c3be00f6dd43485c2ae7862f6

SHA512
ecf6afff6d980df31a07a7b261a0808d0af4b321e88bbeb857aa5993c57fec37359fa807d782157a9a8ab215bb1d2402e3b99d2fa79f3538688d83a361a0f03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7860cc2392651a1bd1828d85c25fc3e8

SHA1
648ccd856cdc491e87f24886422664477e9a6bb9

SHA256
c1d96e5a8637777d10241f6825ec414df242fd124530484677896ca8afa41167

SHA512
4eb6c3f7a0671ed3b538e423c26c7e2b7c447da260c120363eeccfc83f8cf849e00d886d9258d30cb213079eafe33c5d7cd7fa706ded6e01ca227896568f340b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
580092cc29174d0dff7d983faaabc52f

SHA1
740ad3a9582b869c5ca04dda1056bc0d93ddb073

SHA256
8751090f9d259ee8f69ab4fb4bf993ce46ca5c43d53921ebdae7198cdf1eaabd

SHA512
371d30e20c1b25fcd9fdb6b9c9e28287100f24af4345f6337889f857c672029d87ab080c44d9db54b6e00b18bd815f04862232538731e07c0c2f1a8995571a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ed9b6c7be718f58a3438ecfad603933a

SHA1
6773e1361e3b6c21b3f450d8f22e88b1a24b333b

SHA256
f0ecec21bcf1e8fae6fd62be1814530e3e0ce3647a1dd987180f9a4ed7af8bf7

SHA512
4a9add2f0b1b911d6943a5b2c33bd66c35330c3afe72ce867b689d64a886de0195f738664a4fed807f8afb23a447afb1b11f8892f3569055d7d1f829c4c69285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6af2e312055eddf857ea6bb5464025d3

SHA1
ef783b93aa858cd5fcb45276323d133253022d57

SHA256
ae58efbb2313688abb16b2c61473a982ca956bfbd717209aac4ddb624a2a2111

SHA512
eee1de25d22f27670133ba96091563a8fab549bca8cfad7d1e808256c19b6f24932f5444371eea653b73a274d08ab2e50c3095fb3bf3fa8bfe834d8c7c18d7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2b2eb317636264961873acf429d83fa9

SHA1
1d4b31c3219eb4895737402087a06568817c8203

SHA256
1c2456cc4285cec2a6ecb5e997915ee36018c15ca8165f7a703d208e59e23240

SHA512
d832012d90fdf1ebe52135c68537f391f612df42b4e481ccf519a715a99e85e0ae3447c0821568460e52f691c559ecdc8c8e5906b25ce0d4ef44fef33d167bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f66f0a9515a40b5883c8a70b2a21d5c1

SHA1
9b2e9b7cb3d29236b38f39671b870e43746ccdc4

SHA256
7e154dad632c7a38ac6f26fad2df4a8f954adf61226b01c5390a44e1fe9de61b

SHA512
2d21cd8946eff2503703073c769e3bc30cbcf8f9765f1faecae64fff07b732ff3462cafc4e159b1d001e2ea838f648077f97f7c751d3b0baeeb62fa55a783366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
44e113628fbe5fa8b83d0984f23a051d

SHA1
06976bf50cc0a3348fada843147c235be649b420

SHA256
1acb67f4bc5444c2791bfa7de329a2080fe1e552616a553ea16ce2426ed562a1

SHA512
79422583de6d05c1ea7fcdb9548144d33bedcb49df4aa11e4c20201228420ce51954c179863458cea5f2ee6dee3c654d0d9b968c9a79b17fcab70cbdf49721ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8719c065efcc68d9bb13679ebfdb2f5b

SHA1
5d6b5a282c72ec6da3ede7acdd8d748fdbc1ec55

SHA256
1d984b786018c4193c6a0f08f4905e8e23ab4d62f301747aa906f4f9c8103443

SHA512
7bc4fccbe2c220ae636f1abce8e628957aec094a2f23a8b2a1e998d02fc79dfdbf8139ea82882d6c65acd1c180102087a507053e661a17887143f942a1efb92d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a480ecf50eba1f1ea11c0b79a5a6a431

SHA1
425919ae621f235b6a2d067a22dfdf30cb940f7f

SHA256
aae9d55d6e58bbbb55b2be532214e16c85a2371b53dac55525ac53dc062c1fe6

SHA512
ff6c429c40c874a6f5626b3b34b4f4c7211e519171fb70760a172fa6f92e371ec9ed4576c127c2f8056bd14344c7686db82293e8cff81950b31ee745a9b4a358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ded292afd33a7ce3d10794dfb3092ac4

SHA1
2a89df5280d6c9b237eeb674cc67226e35b752aa

SHA256
368f97570b59c4d529cf03da96c66fe25a5d01e87d93c686b8bac9c3d3536626

SHA512
75983ebf0c82f882b5fdce6c3803553113e62f9c5bfe5584ea9a6d4bcdc49b1fb6b97153ab1912d5408a85df65cb369a55ec2eb6d60c190b8281869443a55425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8426eaa3a4820f7c8f192100a0127c2c

SHA1
dd3c224bb4956251179193686504a8f465793ace

SHA256
e96e8015a9fa763edf905458404bbea635dc72aa81a1fe93012788ff92b0815b

SHA512
a96042cf132c94f251f4e06950676acf607573d1fb4c9e1b8481f02dfbefcbbfb5afa3401eba8d73ad66f4db88cadd6774f9f19ba095e01ec7008484d2ee3cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
522a3c866c47db65ec7324af4ded3ea9

SHA1
be812f6ed739c56ff2523262fc4f67b6bbf69c27

SHA256
243e37ea4e132d7605d6105361f2a9f326cbb841716ed5e1fbec9452481cb617

SHA512
9754776c43558254fd6522d55db6c990d987663ff20ac6a603571dd06767490b13bb83dce43c787a5e2b0e02bec55504936c8ea329e0ac2a4b9b3c9d790dccf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
06f17941a6c4431274350e3c2598fd81

SHA1
60446271fcfd41c867ec8489e87deab6f673b371

SHA256
bae17bf6e8e8162000604505d33d04c73a4fb93f3f20e33368fd5bcd81aca737

SHA512
d1837b3994ccd98df2ecf2694b07c4885efcd54b05809515b05911510ac56acd5fef8c721b22a0f2084e39c0ba08480c0724007ae80f0d0afa202ea402b68354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2cd8c07139b2addd096e16f8b7d5bb40

SHA1
ad909f69a826e03e15b3a6a5bdd116c1453966dd

SHA256
1596cbe1722b3b931d62faffaeca09e9a8d142bc0a61f5c249686c0d04ac99d1

SHA512
45c301c4d0fbdbb0a09e4b80aa7c730013c8bff4512f7e24f11863de4fccda56f6f9b8cce5ff50b275f8a761141654cb716db7f37c43bfa0d35c5fcd6b300799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8e761f27c93c3f99ec2fea00ac2942ad

SHA1
3866bdc1d8230bf414d488ad34af8f5fb6a91ad3

SHA256
a316fe62e5c5b8f88bec28ba955db89481bef12bc418b68f473ed7c6ae577e22

SHA512
7b3e37ea9c537da06746d66ec734ad9819426e587242d7b56be916d3fca64eec24f70e7fad778e1d2d6a04ac0049a5648e92058490db4bda9e9c10e8f7bbf71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
04e9022741307fe8b8c6af891a660ae2

SHA1
03e6d569220fa66c7d01a33bbf824fec603eb412

SHA256
34acf52eaeadf06c6785b039b5fbee1025adfbe0cb9dd88317d70595b33052d8

SHA512
c684933eb9db6209e27f1275314243b7d558507034e4b1f8f3e374a8bfc585baad2d3cd718e29de9d823626371dd96e1c62062b1f2ad2e6a06ef7e773813db41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5eefa060ff83a06fb980379e2b1c8664

SHA1
5f58b91fcca71e9c99858866762710ce69d63952

SHA256
1cb3561af6d549b8ec647f7652d42cd000fd62d7097a49b821cbe35e71a4bee8

SHA512
97f81993b237e6bca1af6e6cdc00f5963939d35e3e80259cc6d35adf5a238925701614e2043b2f69b9ee6008d8c3bdc29418cd77dbd17d0b9731534ef36aac44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bf4a3eb2c2c0181981a4ee2d7e628da4

SHA1
60fe0730cac7463dd251a35350704214acf3d350

SHA256
cf630427e3a8899815d62b1cae027bd6fa4a740a68d3cd9e4c7f3466a5a3b408

SHA512
c17ac67fcaacc2c8d693b72834bbae925627ceac82811978f31c1cf062ddb31c238463806f82c3146b64e1cd80075fbf69ee0460202e0668c2cdcc0c2b3269df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
974f2b90abd186446facaffde5fbca54

SHA1
ae1f6476b44ae75614139992b349586a099555d2

SHA256
7d7662f47831d42db206daf5ff6ca9d24a1f952c5395820efd4641ea58020b76

SHA512
30cd467efda3ddedc6cdaf7946652f01c88bb6274ec2bd84801a37df834a90abfd59d773553210128e3932245f51360133c4dd3a5efc8c2f2229354e3bd0b0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
af994a8c1f381f90d560be06f58d28e8

SHA1
b35fd473ec6d6ddf7bf49e8855292d7d956818cf

SHA256
045e117974cac14d81a9dd607546b11db8eeeb8bc53836cc26ace3367f208314

SHA512
5ef827cdccad29d73e909efe5ed630762cf5f584611b07868782b328dd778bad3d518c93e45f4fbab5b4b3d112d5375e2b82283126dea7ae25e26c59a55b7f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
551d1292f8d8852b71751b699fe37cd5

SHA1
3ffffc19b156884e79fd128e78e0211f108d0fc1

SHA256
2a21a8d7ab32dbfe68b6d9df6f94bebfc089a5f00bba246c64639769670cd0fa

SHA512
43fdfe9e569d8a23ca69a84cf09828ac4b0a92e4ef785bdbe1236b87bc63703b1d071c4554788f13f262f110a2b5d51f94c9228c51909a6a6ae5538747c0ae47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1f5685938432ce1e2b22568366fd6189

SHA1
f54d0a6304df56dd7c0f8617cdae125033b6f02a

SHA256
ba036ce84194b8ef37285e157b71167a74e1042f3b98bf6e1fd473771f1718a5

SHA512
40283ed8a5b27878ca2d176d2a9fef811ee53daa1fb1eaaa8c594b5090cc9a549fcdfac09142d04bd96ebe0637983790f49fefd62f6b8b2747d717c2400a0663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
797c2af11a51f9fab6144e1c75939f97

SHA1
0854c5159c2c0d1443209229eb80dfe072b311ac

SHA256
3d0029f768e5617e1de876a452d4e26c3043b7fe1759fb1edded8b2d086b4428

SHA512
5a6b625e1becb6178f17918b5482b92719df16c6e9c5f7958c693524d54de5597815942ae1b9cb8b161866a8e75b53ff1107c7c31c47aa260b6dd1cb28a78472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fc7fc70750aac58979bf1ca7968efe57

SHA1
e3970131dabde70acd2eb95c270fde6a873b666a

SHA256
91c0a3d3a5c5b9a4aed2d4ef7c7560239f9a7bb8a25ece7a6d7ac39ec07fb654

SHA512
56ebd467a19df5f41728c797c9eb7e195b6813c491ba83e46845680a0882227e683fafd06e345820bc6cba0f266e12adc300aeb2217a377c0d724c451f947751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b25c153f30356caa7e17c02603e3924b

SHA1
925d566d40221bbf2c7df44965cb2ab6bb1f1eb3

SHA256
b89b965b75ba9907e8a07b08b5432bfc6e6ad01f80296c6a106c9d04f021a0c0

SHA512
fbda51d406237470c80aab2cefb91469d3fc5ab3f4fe30085fc6e6216a4772ed1cc7e745f7f3f4fe3a9e2eac9c00c8c9d090c6acbf1e871745a6ca862bc3b933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2d5edbd72874108d4076a1c8c1564974

SHA1
8872213f2525a7a9e402bc286cd1cd80920eba19

SHA256
258d23d0694ceb8cfd43e2908a21348337a43a7987236c0ff07015a7fe727497

SHA512
474b51fdc6c32f05f55e20f53af034c10db36ce73c08f5badd6204febbd62a7af968f4da1c516f7b843406475bd66e0dd033376e0d3154609b4e951c749ea019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4445b33ff611b5bab84a703b7ca0901f

SHA1
bdd0d58637e5a2f8de1631607d3a9a11430dd398

SHA256
4394832558bf5142c99056cd45d316f9b327a7da3e924f1bcc6c9a2180a843ea

SHA512
9c5bec18ce89e684361811cdee908b85f2645e46ddb4135595def88677286127126509a4e738616b6054f480ac1b8717d40c3ea34f282223c25fdd5e22749e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f33ff04f2b160df2e5942e03dcd7c7f6

SHA1
789552cc206734d3089a51d6b31d41a88840ab84

SHA256
ba85240d16b33ab42899600cd798ca88cb683c918a9e958a0e10739787c38e27

SHA512
656af11bb2e965d44b93e900ba3ef9d4bc193c1f450868453102db60406fed76736d727cfbd8233b7ba320b6d7b34a48205ec701698cdb865f2b8b6438a064ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c858574544c3517bd0ec0e7d04ff8235

SHA1
71cf84fa0d1d2466df2c4d844b92e5d7dd35b701

SHA256
520e36aa7e0a450ed910e3ac127297ef73f1784585cd5038401f14dcfab0cc15

SHA512
33a862d83edbc67e057ce0d1d4d5767d95b373211d3986da7866536b3a6391168007c4d497a4aa1c8b62848dfda94c0b406441d57c31aee2ec6bbbd67c7b44b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
17e758267975010dbd4b46cdafb28f47

SHA1
dad32ec31e3600e53a477fabb20e26698f08402b

SHA256
d8aab01ba84db157c0abd9f65b179e31fd4b3a72587f3bc80006b141028f0e9c

SHA512
00dacfab3804f61851fb57a0a3461b889e109504568639b8f13852e6a77c1cbea16c99143b62fd2fb4ada22bb29ca79e7d6daeca9eae6eec0f088185696a6b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0a536a0be01e28683b6d130adbed3f7c

SHA1
42652bbc96b84ae04eab508ac1153a58faa7de6d

SHA256
8c90bc30f232cb21ee35eefc31741dcfff222625ae6f104dda93ce6c7b11cfbc

SHA512
3a770e9a7a214ccaf5c5e6d688979dbcdb2cb42fb5030c15157f63124b4f45614817b3a94435c7283e0c135a7d72c2c5dd6da498e84e7cb8268dc61a848fc349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a477999a0e971c521ca02581ed735029

SHA1
9b1850b856149a8317e037f05f0b53e56510230d

SHA256
01c9ea72488271aa234ce2e2495597ca5f89df2f8e5140a52ab689c0de673136

SHA512
dd99daaa47ca852f8e7935d1bdf164e1904dd870371d23b1020c864920387acc42a13e15eb5fb45d6f2191f897369636a1b566ac39aa9dd536fa5fcc246a83d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
204e610ac0d72c819984915a1556f91e

SHA1
66d24528320924d8c1709d956c05f60ff35335a7

SHA256
40caf714fb11dcbfeebc0f09b6f99b63a366d5694d87e7c21f29ed546e498589

SHA512
8206eb14ce15ae0c421fdef730f6dbbc919df269a66fc2f923cd9210b634e2f5f6d02448cf64da36ea4980a04819844d0e574c058d7a90f102f1926d9f3294cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
47d2a1c8aa679103e9f9e11f77631c26

SHA1
6f6e594274c4c967b7820d09ffbca9236589f42b

SHA256
949cbf949a5e1200fc125c55ace272729d76530609dedacd6d31ba7696caa2d9

SHA512
cd0f38c692cca50b24418067f0fbc1168e660564fc8923dc7b2e2badb2e67c9cf7060f7459674ffd6143e6d957c34d7eba5fd0e30d3e878bd3d301160270c69b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9a85522858da3d756b7cf352917dabf4

SHA1
f238dfe55b4af4b959f77e38d47298b2f24e15ce

SHA256
ab555d15851a8e1d648cfae5248dd1a92a9816bf2bf4ae1e29b643001205c51b

SHA512
7d1d355465a0702c42f106830c582964a424f9e20caa088063c3809fd17669e0509918fac8955bf55b7ff300fca8a33ac2a21552142c93b1ae7eb3d64fe7692a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
33f5bb6587f4ce43cdd8f115778c8a20

SHA1
a1b74d3724642deeb005ff3caa2899eb536c9f2a

SHA256
33c3f17a2f2269895b3c63728f24912670796278646b488e7d8ff701286d329f

SHA512
802c192356be946402099632ffa8eae1c6806ba96904b1814be29170e7b909cbf12916167c71baa6f9eb349b6325dbe5322cdfe6562c3a8fafa6bab8151bf7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6b217c467ed6d5efe5763b3cae0c9871

SHA1
a0818e5c8f2a2e432678c1fe3e4ea84616ce697b

SHA256
83ab9341eaa83b292f7d711bc7c695cee2bb5c2bf5dedb01ae2e8209b3575b14

SHA512
169018c644d1d0c5fea12500944756cfe157503095cedc0b9ea7aa8384502244711936af7a08b7820867b3347ef4643a9e68aecf23e58eef9a6a0e88e2dde3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3f61deb9d4f20b6a03b3caa84442b1a9

SHA1
3fc2f40a35d1bb8f812ce726cd0061d6856096cd

SHA256
b4990271cb5b4834e724521c25f746045f6e6d28ec8779c353a1bc29659f0fda

SHA512
e276101fb3c19ec74b5d45b52313bb2b4444b56afe0e398cb7ac205645b78ec3428b5554ae5fc612e7806b36a21c7be8444042c0fb255f19c107b01ca74d64d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2b4d9e238eaec52b7280bb8deb4fdb48

SHA1
dd7d6276db3ef86108050399a3837cb5a0dab802

SHA256
2ddfe67ad9f384c9a99b78714be2ecb2ed2df673e0677fc2e2e69fb06896fb02

SHA512
c4761fcd504e666400adfa11981e161d46cefc086d08ffaa2fc95db94bc7111f93e9fcda088651dd2b8874fd0c2f743a07e8893aa64a12f5b95794b11ba2a844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1f92637ebb293d0a1c08dbab8d4d5148

SHA1
701f02884262cf9408f665ac2fdcdbc8df436311

SHA256
accd0f2ed4159707e2633b16b9ac1edd5890b8456b0f631b6e35f597331ec0c5

SHA512
56ee7bad8f248b061531258ff51d41faacbbf7e887cbe5e0056f41c15ac2c71dc6e3dea4187eee4a8b38f839e815c54f404c3a75cd3c45588e7dfa329ab67476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
08ce31566705a5b47c2613c94245e1c7

SHA1
409d46d8f0578bad4706c422888511c4a1bc1bf6

SHA256
afaef64343314c8b047c8a7ef1b9a14d5896c6d7593a200131edb5710ee8433d

SHA512
61a06eef8acc8ac24a4455cef20f51d03472d615990d1d65806aa6473ce21cdcaac6f477e4381d88f11286bcd7767bafe7d19ad6aed55a5cdcafaf9e9ce45062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ef71da56446df8bde553a3b8c4e28806

SHA1
f4820b385408b5160317ddd53a9579d22a734f24

SHA256
fd5652a830822ab766e5780d36867dc0746d5a82f569070f81ea7f1327893f1b

SHA512
b9cf8d8067be7c1347b6c52a1168c2e758d3f967cc25bb0625e38c83e4fdc73e9ba9de7bc932c8f5e253c8ba2a28f60ea2b728a03052011c6a2412d5e7a25713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
60f808f03e9ecdc877c00e51140d06fb

SHA1
34960b5fb05a507365014975f2733964e4e98c3c

SHA256
d4d39fc116b5c250629c87440b77e5138447b828a6aa5383a78cfcc2aeb42fd5

SHA512
11c212d198275c503a8221f4efb93119dd5a660f295941413d1bb9a55a519cedff556eee190f3d46577f7a6128c6d132b9b72e69b80fef81f84a5657cae67380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a7ae52b1c6debadcb4911d19d8acd15d

SHA1
d21574ca322b9a06f0b596a412633c91c6099f8c

SHA256
8088c1e825eb5737096b62e96210630fcd5d69cb4b128961a27f81df931a4184

SHA512
3de60fac27ce4462ea15221944ec3b92acff871343c3f4cc8126d4ee84fe4d1099a8036e3bd401d58ae48b8755a1a24adbac764d00c7dbeca41accb8c06d0349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3232eb442e8c0f782cdba9f41f60fff2

SHA1
86806acc3ea5bbaa2f85ce16ebb467a910187c19

SHA256
b6c8f78cbe899fa1af4523f2ccf3cce17cc257140f7bbcaa5087e16ac15e5cf0

SHA512
aa46e69d45fb09dbae65c48dc4666868f0465237e97d2e73a77145f573d8aa317f5b2defbc7dfc0227f6570f4b818e2ee2bfc3d7d1c1bf8934e09993fcc27a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6130c165dbdcd4260488d493026af6f8

SHA1
59b6eb8cb3944c1d43df1116341de586ff3548da

SHA256
1affb2d4ea034e9c07882011dc6a8bc38ca9feecf87289cca06524b800f4b6ea

SHA512
cc06e1cde1ecabe67ef223cf7811d2668b80cac1f7adaabe63d3cac7f0379b66dbdf4c14753281d3cefcdf4f42a343d8c753be19c0750c1a72d7a17456a26e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
262ed66384d26718fb5e193fa7d34072

SHA1
c03474781340e95f2456e60f97a429902ea746a3

SHA256
5b994c1cd5960e5a6966bc4eb0a5aaa293ecfa35c20bb10d4512d0ebd3b429f9

SHA512
a8dcb8d03d79158c6da5b95330782752343a7a1d87a86061a77fee9d0c0eceea855100566b5db2df028091ed6f99416ea7c24c3d76f0d4a64b5ddc2ce9d726f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b0b16dbbc6cb452d539713ee084ab063

SHA1
3405ef4baab6b0ebf97839574da7b1faef3a587f

SHA256
e0edf38a0c700b25a04b3ae2b47a38eb13f300959a61e3ad637d4e0e6b630103

SHA512
57d804847fbaad21d052bff4aa8b4c128daf1a8cfd7745961e6d9f43e30e9455a224451b4f610ed7e1a82a19da057dc509fb60d2a4360f34c438de4c35247fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e3f75d94eeba785dcdc2cd6e45cdf260

SHA1
cc81d202ab609f7cd697da18dc9998745820ad70

SHA256
d9a9839d10f6d7d71684adc650cacbc5db7e3f737d8fb7de1b36a6ae40cf5f11

SHA512
edafc0066ac60a148a171021dd0f4c62a855efb9dd1f0ccc4473595fb60e968219a2418ae06e37d454504fbd9c80e52362edf0414a31a3399ec40f54a1f72d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2e53def2b31ddee7444d2835cb48a173

SHA1
d45f546774121dffc2b12a710ae7c20e6ed8acff

SHA256
a9a84b0c570b9243bce3e134a95ff39c1109d0c10b75d6bf65775366ef740930

SHA512
451c7552dc34bf66c8a01defd1d6cd38b4ba3c20917a3a6885e5275e0ef868b70e769bd4982a53ab46b4cce8c8b64c16e2a50f0845f92ed45ceab102762f7053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
51b19d6f34a2ecfe41948a23571d3d45

SHA1
7e2bc484557179fe696ed9f9e8dbd9b370b6de78

SHA256
f8231d9166d3526dc93e210eb8b788404da5306f28ebcc4d482a4dbd9c00aa16

SHA512
3ddf437129508a301bfe9165f57ce42e45c95f2bf9e56f51c08c157bbb52e0bf40742d9126b854c4aace8d31fdcfb2b45a552b9080a216f15a94dfdfd52af4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bc19b81f8a3bbad93e27a6e92aebfbdb

SHA1
79c6cff145e271cc33bdb19a251b2b7555818978

SHA256
62bb2c21e383070babcbb9a8522dec4fda04fa0a708bc2fd2052a7ee18187d67

SHA512
3295d33d3f58c4d50657d8e7a7589ea98889988a8eb04586e815f00ae4db1f851163c94a396b332895f67b76dbcd170fea0e86640fe41c9635e716e97da55f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5a40d343bd54fbd17deda7cf4fe1d686

SHA1
7af3c8815dfc7e357985973c6609f1eb499026a4

SHA256
bfa7e698b997c695069213004b8dbca12ff1d738243792adbfd801685b996a3b

SHA512
4c0d08cd0a23ee5c8297ad4fc764ae0ff21da615af8b9d35d6fe157e31bad17faec0483f846827a80477cd6f230052287eb2eac743f160ba02635fe4c4434876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1d68d7ab800e00f8513c6669725e10fa

SHA1
92e0e71b39946a6e25f2eec650592f36dcf51089

SHA256
e6b483c158c1746967e1f9dd946769fef95693f82747785f238e853f3dde7e8b

SHA512
c8e6e4598eb7f00985ef3849699eb896a210b764ca7dc93615d65f4e9a47156d10251e49b564b1cfd2cd254945674c44c485ab53ca653d2bfffbd01ae7ebff1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
921a675a12e5f7ac119553e256a0ebe8

SHA1
622c40fad99ea47b510af6fa88e2a0741510c95d

SHA256
4c1ce83a7403e2bc83bc6f7ba5d6f0a4cb7aef5d32f7be6c4a3a0e00e1683323

SHA512
fc4e438456bc950b9102da99d478c8a91b47a0a0d066395f9c0ce58b50fe5b37eb90491df88d28c655deced825e1c918bebdab642df5fc8592244e5666de72f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
af02a9e931e3d1bbab324f15ede56a5b

SHA1
07c11c3dca1b55a660b13589896146df617d35c4

SHA256
18251504910455118f3342413b2305136fc31cd551b4820199d876a42da2b656

SHA512
b3dc553864b42d3920ac95667107a2c50d3ac7767a872fee647670e36b7660ca24854536537f534f4ab7983781ecd37094193060c3e6dd0c69afed93af3b54b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
94610c0150463c951fe329b82c37057b

SHA1
4000066fe7f3101c5730ba0c58318f7a4239139d

SHA256
ec91187d75a3c407057ec88bf8a5e79f0bab79d56efa0b3410c71952151eaa42

SHA512
b99545224a2345002aad7f92725248340601ddc74c3dc824ac3400234df9b0d5757337dfd0592cecc3ffd195f5c30480fa154310c8dc03b10ac66c383d428c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f4bdfc5b029e6305abecc4f45d2b6ed0

SHA1
65f6607183e7586d56808936dd618e5bd2190b3d

SHA256
cdd4a72cee2c1cbfd6eaf9b479960c302aac479e013e5ba65c121f427be361c4

SHA512
8e53723050aa10ddf0ee4f9da59e41b2a252882725419ffac946fb9cbe3cd3e8fd007eff8375bd90e034ff3d37adb4e0cb8e91c5a5a11b4b642bb63ce19e3a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
67eb54e4f6728c7529e9b525c77e5ca2

SHA1
afb10071ed5ef05ed3e1af0c7d11e15ba2cba5ed

SHA256
89804b9cd870a764f5a745db0715fec2c95db848181e44deca9dd1151460e4e3

SHA512
dec1f4101ccc8a1852ca8e3ae4d62cc91eb6ccc7f4086c676a986a6e56c347c8152f4f7beb9d12b7570e5478c5874cfb759ca4ae3c80292680fb6156f7025d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
12925053a95d711a351029e94f538e3a

SHA1
ff1245106a1a404d2ac8e5b8d8bb49d938f7ea22

SHA256
6114e9181742082a2b346f1fdc01daa363e3bc871d30f5f550620d57590968b3

SHA512
a916d542818f22a9fdddf7a2b2f4ad895d9fcb1a0db7edb45e69509f4dae857de0ffdc4383f38255e06a927f7f060676b88e28326332ed19794ae22e63c0b5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a6acac8bed60a0ed51a13e83cb168881

SHA1
15b674c70d5b50071810b648f369290ec3169dec

SHA256
c39fd0e07ed7bfd60e4da0d3ddad8df1717ddf5a42e0bf7462e2af24eafa444c

SHA512
5326392f75a1308392e63a5e5d3594c267a81018f5ce2d97a1ae7df24c1ca82f457ad69b79583ded5f04f105831df472152370bfce3cf5613ba9d9faeb7b5c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
080c8122db44256677538e8e85ba3b23

SHA1
a353f685293903ae376c4132b9bfc366a62c965c

SHA256
cc2053d03ad865d0baeb5e7e11fbe391f240e67d421dbac4e92e17d8b374b3ed

SHA512
29910ba945bd71cd94fdc96d39c24b7f1451e5963337515222967ab96895453a10fcacca1a0e717c5ff13e0c6b8fa868d829c785195425ae5fb17a3d923a2b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
432153979d6b9b5c9e9dbadf3f7dcc20

SHA1
c326f40768658bd8e0b0ffa51dde01e149215a7d

SHA256
e610b0df1e36fcaeb5ccb8691394cfc0fc832013f0d59e91df25cf5e5f607e57

SHA512
c63742b0a77f3697f95de2fb68f2ce4a6c7368b31ad8bffc74c1ab5ab834a2de0e21fed058aaad2a17f1d471973eecafc1dd3d86f03f828763da79bf45b7d058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7e183ee69fae07c51b7f0e6978022a4d

SHA1
7c58bc7d5d301a10cff2c4cba56cc888ae479207

SHA256
806afb7f568b2913e1448a5fa4e3069ae466d7bcb72e2ae026a1ac6de1d41105

SHA512
7ed0c3efdc43612398b1de946ac75e028d8a5d6484115432ee3cdb63422fd04da91caa9c4ad325ba55367ee7ca3c9637f142fb87a065acbc60f14bf0768bce4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
19ce31e0ecee649f749ccb7415887a61

SHA1
2aa489b0f81309e133c88c7c53c63a21dce9830d

SHA256
463ea1a8dee939e320da66029343e0b75097235c31bad44e593df22c7e2551e3

SHA512
5e3c63459c7fa9eddb28bf9cd8564bb08e7e0a2364ed65469d1c44811deaa708dfcf786a41d9faf32c688d8c570d52d86cfa4798c31968c28f96253b6f9a5d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6f29718dea0794e6b9e20415a4f9bc90

SHA1
23c6b11755f42f4fb8f276d9dbd3f2927d8f9e9b

SHA256
9c011338b309bc46f50a4415fc859d38f2beeff8a8b11cf70992e339f320e481

SHA512
14992a3e70c80001cf9451b874f43c6fde2179bd85b23c28a679786cff1a8e10c2ce1e5fb090d9b3187a6b168ac6a843f6c3b7da0256630c6fdafd911c2a29ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
107b7837025de577a1c767c9cc941da6

SHA1
bdba8e2b507870c395804916109e3068da19fe25

SHA256
5ecf230a1c3794b212cf956b0204394579fb35dbc03dc2e7b4f045d8e352b32f

SHA512
f4d626fab08a63a0dc8f4eb2974a511db93cc92a6cde8e078582b2534291a5f972c529930dc874576855ed0833c5edb12f56c3692c94cf1f6bee61a6e3c23245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b39358a1791576bc346adf1dd689371f

SHA1
ef1a4c98ffbdd7528aa4e1f4753b5ebb60117a80

SHA256
27342b1c391edbad82346af16a27d1dd28b60713f5e79ff44bcdcbb38c74c477

SHA512
a3c93c00dc0310d8b20ee41400a687bbe138443e0c92b7ece61aae16c30403990f00614f5aa144c25fd3e44535a39318f94e440220f5b7c68afe6f145e9cb7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8f47a3ba51666a97d72aabd9d131171b

SHA1
fc001ece4ef89b385cd420d111a1bb6522993a94

SHA256
2f36d149fead2d02ac385e463ebcca7358e4224872cc2147f6cbb6eb55dc3c54

SHA512
44cf4f863af7ce4b32e1e2f67ce7d3b39fc1424d1fe1009c87fb40d259bf727d04b8a56cb5016a56c8c933b4e4780136de3a92855ebc89165b32f8a2c235f86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578ffb.TMP

Filesize
3KB

MD5
0e7afe428657b348dbc78db1fc98a9cd

SHA1
b513f7a38bade68a7d10e3f9cd026b5cc3108b4c

SHA256
767baebee34079a0ecf4599e38c1a5aa5af5cdeb42def2e957122391dc792664

SHA512
3288596b071571bb939994db13da14fde8164d45707e96519fbabd033f60acc266503243b6cd5a73a742b6ca781e0a6e8cbc6c527ba443325dadaaffa5e64c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e85dfeb3-8efa-4e73-8ae6-1c48e390a8a2.tmp

Filesize
5KB

MD5
f13925d649e6b8b7666f26330a1ce7ec

SHA1
ee0118bda90f800b3b1b8345d4a1988d08e57d8d

SHA256
47b6bc206fb1fb2d10c28f8f0290ff9e517965e2df641e8b23cd21e0c595078a

SHA512
6237dc7c7b9f68e558adccc2334760218f3f677179673a7a6bc3005d15e872f2c5655ede240528e539b2709d065449f4c31eda1e01c1f330cf37766cae6b3320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eff99574-36ca-46f8-9423-f0ce15c24e3d.tmp

Filesize
5KB

MD5
516462da60dba879bdee57bf7cb3a1a5

SHA1
600165760df7812f4df21734ca4ef76dd660c9c6

SHA256
0c8e1e549c8dd3980b4e3411f90547663aef23ccbfc10a344a2dbf97a01a4835

SHA512
9c1af4021cc9b913c41bca3b3b4b9bb3e92c3a8764470abc7f9f7c5c15cab9d489dc0c0c03826f6aa04cbd234600adc87fb7c75072242ce040e266fe806671ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9ceb5ca69c87b129781e1861b788e23

SHA1
17c6f44e8b8219a01ee8b24340e086965f732856

SHA256
a2d7d85b3e958717cddccf294edaae1294fdd1179a2a43836cd4b25c9d40c33b

SHA512
f1d1c2baffd78eec56f05b2cb63d4d6d4f35498e0d3c0f6dd9a90cb3eadb8f067229b91e52031a69e6c0ed3489c9ef260e0533a85328c1c061cbaf73502d76e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6596bf73ca6ef64580f5d68b057fafcf

SHA1
39f95940e551a7e732422a902e248c8b1b124b7d

SHA256
0df1106b3398a1b0d9f33fc479d9b31ea7de8a30043ce7ce37844c7c0cd100ff

SHA512
2475429b285b7a52c00d5d81114384e99d2dee1f58800cd7ed6fed37e344004c83a27ea2a5c8baa8bb5ba91ce7d5ede5cc182e643c8182ffeb9d0c22332ce1ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7f984715309b50426f75bbeabae7ba65

SHA1
39fa1003feebc8ee4284baf2bd3c070554a0ba6d

SHA256
e17e0bd6e9e77bc1fcce2226527a26f30eba03626dff7bedf407ede68ed6c3be

SHA512
7ada56021df5d0c5173df173cae9d96dc35536a361aeb59993f953ec8bea5b2ab26f69613de13bd08eb1da5347670c2ae491c71e1f05085d8b1d0873e7516ac1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
4ac1fa5f5eee56dd27d1a8494ac123d0

SHA1
36f2554923cca2c33b9e47ed1eea71c0dbed1c78

SHA256
c266299c85b7332a77b071ea5209b1b6bdd3b9e5df51d93e0a25d2fee475edd1

SHA512
c15b8fa4af388fd49ddc5a9e1bd9794e3b6f420d4ca39576eb1f37d226b73bd0249676ad9de3039f297641b99f2ccccc0a7e7f6db7976305bd9036d855d37910

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2df47ad41ac5bf031c9c861c25c93211

SHA1
5f51071f32514cf73fe69a8197c78c4905c483b5

SHA256
2033cd2d97b3fc56de3c82e4c23df66355489749b50160ddb19a5188269fec4e

SHA512
b612a45ecdd1d3eedfb15cac6a2e59f8cf9d4b43398dbb8ca676061f9695b750838b02a17b9fa139c1977a89351867c1113d68448561c5fba889c76acc9c5677

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 652960.crdownload

Filesize
4.6MB

MD5
c5d17800e618e5a644eb6fa610a1ec9a

SHA1
66f2f3e0d050e393ff3fd5fe4153ed23316360cc

SHA256
59d38c97fc77419c8d944fda0185c145f3da9e83b30db423c6e5ca24991a69f5

SHA512
8fe52999561052376a1516616f1fba640ec099b1a3c9db505c70a403de927c5b79028d072ea10b1e4a2ff4fa742718e2f820fdfc63ae1e2a3ddfe29db7b6b4d1

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
8ee23ba54e2632ade99a3e6ecfe6c1f1

SHA1
3f75dd071ff0b2526285a8d673ac2a3c77a51b65

SHA256
1f26e6cbb233dd2d6ea6deba1df8c481177ef96a83a8167dc10a5c02c54cdc03

SHA512
ec3a65ef41d0a3bbe7604454e91e4bb42de54d76e643d862767a9aca86077ef2dba5c3ceb2cfee4a6f08d273f3b08555c458099b73b4397f13e231af20572df5

Download Submit
memory/4604-1862-0x00007FFA20E10000-0x00007FFA20E19000-memory.dmp

Filesize
36KB

Download
memory/4604-1855-0x00007FFA20DF0000-0x00007FFA20E00000-memory.dmp

Filesize
64KB

Download
memory/4604-1837-0x00007FFA20030000-0x00007FFA20040000-memory.dmp

Filesize
64KB

Download
memory/4604-1836-0x00007FFA1FEC0000-0x00007FFA1FED0000-memory.dmp

Filesize
64KB

Download
memory/4604-1835-0x00007FFA1FEC0000-0x00007FFA1FED0000-memory.dmp

Filesize
64KB

Download
memory/4604-1832-0x00007FFA213B0000-0x00007FFA213D0000-memory.dmp

Filesize
128KB

Download
memory/4604-1834-0x00007FFA214A0000-0x00007FFA214AC000-memory.dmp

Filesize
48KB

Download
memory/4604-1833-0x00007FFA213B0000-0x00007FFA213D0000-memory.dmp

Filesize
128KB

Download
memory/4604-1871-0x00007FFA1FD00000-0x00007FFA1FD20000-memory.dmp

Filesize
128KB

Download
memory/4604-1831-0x00007FFA213B0000-0x00007FFA213D0000-memory.dmp

Filesize
128KB

Download
memory/4604-1869-0x00007FFA1FD00000-0x00007FFA1FD20000-memory.dmp

Filesize
128KB

Download
memory/4604-1830-0x00007FFA213B0000-0x00007FFA213D0000-memory.dmp

Filesize
128KB

Download
memory/4604-1868-0x00007FFA1FD00000-0x00007FFA1FD20000-memory.dmp

Filesize
128KB

Download
memory/4604-1866-0x00007FFA1FCD0000-0x00007FFA1FCE0000-memory.dmp

Filesize
64KB

Download
memory/4604-1829-0x00007FFA213B0000-0x00007FFA213D0000-memory.dmp

Filesize
128KB

Download
memory/4604-1867-0x00007FFA1FD00000-0x00007FFA1FD20000-memory.dmp

Filesize
128KB

Download
memory/4604-1828-0x00007FFA21390000-0x00007FFA213A0000-memory.dmp

Filesize
64KB

Download
memory/4604-1865-0x00007FFA1FCD0000-0x00007FFA1FCE0000-memory.dmp

Filesize
64KB

Download
memory/4604-1827-0x00007FFA21390000-0x00007FFA213A0000-memory.dmp

Filesize
64KB

Download
memory/4604-1863-0x00007FFA1FBC0000-0x00007FFA1FBD0000-memory.dmp

Filesize
64KB

Download
memory/4604-1825-0x00007FFA21300000-0x00007FFA21310000-memory.dmp

Filesize
64KB

Download
memory/4604-1864-0x00007FFA1FBC0000-0x00007FFA1FBD0000-memory.dmp

Filesize
64KB

Download
memory/4604-1826-0x00007FFA21300000-0x00007FFA21310000-memory.dmp

Filesize
64KB

Download
memory/4604-1870-0x00007FFA1FD00000-0x00007FFA1FD20000-memory.dmp

Filesize
128KB

Download
memory/4604-1824-0x00007FFA22780000-0x00007FFA22789000-memory.dmp

Filesize
36KB

Download
memory/4604-1861-0x00007FFA20E10000-0x00007FFA20E19000-memory.dmp

Filesize
36KB

Download
memory/4604-1822-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1859-0x00007FFA20E10000-0x00007FFA20E19000-memory.dmp

Filesize
36KB

Download
memory/4604-1860-0x00007FFA20E10000-0x00007FFA20E19000-memory.dmp

Filesize
36KB

Download
memory/4604-1857-0x00007FFA20DF0000-0x00007FFA20E00000-memory.dmp

Filesize
64KB

Download
memory/4604-1839-0x00007FFA20030000-0x00007FFA20040000-memory.dmp

Filesize
64KB

Download
memory/4604-1858-0x00007FFA20E10000-0x00007FFA20E19000-memory.dmp

Filesize
36KB

Download
memory/4604-1823-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1838-0x00007FFA22570000-0x00007FFA22571000-memory.dmp

Filesize
4KB

Download
memory/4604-1821-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1856-0x00007FFA20DF0000-0x00007FFA20E00000-memory.dmp

Filesize
64KB

Download
memory/4604-1820-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1853-0x00007FFA20DE0000-0x00007FFA20DED000-memory.dmp

Filesize
52KB

Download
memory/4604-1819-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1845-0x00007FFA20200000-0x00007FFA20210000-memory.dmp

Filesize
64KB

Download
memory/4604-1818-0x00007FFA226A0000-0x00007FFA226B0000-memory.dmp

Filesize
64KB

Download
memory/4604-1840-0x00007FFA201E0000-0x00007FFA201F0000-memory.dmp

Filesize
64KB

Download
memory/4604-1817-0x00007FFA226A0000-0x00007FFA226B0000-memory.dmp

Filesize
64KB

Download
memory/4604-1841-0x00007FFA201E0000-0x00007FFA201F0000-memory.dmp

Filesize
64KB

Download
memory/4604-1816-0x00007FFA22580000-0x00007FFA22590000-memory.dmp

Filesize
64KB

Download
memory/4604-1842-0x00007FFA201E0000-0x00007FFA201F0000-memory.dmp

Filesize
64KB

Download
memory/4604-1815-0x00007FFA22580000-0x00007FFA22590000-memory.dmp

Filesize
64KB

Download
memory/4604-1814-0x0000025BBE680000-0x0000025BBE681000-memory.dmp

Filesize
4KB

Download
memory/4604-1844-0x00007FFA20200000-0x00007FFA20210000-memory.dmp

Filesize
64KB

Download
memory/4604-1919-0x0000025BBE680000-0x0000025BBE681000-memory.dmp

Filesize
4KB

Download
memory/4604-1843-0x00007FFA20200000-0x00007FFA20210000-memory.dmp

Filesize
64KB

Download
memory/4604-1878-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1879-0x00007FFA226F0000-0x00007FFA22720000-memory.dmp

Filesize
192KB

Download
memory/4604-1876-0x00007FFA1FB90000-0x00007FFA1FBB6000-memory.dmp

Filesize
152KB

Download
memory/4604-1875-0x00007FFA1FB90000-0x00007FFA1FBB6000-memory.dmp

Filesize
152KB

Download
memory/4604-1874-0x00007FFA1FB90000-0x00007FFA1FBB6000-memory.dmp

Filesize
152KB

Download
memory/4604-1872-0x00007FFA1FB90000-0x00007FFA1FBB6000-memory.dmp

Filesize
152KB

Download
memory/4604-1873-0x00007FFA1FB90000-0x00007FFA1FBB6000-memory.dmp

Filesize
152KB

Download
memory/4604-1854-0x00007FFA20DE0000-0x00007FFA20DED000-memory.dmp

Filesize
52KB

Download
memory/4604-1850-0x00007FFA20DE0000-0x00007FFA20DED000-memory.dmp

Filesize
52KB

Download
memory/4604-1852-0x00007FFA20DE0000-0x00007FFA20DED000-memory.dmp

Filesize
52KB

Download
memory/4604-1851-0x00007FFA20DE0000-0x00007FFA20DED000-memory.dmp

Filesize
52KB

Download
memory/4604-1849-0x00007FFA20DA0000-0x00007FFA20DB0000-memory.dmp

Filesize
64KB

Download
memory/4604-1848-0x00007FFA20DA0000-0x00007FFA20DB0000-memory.dmp

Filesize
64KB

Download
memory/4604-1846-0x00007FFA20D30000-0x00007FFA20D40000-memory.dmp

Filesize
64KB

Download
memory/4604-1847-0x00007FFA20D30000-0x00007FFA20D40000-memory.dmp

Filesize
64KB

Download