0e3ddc4add4de93951bc64ac614f5e616d46a9d23d9d9aa56aa27b0e31c073b6

Analysis

max time kernel
520s
max time network
523s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SG9uZXlwb3Q.exe
Size

1.9MB
MD5

840a437a3f0fd4ffc7e640fd50112fb3
SHA1

b8df93d4ad036fdd203d55c56c2224ca4a53c187
SHA256

0e3ddc4add4de93951bc64ac614f5e616d46a9d23d9d9aa56aa27b0e31c073b6
SHA512

01d5c6a41c4f1c7880e6552afa865dc60fe8873b579f2e84146fe22dbeb1d2ab6550d02cb014c5a8b45f22f3370a4d76f4bf60aee16866f642c6cdcba965fd72
SSDEEP

24576:m5lYe0j3Z6o2GEr8RgE9QRhAmnjtVLFFAVWtOwjV3SFDFnN65qsyHiPOMXB8sN/V:vEoTgYyU1zaCXDXFWGebMYcG

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

Processes:

RobloxPlayerInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_127.0.2651.86.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	Process
816	RobloxPlayerInstaller.exe
5012	MicrosoftEdgeWebview2Setup.exe
4952	MicrosoftEdgeUpdate.exe
2996	MicrosoftEdgeUpdate.exe
1484	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdateComRegisterShell64.exe
3208	MicrosoftEdgeUpdateComRegisterShell64.exe
3032	MicrosoftEdgeUpdateComRegisterShell64.exe
1736	MicrosoftEdgeUpdate.exe
1112	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
3548	MicrosoftEdgeUpdate.exe
640	MicrosoftEdge_X64_127.0.2651.86.exe
2668	setup.exe
2096	setup.exe
2292	MicrosoftEdgeUpdate.exe
1948	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
4976	RobloxPlayerBeta.exe
4696	MicrosoftEdgeUpdate.exe
1084	MicrosoftEdgeUpdate.exe

Loads dropped DLL 28 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exetaskmgr.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	Process
4952	MicrosoftEdgeUpdate.exe
2996	MicrosoftEdgeUpdate.exe
1484	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
3208	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
3032	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
1112	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
1112	MicrosoftEdgeUpdate.exe
3548	MicrosoftEdgeUpdate.exe
2292	MicrosoftEdgeUpdate.exe
1948	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
2852	RobloxPlayerBeta.exe
4976	RobloxPlayerBeta.exe
4696	MicrosoftEdgeUpdate.exe
1084	MicrosoftEdgeUpdate.exe
1084	MicrosoftEdgeUpdate.exe
4696	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

RobloxPlayerInstaller.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
1948	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
4976	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
1948	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerInstaller.exesetup.exeMicrosoftEdgeWebview2Setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\GameSettings\UncheckedBox.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\icon_follower-16.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\scripts\humanoidRunFamilyWithDiagonals.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\TitilliumWeb-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\PlatformContent\pc\textures\water\normal_18.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InGameMenu\CircleCutout.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\Button_Dopesheet_Lightmode.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\btn_newGrey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Lobby\Buttons\glow_nine_slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DeveloperInspector\Inspect.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetPreview\preview.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\button_radio_default.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\moreOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-90x90.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DevConsole\Info.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\MenuBar\icon_seated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2Loader.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\sky\noisefb.dds	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\button_arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DefaultController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\meshes\leftleg.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\RoactStudioWidgets\toggle_off_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_limestone.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\BuilderSans-ExtraBold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioSharedUI\pending.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\Jura-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\New\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\Debugger\Breakpoints\filter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\Misc\MuteAll.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ViewSelector\top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\GameSettings\default_badge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AvatarEditorImages\Stretch\bar-full-mid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\share-game-thumbnail.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Trust Protection Lists\Mu\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_en.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DeveloperFramework\UIOn_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChatV2\actions_editing_compose.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DeveloperInspector\Record.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MaterialFramework\Grid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\families\PatrickHand.json	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	Process
1736	MicrosoftEdgeUpdate.exe
3548	MicrosoftEdgeUpdate.exe
2292	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

RobloxPlayerInstaller.exemsedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerInstaller.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exetaskmgr.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 190328.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 449794.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid	Process
4716	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SG9uZXlwb3Q.exe

pid	Process
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe
2220	SG9uZXlwb3Q.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exetaskmgr.exe

pid	Process
4716	vlc.exe
3272	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MicrosoftEdgeUpdate.exetaskmgr.exeMicrosoftEdgeUpdate.exe

description	pid	Process
Token: SeDebugPrivilege	4952	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4952	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3272	taskmgr.exe
Token: SeSystemProfilePrivilege	3272	taskmgr.exe
Token: SeCreateGlobalPrivilege	3272	taskmgr.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exevlc.exetaskmgr.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
4716	vlc.exe
4716	vlc.exe
4716	vlc.exe
4716	vlc.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exevlc.exetaskmgr.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
4716	vlc.exe
4716	vlc.exe
4716	vlc.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe
3272	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid	Process
4716	vlc.exe

Suspicious use of UnmapMainImage 5 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
1948	RobloxPlayerBeta.exe
3208	RobloxPlayerBeta.exe
3068	RobloxPlayerBeta.exe
2852	RobloxPlayerBeta.exe
4976	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 636 wrote to memory of 2500	636	msedge.exe	90
PID 636 wrote to memory of 2500	636	msedge.exe	90
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 396	636	msedge.exe	91
PID 636 wrote to memory of 2624	636	msedge.exe	92
PID 636 wrote to memory of 2624	636	msedge.exe	92
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93
PID 636 wrote to memory of 4468	636	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\SG9uZXlwb3Q.exe
"C:\Users\Admin\AppData\Local\Temp\SG9uZXlwb3Q.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff855df46f8,0x7ff855df4708,0x7ff855df4718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3016
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  PID:816
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4952
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2996
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1772
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3208
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3032
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDg2NTFGNzItNUEyNy00RUE3LTk1QTUtQjdCMDM5MEVDQzY1fSIgdXNlcmlkPSJ7MUVFMDk5NDMtMzU3MS00OUEzLUJDMTMtNkFGN0IxMkI2QjI4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MzkwMEFDNy0zRTI4LTQxQjctOTNBNy0yNUE3RjI5MDc3NUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwOTEzMzA3NTkiIGluc3RhbGxfdGltZV9tcz0iNjQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{48651F72-5A27-4EA7-95A5-B7B0390ECC65}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1112
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of UnmapMainImage
    PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:GP3OTIUJulN6LoqZzvQXV3QtTrRYRqu-vLTx6okkzl8j8vOZPtQzgRbm4zJFsZd_2uO9vWPBb8-Als840b7j41P8TPmwGV7tSnpjIyasnaIvT3WtmsBBLPekCOPvUW8Kimu5ZCWA5QcAyrJ_dWoNOefYmJJ29MX-f_MTBaqzCuZrVIIgjSBk03Qa9wxkedU5rs21ejCfgyEC2ISqYOQJ_2nCnlX050KKDU6od4uc0Rk+launchtime:1723021236387+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723020975945003%26placeId%3D2753915549%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D84e5953f-951e-4461-857b-728879874565%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723020975945003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:lpHTI4wASEKl1YgNux1feFppaWfWu1MH2RlyWmBkRqIUM3LxyVtRE4yMJRJSj-MPATtwO7S4apwKVHbU1Z94Hq61tHBuIusU7byO5vDTdc-lh9DpG-NHJb_7wtvQZLZZNC8Kypnk-PSAGQF2ZNxl1zIrpybHjljHqHqB6uxuNQ7QkoGs9Cmy-LwEGqrIi96bINcgcAyiQ5c4_pZmCGFLs2FAjdDgFv2tpm7ZT_CnDhk+launchtime:1723021292322+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723020975945003%26placeId%3D2753915549%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D5e10ceee-d730-4de5-8aca-cf3db3e9978b%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723020975945003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,7749523513536231205,4070259101680171086,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1204
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDg2NTFGNzItNUEyNy00RUE3LTk1QTUtQjdCMDM5MEVDQzY1fSIgdXNlcmlkPSJ7MUVFMDk5NDMtMzU3MS00OUEzLUJDMTMtNkFGN0IxMkI2QjI4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEN0MyRkVGRi0yRUY5LTQwRTktODNCQS1ENzVBQUY4NkU1NjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwOTc0ODA0MTMiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3548
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:640
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\EDGEMITMP_E1C6A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\EDGEMITMP_E1C6A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2668
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\EDGEMITMP_E1C6A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\EDGEMITMP_E1C6A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7FF8CE69-793F-4BCC-BD52-A55C96844DE6}\EDGEMITMP_E1C6A.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7e539b7d0,0x7ff7e539b7dc,0x7ff7e539b7e8
      4⤵
      Executes dropped EXE
      PID:2096
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDg2NTFGNzItNUEyNy00RUE3LTk1QTUtQjdCMDM5MEVDQzY1fSIgdXNlcmlkPSJ7MUVFMDk5NDMtMzU3MS00OUEzLUJDMTMtNkFGN0IxMkI2QjI4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszQ0RDQzVDRi01QTg2LTQwRjQtQTMyRi0yQkU0MkU2ODg5QTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS44NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjEwOTIzMDI3OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMDkyNTAzNjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzM2NTQwMzU2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iMjM1ZmMzYS04NmJmLTQyMGYtYjFiYy02YzY3YTNhOTU4ODk_UDE9MTcyMzYyNTkwMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FZ2clMmJlenVCa1hKMU9NQUpJNExMOUY3ZVNiU1clMmJyUjhpQmlFRlN1bFppTzJabXc0QUV1RHhZQ2h4cUxRVGdZRG9jcEFUY0pJVjlmT2dYRms5MHQ0VmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIGRvd25sb2FkX3RpbWVfbXM9IjE2MjU4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMzNjYxMDMzNyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYzNTA0MjAzNzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3OTY3OTAzMDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3OTciIGRvd25sb2FkX3RpbWVfbXM9IjIyNzMyIiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NjM1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2100

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\LimitDeny.mpeg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:3208

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3272

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4976

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU99A6.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24591f85e9569269a3b822d0da2e0626

SHA1
62641ade4943b93983b4e59ffd6ee4dcbd77c17e

SHA256
d29bcf294dd77568fd173adac8c705d991482d645127baccb7efca20f560a5a2

SHA512
d0bfe43ece2c598a12fe7d3f2cd12e0685b639aec0fc7a1bbdf0829b886c22208e4236500d8e6540d7faef1514769b87bbdc666602c5548649e50aa61f2077de

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
b2cb1dc29737f7dc609be329440716cc

SHA1
5e0468819121c1aba64a3e13ae0d3d48fa3d8d3a

SHA256
77553bb2d4177e201f9c53ce5ed4e4d0aabdccc47d14d83db1dcbe3527fe5536

SHA512
70813e1aa52d73aa01cf68e61d433794b650a447e95ae9f6527cccc25569a65e6db851bf75343ff2be7605183cceea4ab829e09ebe0f68aa23bfc9c124a450ad

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
74KB

MD5
818d1dcaa8ebb5478d24e22673807588

SHA1
7e4930bcda5a5216eb1e54aed5f0daa6ad09e8b1

SHA256
32b882dc8b0361d34742eda57d95d6d861ab673a734003c1f21cdf29cfc49c72

SHA512
4c53e7f35d3dee0c43ab6412be652870f76e6b4b84573f605ebe7407270702e1cbcb4abd878c7b981822498a4b922e96c2c47fb356b1718f454979e5b44c714f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
51KB

MD5
0a7c0eb14fb4f288d5c61cba111e3dc3

SHA1
48f6448938e1b8df723a9f7c6490a78887f240c6

SHA256
8bef2cb55b40f46f7e2fadfe280e4c41b71a657081858a8224c6fb639d910e4e

SHA512
a63a2651e36b03846d5818a4e03f7582ce95a34d9b4d4be9a5ee152ce22c305a14fec2618aa3f904495bed4c94a3256951ba75dbb0fd0386b3f570096ad4226b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
db853492b952e1033affd27167da60d4

SHA1
e0d6867d86cad5663a982a5b0426608bd1374c2d

SHA256
a4dd96ca33a7e70561c5eae2e6bb1a8be2e7212d6177b7df93f1f806cb2ac9d1

SHA512
17e86bf7a7d008ca7b46a1d844b606a930c28779e1a2b9316ef8153d75ccdb39dad1a2f3471de17edb3eea33b8e7c3fe219cbda0c225cce5568ef793ee90247e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ba8f1922230fa23331db5b0eb120766d

SHA1
09635283ba1fb3dca787dc7845d77d2b76a80499

SHA256
aa4a983500d77503138c00461ece2a71a1d83dd277720ee3b6254397e0f0446c

SHA512
99d01959ee201b19a22b96db57a48145cf3af5197c2f83b0b470c5b593cc768ea0c114d3a646063ead69264ef5958913f7279cd98f16a7ae4c8e31be4c0a09bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c4793fa6f42c26c85396972dc954bc40

SHA1
cd2242a66fff744ab3fef6bb2141263b1f9c56e7

SHA256
52374e1786b88c81974538ffe6c3fc8df7efab3eb63aaa37f12d142f6b89bea8

SHA512
7a5ec881ca037f077bb5750bab1fe16e491792dd7d09201c99b7fddc4fffad0595e98a87e5f41e5155175fd4648164a4989da04cb644a22844943647b099dfce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
f2143bc77170eb3937590cf34c8584b7

SHA1
8335b598d43400d56eb511062904f49c1e4a07a5

SHA256
47c850183186688ad729d3a22027a2a34e0613d4bf9551fedc674b2fa42a8f43

SHA512
6f886fc52c6a1139431c2f72a2c404aeec0c1f3905a2ce647a082d15e6ba7a68b3cd30f07dbdaf3dcc05604685a55d47090ea3e7e956ce747bdd5c9f60f5f955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
45e175db2e8a4688bb3762e7f4ad9561

SHA1
828f00452d59543a6f0ed4dd0fff3896964cfb48

SHA256
22acd3c9eab560c632d56604b0cb00939f661ab8a8c159431eb05fecc811d99c

SHA512
eb14a79d8e4d4c8e841587b0175bd3ed8ff4799b2b887a03342636d7c6ab1d4d85800abd3480c2121c6383d9087088a1733a5590129cc6d5abd85f4237bc2279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e57c190148820bff6d122f5aa2402857

SHA1
831a18a5e3ee0a871405e9be31303ef781c09c66

SHA256
cd6cf513876c639d15d0cc72f5c9f27e07af0798555be4a50a9d5965a1604e4e

SHA512
b2f2d7406daaa2d27dcbf71eb7c45e0382afc0c9366e88a92410ee87949acf5064012c773e5a48e9df59a3879beb8f0e84c32e54abd36158d53a239c4767b0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0213da984615b93b3193f8d09bafa591

SHA1
607751daa6c44d8127ab849661b45d4981389919

SHA256
3d2350c5345b1db8323a2f6e99016059290bc86e63f1babc7aa0e650d3060c53

SHA512
562c7b23c32cd24a299e096a9ae5aef608bd610677772cc008ff3554affc353005d40da227a16a6044451d23efb6a5baa021c8e5761f55850477b94ffc80ff08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cea916b115bd7e49e343e1c100a86006

SHA1
4a533c1016b6cdec81ad5ee864a40000ee4268ee

SHA256
1012fe75bb8c1c85fb32321cad1379cdae2559cd59e277f31482bc474d052026

SHA512
32f9aec200921a01961eb93f58ecbaedb219326081a9b1a1ff0042e7cc68fa28cd702a14f870b92609356ddd07ba954f1615d0a7e003af2cd7497c52e41bed12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb88db51878c3bcd3ee1bc48cc46cc2c

SHA1
79257a43d95856869e6831a64c66c8755aebb2f5

SHA256
e79ce9137fe08d83c4d38803aae00db2c82205f7f13669ed5388233f589ba8d5

SHA512
fbdd4e27f5363cc2149c505ae04d7463e64f66091fb349c5f258d81a41578845ada3d7194e27de5533461bb5d52d119369a6e8f97b5b75e8826eae77e880454f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cb338bbeeac8c61687ab92beeeaeadd

SHA1
c5c2247b1c0f5883c937d9015ec788accfe445f6

SHA256
fae155226e4378557ccb0503b29f49f736946eb060228c54446b3716336fe52d

SHA512
135d0b9b1f1a93d2c42d205b261cc31ea49cadc7b1c6ff2a6eab3f426ca95370857aec6d4f1025789850309ad3926bdc701696c670d680ebcd7a4bf025019033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
19e76254bf276a1428c1c44c2c279c1c

SHA1
7c8ce7620799fe7cb81489e060df1e3c5215870a

SHA256
9ed676595cc70189a72a3e57e34b8b79cdcddf7f73300789f976c24a944b315f

SHA512
882413efae7a951c4e97c8c9cab383e48e98e11f3d0ff17f4a6cc0d84445828a83e688a3243349bedc76ed468165dda7f74a585cd81607310d2e887067c4280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3971b68491e7301dee70ef3945bc97d9

SHA1
23d251d51b1f7441054f2c7af82bdf42e7a59c42

SHA256
e0499a947d5aa30eccce9820ddcac5014f91d7b4d5ffe023a9108feca588d1f1

SHA512
144a106f38ea5839fbd4a338e52ede15bfbe96d99fe80b38328199170c909db2439d5595c39dc08bb2a95738a5409447f8bced88d091585704d7ddecb2d630ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4fc2ba35ed70af0dbc735c2ee2146b5b

SHA1
9df4636519e95a5fa87531bbf084a4f561965b61

SHA256
b46c027ca326cfe8474a7ca35e81a9a8e17b89e1b9d0e41b4298d1dbfbdf6da8

SHA512
12b928542be59b18ededa115842d316c160c2fef555e0a815458bb2388569db6a6c85d05b851d3242c27a08d62030f841b9e3d46ef0f43779f972d71c60d9d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3f81e578416d1ab330e08000539d045e

SHA1
fe58b0b2e3cb99d3c0c936e3250622a1d9f89674

SHA256
3b864b72114312fea2aba28005de8dc9eb1c7fe810a3cf3ec9bf80c8db3898e8

SHA512
09d2e5cdd1d61df46e5460923a06794c1c3b7df1f5788ce28384f78ffdc77f7a7556638b90cac391ea320e0de89079a86c413b27b834b0d7304bd508bfbb761f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6709fe04a7b865f3a7c1f9b539512c5c

SHA1
49f5e2bc040dc712d76f25ae8757c16570569c90

SHA256
a47262da0ee73d1bc77749c8599b54fa7ecd9a2fa10025f4fd591cc6f1d90090

SHA512
5107cb5c3aed9a6080347ddb3eb557354da3a4f6dff18021c20cc5f2d0a6fcba5edd301b21bbcf8bec6398c15f9109393a63dae9fb130a40b9804a46912d58fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2728919575e899d201a9f5e2cc9f000b

SHA1
9325e7f17d6844b692037d506fda1479b41c1075

SHA256
5c07080243f6c9ebd689851a8fa8815661dccf4498b9a0e1e294888bac8cedc0

SHA512
a4fcbba9d5ebe25b5cb81ce723610c0c2de55e682e9c2e8cf6f6c519aa22e25fcd28e192fa819921f231e37dce1b4a8f8ddfadbcd2ae7997e2d5880e46f31f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0097ea2d7bdaed90f0deda5293d77759

SHA1
331d51fe7c0771150c7925a616b8b618f691c397

SHA256
1cdce8cdd19caf33e21465191d939ae6bbbc4f323265f170ed9a25c503d7a1e6

SHA512
a5b3e6e7d3d556401af008c77e340aeaa522e047d7bf747af659f51015b884abf24fd106fb022f71b1e280f8b57793f9a45044f3b32755c1d847f072560b5ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6d6fdb918fd45761b3f1825bc3ec54f1

SHA1
f587612e8ebf3efb09054d3070112ff84a22c309

SHA256
495747dcb38d86c5edb9fc632b05cd14cfc689ceede79848cea2d093ff68e5d8

SHA512
029d37fa57960ebf740dff8b281c31bec817858c576e5aeb2f012216a813b92e249a4723c1a658d08d792045d4e6b2eef9f5366e80d065128c6de9d31784dee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7055d798fbb9da2d21ed0851d6b0f2cf

SHA1
c2528e817ba7112011f0fb73c5f7a097f1db828c

SHA256
31b78f8d4d047861600420017c9480f281ffc61fe35fdd6406c017fd2682cb67

SHA512
84bead977f11245d0cdfe3598c0f5a50c834dbd43a6795ebbbade6a4fd797fe414debba7da1323fc9e145f43507312c9a34757734b28c8cbea70f999dd8ed950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
44bacc52a6addeffb5ab5c4fd3e6f08a

SHA1
72f794eb2930412de7f5eb43f9b8af4e8e0a63bd

SHA256
a084a66b7783dd83f60a4f56259e4cefd425edfd21b63fb5cbe8773e58ff6459

SHA512
1689dbd552e0f3269822d01c8eac0f38df9bf2d7b7df5db1957ee4a7a729179498b4adb1a64ebf60d12d436c063e64d14ceb8a5d6ecb4a96674847537424283b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4b94cc0800da4f11a13657d70235788a

SHA1
a29a101f484ad969d980b01901b0ce2182e8cb00

SHA256
8705f4ad4b2215cefb1c91388806e91f8e30a0f68f345330f4222db2cd251dba

SHA512
6bfd4d8de7a2f7f2f31b02519295cb69062807bccf2dd40e141b1f95fa3ad1ce1c6ece33756f2cd314fb2460c34f3271e5a060a24339ce87fcb2a9c8e867d144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
18d7f3a8f25575f78e80c438058a08c7

SHA1
7832eb626a8c9421db936e59444415ecca798661

SHA256
99d22c79dff8aa8640056aaeb4ae971fb67ebd72b85d0e06c7109640e85ec671

SHA512
42a9e045160fe2d4b418cfe52288efa288a90f1e51f6952b42dbfc3c62adbce0bb202f330a75743ff028df81a5f724697cb73b3514f174b243179865038de298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7f68f25ad4e43a4e2bcaa9f35c1a0354

SHA1
35b92b0b836d7ba98b04de5478aaf2448e862a7c

SHA256
67eecb8225a003101173cf6d9b230aa11912d8f08e36d66078bed22a2e9c0b8e

SHA512
d1979a52f865caa0b5f9737fdbad90a4828b730892b46fe961e0f5f9248dc40cd060750057bbc3266d0f3e1fb4740665b7d302debd6969b5958ccc5a01d7c423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b8b76da920cc1f498af04bf158ec1e1

SHA1
ba59e598761f0dd960f299c9fcf513b6602e5019

SHA256
018971d549059cf6e3dce9ef80a94f02dea50dbe8922ac62e9a3afd9392ca153

SHA512
5a07144c089cbf8b3440a92541f67b6803c78e0c55f8722160b4141d8250329e160c9125fdd0f1fd16d778f9557a5dbbfc32d1165ce55d44e71ee56c058543c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0edb1e66013b22bfebc3c8fdbeff6814

SHA1
8d6df5846a7bcddf8bf36339aefad4ab6c575117

SHA256
4b31454bd3305468201aae490d489563f24768c31021da74d2a248b332c7477d

SHA512
7f1cf6bd8b08ca2d00dcd44c8778043a0569f08e7bf5c3b838aec98c499cc8afff93b113533a433351b7d26309a55f891616d300340f38bf019c87bbfc546dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ae8197ce45577ab66abe00784c19d780

SHA1
677a77710435e29ab7ba7af4c089c80159721108

SHA256
f09b26a6a36320508fe42022d0afb963a6582383c1e7b8697a26a0a5fe82becd

SHA512
25e6419aa63fe0a6e2181440b982d09ca18e53bec6fe3d89670adb810b6d39d61afd1e4f3211b40a51c038daf656c142b8f59cf6d82e2849938915dff8d4f1e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7605641c28f55a9bdf2e0870f6cf445f

SHA1
892fbd3bef805600dd58e68b51600ac4a1065ab7

SHA256
78ad7c9b03687228d6da1ecd367fb56e3c8264c55ab492d12209297ab51836ad

SHA512
70d076406b858fab24e0148a2e1605c1eee8443947537856a92fb320ee75d999fbe93407998e1214352b6a0672d6275f5dc4058799a8025a3dbe95bfe419ff32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7d557e43420d56c411d82d89a60b96ab

SHA1
d9f4aa1b4c1d1ac53586e6ace97e69030010b7b7

SHA256
b23e83806c4cd71dcb6138eaf59c743b457ba2d7c27680e37ed5e6401b504751

SHA512
183f06a1fc9a8630b88840f349bd66f82d10cc1c8d49d111ea52e8c79b03aac9b15cdd42c825197e4efe22e095f0eacad70e36b505ed0533ff645a79226d1945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a996dff72ef8956ae9f0522324086e83

SHA1
519e6c32f625672085bbb443c1f5fa31921745ef

SHA256
023093b779bd5ed56a4161eb7542234ee8c8e01e7ebe7e947149fec23913a017

SHA512
524132eb7a7f4f0026661dfdb5ce5030c64426d9777eb6e0897fc6e98af1ad5a3050d583dc8c631e0b319cf628ba88661e524da44a65d3f158134e696af8a6e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
62e4bd8217d60bd99c20d09871953f63

SHA1
e48d5f379d489f066960f85a8ee628d5ac05666f

SHA256
e218331039592d363da4fadd6f5d2c61c3e45cbb8c099e8bf61062a6808cb2c8

SHA512
55be9f47dd52eb69707507ff06ec58546f66775c6b6a3edeaf38260fa2f650d802a3a14af80979a8d02a1955c9bc4719ea39b93fdc47d47622f8e35a0ad2eca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
63ac3c633671f7f73c63993b4256e5be

SHA1
35ccdcd8e2c36d87cfa7f457b8b787c190dc39c7

SHA256
9927cacddb464e6a7a642aae96da5d0c18a297997fcafdfe12666d3caf1d4aa3

SHA512
ca77f65e62eced36611c3a9ca3f0a97e5c41ccc4e3fff61e7368c32ec50810a89d576f32f9818c6e375d75f76e2466742029762b488560fc7398ed30771fcc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b77b3939b59d2497a58c4e60a8c622a3

SHA1
0253db87ac1cc72df18a0c27e2ef67ff148120ec

SHA256
50e882183dda7982b964678b78316bec84aa070760336602204ce32b7fb426e4

SHA512
f193e77133e30f0c4018284936a10b4912623acaffe9568bc82ea15d768e38aa5748a8089894689ebca3f2c2b05d4aed1035585e6286e84f93dc405932d7f475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
78119c7060755e09723d39a035b8d144

SHA1
d16e27a7ea211f0e660844a477cc4e27066e5741

SHA256
210685713d4474aefc7edab806f2da4716ab5d50c992e94df628192f46d1c8a4

SHA512
8b82fcdd655054be670f582f8f79050ee1f1b97ab09c140e91b9396931aa5b87f756ab3e0551e91f64e0edeb133dea119f81900ae3a23e3430c6526849c6c403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2389d033a596ceee4dc04bd657bc56b5

SHA1
cd3486515bf63894f457b12e7fbc8b13a40e1c8f

SHA256
ef0d695bad585d245576c1bb4007569a283200f11df16650be6ab0076b680cba

SHA512
e16e6f7688a3b1a7e9cc8d3a72590dafae098e47832677e11615dc0240a4a6a5b3b667eff2d34e8987cfda1b7ebf2a1431a9a8049b5e6d6a42cf588cfe02432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
739491bc9486d8958dff5e626e413129

SHA1
196f054c60437cec7cbb62d8d2d1a7b5ede9006c

SHA256
11f77a05be56eca21ce480f9299af521a3d51c06cfb98c6e778af00bcf1ff875

SHA512
0d32373265484fc636e6b513b143e9a69717294d2a0f94f8b111966e917ef21935566c32e582eecc9cd5ed8bf503f491018b018a3194a4b077b78087fd8663c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
150cdd90f992e92a69ee2ae6db1ecd6f

SHA1
158fe2d18314c76b26133f3770ad55297dec8ae6

SHA256
d8f3f5b6bcb853984a82c3ee5fea1aca4497d44ed6a6be4e0875638ead7aa553

SHA512
01c4062691a448a150bff86adab4af1429bae538e97b8856ee0c6ee65991f681be4313314553a7c657506277f9ca81df1560ec633fd3b211c3a0851d7792ddda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a8ab1292c6d266b40903c495680726f9

SHA1
9edafb46436af4fc3858ee45030a079c198441cd

SHA256
2944f9bd52e5da37b395d69e91abf9eed327e353a0100786765d068a3b885467

SHA512
4be485024c7905b729b72b470b7419d6fdbe105a872ff2faa472b9f558c461f5253a76466218ecf5b3bb8a0c3170f7dafe52a666c02d5064e7359aab3c70e8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7867507fdf61a1a539f36f990cfa6d65

SHA1
4486389f6e5ae1d6ee8c2117615aaf06548b5d30

SHA256
70da86d312668344783ae94992acbab91c61da5f000363eec0810f4d0282da6a

SHA512
5dbc835ea4b653e0fac3ed47fca9044c65c078cf57e36a8b69447760be911ddd65f3af1dd81586620b2c5b1d319562b03cca649e88ab4731bb0a4531f80e745c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43f40cfde43f1389cf25a9ffabc4af7c

SHA1
28a8293888de1423dc690749f91ffebf7bdc6a0d

SHA256
1429234e008b1123a652fcb523daac82c9a57055e7e5dce8096d21151a012eea

SHA512
9ef5bd9c102640d34fa87dd93c1ede7252b4ea75624c5ecb2f01ef5e80a04073fa288f0e86d0e0fadef6ffeadf8f53f37d1491a809f250f4167c1b28650cdf0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b1d4b202578d54a0dc17b210b1a413bc

SHA1
55a79eead7ed23806599df14e1fe0931a56f4a80

SHA256
52ceec43eb57887d59f111141b68f0d46ae29973e3f28ca27fad972ec1f1611c

SHA512
558b77297728a945e2003eac3dde9cc0a51a35c2dfb4c252d0b0303c93aa55073e1202c01db88c1348973816f9bc1dfc2149f912649168d92af32d72020e6d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
200a1df0be63e69bae8fb88b7a93f2fa

SHA1
46e31ab68ac978c99fd6591e78f9bc177ecbf313

SHA256
728a057cdec88fb8e13293b5e35e8765548b086bb262dc656d7c7e6fc48fe78e

SHA512
0f05050fedee95b8504518cd871df3b6eb2225d69f8c2a52f5702afd1a0d1103e85f869683320a9f6d0ed7e4502af458a8fc5dffc56b3ecbbdda859f5ed9c12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a13ae43cfd21d7c2336086aad652444b

SHA1
43f6fd55ea8b76db7d1f1b77c19d96dfa3ce7a80

SHA256
fddaf950361c13441634f14f6e1555aac5e1f7ac82ffcba37c7e1389436c6359

SHA512
212d24f74793f1d77c7e7fe77d42d9cc259494b4b2762fed5a943e7b7811b4c31b4c53f4ccae1abb80bfa0511b18a55a48dcf87a31821ba7492f9a3aa065467f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
085ce15bb7e088a0693f5ae66922704e

SHA1
867847a33c0bf01c81ae6f9317c48f5ef148e0d9

SHA256
8bc70d887f287e6e74bf1eafa94ab36a4134bb19a9320cdcff7bad9ee484f8a9

SHA512
e30c8d6be5625ce183f427ef4d1139e4fd3b3622f5240f097cd2226a43d12d77b9603b55ed42a79061cc0683c49dd1c3350c7496c18de1f99d4d944c9d15fe62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0ad01a7718c6185f5197dcd3bb83e56b

SHA1
4db8f008e2271c9c61cd759590bd999d50304c30

SHA256
410ffbabb66c441aaedafec797475f19626447c3aafedcea71bc066f82b582c7

SHA512
9ec216fdc5467d7765cc1bd38208089a618cd4e838a1892104c3ebfd3e27bbd7073d932806f28f3991f85d9c3a264d413dba88a37928d1f909bde3f01b624bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bd3188c6dfa89408fbe56bd5a77201ee

SHA1
08a5d6e345305ef06075c8c3b1b5f409cd69c020

SHA256
e3e35bed9cb6fe64bf21f7e987edcf9b33995d4ec8858aba2986b4b6769dee10

SHA512
fcd5701e2ea6f376ae6e12eda61c460e9ae48959ef355f4c7baa40f37113365b8f2dc5e760dbe68651249afe7466dd53e4e64a2dec298c39e22af48e0820c539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c70ddbef0586116e2534fe76bf7f86dc

SHA1
05a0954cec1b123f97d70856dcde33d3861fea0d

SHA256
b25d3afba5d920e4d18f5dc7ea68b33b20a41114df66a642f54b25fb667fc42d

SHA512
85ff42117c10c21e14d87871fc7dccefe52e9c18dd68f08bfdca00a9ad1f01b0df4f4d1f50b4fcf6db9f66612cdadd128d8ae972b59ab4e410c619f19892c967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0300595b653bdb0a14a47b3a989883c0

SHA1
9df59c591c058e59257e53f8deb8b57c41b3ef52

SHA256
70e0fc2d9a7793253091fc4d8606354076cdcea907eea1df613af57005297df8

SHA512
afda44f41e2febc22a5a3feb0147ccd9b2b4f1a7802a9102c9efeb343fd4b3f61b9c9c4c470b344717415e5f0a122ac86d0bc349292f1ca439963de098e606ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f82cfc72b5377dc6d53b2ee4fc1ab37c

SHA1
baade9e671b1212a786eacf5000c3ab48674d266

SHA256
2b65ca2197803e3af8b7f9fb1e71919efb92130d1893202ff57078ec596718d1

SHA512
909dc0a0191fecc7b1fefcb5c4b2365c169db5103d049561a2b01f58dfd2bbe5be162042c1213b16ad1d447836bfe9e082386e9b97eb8037b7a299f311897c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
111d2a915ff24e47335ad6ac1bc9feef

SHA1
43382765393ce7e966abc7b9eee12a62e4f83f2e

SHA256
7e1bcdca8e1e1f68b2863e76908c862cf6014fc0a70d3881cc25d50be4123313

SHA512
8f26cdb101d591e6ed1f01b74830b038100efb1361fc798ef891c15e64b95434480add60bd9e5ecfabee521cc74941a41dabecb901c755f6ab95dbbbd2ef0496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5824aa.TMP

Filesize
1KB

MD5
49a8dfb47ef83299e95dbe315c37b781

SHA1
3c28184b4cf80709f973075b6a660f91646d1c0b

SHA256
f50a800d255b74cff6b6b025343c7fe13d86ccc4ca3fe343af336bef8999e21a

SHA512
9ec7791472f14f5c708286012ab12f6b95e41df951f2b5d2edb00280b4cf32d33de4e83bf5aa2deb1354f172a4a82d54038b49caa064a7eef9f823e1ea00a448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca2d424a-f4ed-4059-8022-4292737b089c.tmp

Filesize
4KB

MD5
f6b7b45d4ee251325fa8cee27ee05b00

SHA1
141c42ce7d76503f7be95b060c7dc4fe13cd4ab8

SHA256
dbda824ee04e1688cde475fa65a0b157037fd7e5bade3cd7fc8070e318f9a388

SHA512
ccfa0d137bc0a6bd376f5f744e5078e9a5099c40f9d4562abe085bb39048bb2902e8d97b1cc861bc9af76db48e4d81c4155b910fe8c14976b180d5175d39257c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe023363-ae4d-40f0-8103-01c44d210a8a.tmp

Filesize
4KB

MD5
58c08c04ff4880799a23806ccbc55ea6

SHA1
32e1b607654099037ac5074f93c09adf5f57441b

SHA256
05ea30219b67dc9e1a09b58911a26215638bf60d10ebf6abd7304186a6e45ad2

SHA512
75182bb48b9fbfe6b7b02db8b0f4cfe530c2e233eb50d51728cbfa1158f62be76610dd26167ad2f3b9d6b1443c8ca4b7fa4759b9c2c0710fd5f5350393514aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb9b31de677c4eb8affec16f9849eb70

SHA1
2c47aa49712d19c6a5ccd8ee4bf5f77a5950a967

SHA256
d0048b8711897bd3afc42b956cf715f724998000d6c3fa68e5c0ea169c1e7dfe

SHA512
9dfe4ec28a24bde9a361aca49ec24479ac33826db7e7da88bb21c42bacb79e5bfa90f2b5695c44570d22fa1a19a0fdd41830ccdc9e7ceb9c0f035fe64c36d991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fed3a5ae85cb94171b5fa87d227f66dc

SHA1
9453ac008c45c120aa57cf17e52eae6e65e76b76

SHA256
8cf39a8d69ad5413078c144c8e24c899c38824a5614017234f8bd379b444bd75

SHA512
be4ff51156ae9171473174171435bb8479c6463230390b489405aa8da78b8bafdfaa28760f5d3939c7c43173261fb780b98ebdbf2ab057fb40edc1d4efac7bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
023a7c05b5fd78b896640b7a876b53c3

SHA1
d6b6d0c95da6cbfd3c196b2bdc5975da10b6f32c

SHA256
dcf26fb9747598a2d1d6b61fede67eba8a9b8be67ad2dc8ec77595b9d759af75

SHA512
84afa2fd2d15e2e0c22f3898095c0562eb7e6c29de60c837e73b2176bb9cee81fe30bbe02dea546e61df408de4a72fd37a517f343c0a097eabba98e50eeab95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
387654dc8ce4b27e78feefb231fd9749

SHA1
772912b9deb3771e84433115ce718aff31130078

SHA256
b92e8b28994a6c92279907c652743fe1c7ce25bb2676f96093789754e8e13159

SHA512
2cf1a257379699b217e016359bb60fb3458f7b61a57fa6aac69065ef393c27de3e43b57d6d2142824fa3c9ca4b6eb8f5d00711e051018e5cc1d4dd08ed79bd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86a28501a83a9632782a3de7e19fcefe

SHA1
e92b2b3ec9057b5afc4220414773ada083765a5e

SHA256
6288c33f7eae227da5cb43d0319a037e108cf717074ae2de157b1d6c75f43f60

SHA512
ae23a1cc1deb38069b880a6eb16933e5096f3ff1cd1c103004beace44b27f6e6261d0b2a8bcf3a6aa744a65d643c1d8cf2184f03dd6f02f996a866562352309f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6684b0905e42e17c1269cc47a2e0f390

SHA1
125caf0ac2fef20cb104c74bcd9fd312a63bb766

SHA256
78f5fb7f318a838affd9b76f69710f77683ca587e664715055a4ffb4df945fb8

SHA512
6a386dac5206fda25025285a51b186557d1cf77b0d4d0cb1cf5ad6feb9b96e7cbdf5b33da72bb7034d9136d7ed285ed3d5078aec6382bf1c893dab46e74a57e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
619210d63e8261c2e4f4842717ef4a13

SHA1
69d45224941edfcde79b6ea7ae89f4c242e0c3e1

SHA256
c9cb943dafa9bace1bbe11411b6735f90be786fc6f7ba3d41c4a7b668c0d08a7

SHA512
cda4068cdaa8f39d4a06040d2c097019ed8a468cbcec222a424284bd62a7f751a45bab36b9778629d2113ca759e25af8ed380cdd3e58005e01fe3137e257e100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c43e44db30a051f828b00ef8684f0e5

SHA1
3bde482111f36eaf48b9ed61740a67f15e02e56a

SHA256
6a238c0b6a3699ee76823066641cea1edb2c7a73e8e7a416b7719e040ea14125

SHA512
e50777d1be2b1f2e342797d5f823235784c4ca5d88b87a383600121e0edbbaf550a049a8ed1d6f1564457c8a39189c6f43e639e5daba05ad1049ba88d7b64f63

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4f09eefc418c08f275c2fa3f4b8d4dcf

Filesize
5.9MB

MD5
4f09eefc418c08f275c2fa3f4b8d4dcf

SHA1
1eabecb044e73dcfbf5326ab4fae00afdd22312e

SHA256
e9d623c447b1a1f3a279efbc835ce8e8ac396d85e3700b20c5c5ba6a0cdfab06

SHA512
d5515e3621ed19861eac2683b1409c0e34174920551058562dfa1fc009ec9973567a4109afe75577b960d42f1e876ea9cdcd09354c0d9ec48789767d534c6671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.5MB

MD5
6399cb94a0d00b72ffb53432cb26c891

SHA1
d18c3616da0c6807771c0d7e501e811a9f2e7ded

SHA256
fec985e0648a7d41c434c8fed666139090f7bb5df85939da743a1f8859765811

SHA512
5f06f6e235c1e1c68255cf34fa22713ddd8a8667d9584ba316358c785801a0d9ca68a93ff2c2b20d55bca5c0502a2edaa2a06a8f45fec2292b880725f8ee5097

Download Submit
\??\pipe\LOCAL\crashpad_636_CTOYUEDADOVYIQSW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1948-1507-0x00007FF873D30000-0x00007FF873D60000-memory.dmp

Filesize
192KB

Download
memory/1948-1543-0x00007FF873B80000-0x00007FF873B8B000-memory.dmp

Filesize
44KB

Download
memory/1948-1542-0x00007FF873B80000-0x00007FF873B8B000-memory.dmp

Filesize
44KB

Download
memory/1948-1541-0x00007FF873B80000-0x00007FF873B8B000-memory.dmp

Filesize
44KB

Download
memory/1948-1540-0x00007FF873B60000-0x00007FF873B70000-memory.dmp

Filesize
64KB

Download
memory/1948-1539-0x00007FF873B60000-0x00007FF873B70000-memory.dmp

Filesize
64KB

Download
memory/1948-1538-0x00007FF872140000-0x00007FF87214E000-memory.dmp

Filesize
56KB

Download
memory/1948-1537-0x00007FF872140000-0x00007FF87214E000-memory.dmp

Filesize
56KB

Download
memory/1948-1536-0x00007FF872140000-0x00007FF87214E000-memory.dmp

Filesize
56KB

Download
memory/1948-1535-0x00007FF872140000-0x00007FF87214E000-memory.dmp

Filesize
56KB

Download
memory/1948-1534-0x00007FF872140000-0x00007FF87214E000-memory.dmp

Filesize
56KB

Download
memory/1948-1533-0x00007FF872090000-0x00007FF8720A0000-memory.dmp

Filesize
64KB

Download
memory/1948-1532-0x00007FF872090000-0x00007FF8720A0000-memory.dmp

Filesize
64KB

Download
memory/1948-1524-0x00007FF871680000-0x00007FF871690000-memory.dmp

Filesize
64KB

Download
memory/1948-1527-0x00007FF871900000-0x00007FF871930000-memory.dmp

Filesize
192KB

Download
memory/1948-1523-0x00007FF871680000-0x00007FF871690000-memory.dmp

Filesize
64KB

Download
memory/1948-1516-0x00007FF872400000-0x00007FF872410000-memory.dmp

Filesize
64KB

Download
memory/1948-1515-0x00007FF872370000-0x00007FF872380000-memory.dmp

Filesize
64KB

Download
memory/1948-1514-0x00007FF872370000-0x00007FF872380000-memory.dmp

Filesize
64KB

Download
memory/1948-1544-0x00007FF873B80000-0x00007FF873B8B000-memory.dmp

Filesize
44KB

Download
memory/1948-1546-0x00007FF8712F0000-0x00007FF871300000-memory.dmp

Filesize
64KB

Download
memory/1948-1547-0x00007FF8712F0000-0x00007FF871300000-memory.dmp

Filesize
64KB

Download
memory/1948-1548-0x00007FF8713F0000-0x00007FF871400000-memory.dmp

Filesize
64KB

Download
memory/1948-1549-0x00007FF8713F0000-0x00007FF871400000-memory.dmp

Filesize
64KB

Download
memory/1948-1550-0x00007FF871420000-0x00007FF871446000-memory.dmp

Filesize
152KB

Download
memory/1948-1551-0x00007FF871420000-0x00007FF871446000-memory.dmp

Filesize
152KB

Download
memory/1948-1552-0x00007FF871420000-0x00007FF871446000-memory.dmp

Filesize
152KB

Download
memory/1948-1545-0x00007FF873B80000-0x00007FF873B8B000-memory.dmp

Filesize
44KB

Download
memory/1948-1525-0x00007FF871790000-0x00007FF8717A0000-memory.dmp

Filesize
64KB

Download
memory/1948-1528-0x00007FF871900000-0x00007FF871930000-memory.dmp

Filesize
192KB

Download
memory/1948-1529-0x00007FF871900000-0x00007FF871930000-memory.dmp

Filesize
192KB

Download
memory/1948-1530-0x00007FF871900000-0x00007FF871930000-memory.dmp

Filesize
192KB

Download
memory/1948-1531-0x00007FF871900000-0x00007FF871930000-memory.dmp

Filesize
192KB

Download
memory/1948-1526-0x00007FF871790000-0x00007FF8717A0000-memory.dmp

Filesize
64KB

Download
memory/1948-1517-0x00007FF872400000-0x00007FF872410000-memory.dmp

Filesize
64KB

Download
memory/1948-1522-0x00007FF872420000-0x00007FF872430000-memory.dmp

Filesize
64KB

Download
memory/1948-1518-0x00007FF872420000-0x00007FF872430000-memory.dmp

Filesize
64KB

Download
memory/1948-1520-0x00007FF872420000-0x00007FF872430000-memory.dmp

Filesize
64KB

Download
memory/1948-1519-0x00007FF872420000-0x00007FF872430000-memory.dmp

Filesize
64KB

Download
memory/1948-1521-0x00007FF872420000-0x00007FF872430000-memory.dmp

Filesize
64KB

Download
memory/1948-1503-0x00007FF873BD0000-0x00007FF873BE0000-memory.dmp

Filesize
64KB

Download
memory/1948-1504-0x00007FF873CE0000-0x00007FF873CF0000-memory.dmp

Filesize
64KB

Download
memory/1948-1505-0x00007FF873CE0000-0x00007FF873CF0000-memory.dmp

Filesize
64KB

Download
memory/1948-1506-0x00007FF873D30000-0x00007FF873D60000-memory.dmp

Filesize
192KB

Download
memory/1948-1508-0x00007FF873D30000-0x00007FF873D60000-memory.dmp

Filesize
192KB

Download
memory/1948-1509-0x00007FF873D30000-0x00007FF873D60000-memory.dmp

Filesize
192KB

Download
memory/1948-1510-0x00007FF873D30000-0x00007FF873D60000-memory.dmp

Filesize
192KB

Download
memory/1948-1511-0x00007FF873DC0000-0x00007FF873DC5000-memory.dmp

Filesize
20KB

Download
memory/1948-1502-0x00007FF873BD0000-0x00007FF873BE0000-memory.dmp

Filesize
64KB

Download
memory/4952-1497-0x0000000000810000-0x0000000000845000-memory.dmp

Filesize
212KB

Download
memory/4952-1442-0x0000000073200000-0x0000000073410000-memory.dmp

Filesize
2.1MB

Download
memory/4952-1387-0x0000000000810000-0x0000000000845000-memory.dmp

Filesize
212KB

Download
memory/4952-1388-0x0000000073200000-0x0000000073410000-memory.dmp

Filesize
2.1MB

Download