hxxp://roblox[.]com

Analysis

max time kernel
1200s
max time network
1199s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://roblox.com

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 19 IoCs

pid	Process
4692	RobloxPlayerInstaller.exe
5080	MicrosoftEdgeWebview2Setup.exe
3228	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
1484	MicrosoftEdgeUpdate.exe
1940	MicrosoftEdgeUpdateComRegisterShell64.exe
2924	MicrosoftEdgeUpdateComRegisterShell64.exe
3604	MicrosoftEdgeUpdateComRegisterShell64.exe
1912	MicrosoftEdgeUpdate.exe
2080	MicrosoftEdgeUpdate.exe
4680	MicrosoftEdgeUpdate.exe
2648	MicrosoftEdgeUpdate.exe
4404	MicrosoftEdge_X64_127.0.2651.86.exe
1060	setup.exe
4592	setup.exe
748	MicrosoftEdgeUpdate.exe
4996	RobloxPlayerBeta.exe
4148	MicrosoftEdgeUpdate.exe
2660	MicrosoftEdgeUpdate.exe

Loads dropped DLL 21 IoCs

pid	Process
3228	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
1484	MicrosoftEdgeUpdate.exe
1940	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
2924	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
3604	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdate.exe
1912	MicrosoftEdgeUpdate.exe
2080	MicrosoftEdgeUpdate.exe
4680	MicrosoftEdgeUpdate.exe
4680	MicrosoftEdgeUpdate.exe
2080	MicrosoftEdgeUpdate.exe
2648	MicrosoftEdgeUpdate.exe
748	MicrosoftEdgeUpdate.exe
4996	RobloxPlayerBeta.exe
4148	MicrosoftEdgeUpdate.exe
2660	MicrosoftEdgeUpdate.exe
2660	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4996	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\PluginManagement\back.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\unification\humanoidAnimateR6WithFace.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\AvatarExperience\AxisRing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Slider\BarRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Emotes\TenFoot\SegmentedCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_3x_15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\NetworkPause\no [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\models\AvatarContextMenu\AvatarContextArrow.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\ic-close-white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\ArrowCollapsed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\dialog_purpose_shop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Emotes\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\PlayStationController\PS4\ButtonShare.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_1x.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\resources.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\families\Kalam.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\sales.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Lobby\Buttons\scroll_down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\de.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\image_keyframe_linear_unselected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Help\AButtonDark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\edge_feedback\camera_mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\LayeredClothingEditor\Icon_Play_Dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\icon_picker_disable.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_woodplanks.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\xboxRSDirectional.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DefaultController\DPadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\cs.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\FredokaOne-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\Debugger\Step-Out.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\particles\sparkles_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\Misc\Unmute.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\LayeredClothingEditor\WorkspaceIcons\Center Camera to Mannequin.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainEditor\lake.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\RoundedBorder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainEditor\arctic.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AudioPreview\pause.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_snow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\sliderbar_grey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2648	MicrosoftEdgeUpdate.exe
748	MicrosoftEdgeUpdate.exe
1912	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-01a570a3cd0a46f2\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 909148.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
1256	msedge.exe
1256	msedge.exe
2104	identity_helper.exe
2104	identity_helper.exe
5016	msedge.exe
1508	msedge.exe
1508	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
4036	msedge.exe
4036	msedge.exe
4692	RobloxPlayerInstaller.exe
4692	RobloxPlayerInstaller.exe
3228	MicrosoftEdgeUpdate.exe
3228	MicrosoftEdgeUpdate.exe
3228	MicrosoftEdgeUpdate.exe
3228	MicrosoftEdgeUpdate.exe
3228	MicrosoftEdgeUpdate.exe
3228	MicrosoftEdgeUpdate.exe
4996	RobloxPlayerBeta.exe
4996	RobloxPlayerBeta.exe
4148	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3228	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4148	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4996	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1652	1256	msedge.exe	83
PID 1256 wrote to memory of 1652	1256	msedge.exe	83
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 2908	1256	msedge.exe	84
PID 1256 wrote to memory of 4596	1256	msedge.exe	85
PID 1256 wrote to memory of 4596	1256	msedge.exe	85
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86
PID 1256 wrote to memory of 1664	1256	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb057346f8,0x7ffb05734708,0x7ffb05734718
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5080
  - - C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3228
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1940
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3604
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkRGQkM1QUQtRjRBRi00QTBELUJBQUItQTlEOUMwODBDOTgwfSIgdXNlcmlkPSJ7RUIyM0YwQTUtM0UyNC00RjEwLTg5NDktNDMzMDgyRDkyODBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MzgyMDkzMS1FMUJBLTRDQjEtOTk1Qy1GMjYxMTM2NzY3MTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2MzU5MTExODU3IiBpbnN0YWxsX3RpbWVfbXM9IjU1MSIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BDFBC5AD-F4AF-4A0D-BAAB-A9D9C080C980}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2080
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9107091557299169814,2660573322930639476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4680
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkRGQkM1QUQtRjRBRi00QTBELUJBQUItQTlEOUMwODBDOTgwfSIgdXNlcmlkPSJ7RUIyM0YwQTUtM0UyNC00RjEwLTg5NDktNDMzMDgyRDkyODBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBMzU5OEJGRi1GQUM4LTQwQjMtOUNFNi03QkExRjZEQjBDQTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2MzY2ODExOTUyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2648
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\EDGEMITMP_AD273.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\EDGEMITMP_AD273.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\EDGEMITMP_AD273.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\EDGEMITMP_AD273.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C5D1CCC-F3E4-4096-B1F7-272621263FC1}\EDGEMITMP_AD273.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c2b4b7d0,0x7ff7c2b4b7dc,0x7ff7c2b4b7e8
      4⤵
      Executes dropped EXE
      PID:4592
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkRGQkM1QUQtRjRBRi00QTBELUJBQUItQTlEOUMwODBDOTgwfSIgdXNlcmlkPSJ7RUIyM0YwQTUtM0UyNC00RjEwLTg5NDktNDMzMDgyRDkyODBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntERjQ5RTgyNC02Q0QxLTQ5MUUtODUwNi1DRkU1RERGMUE0MEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS44NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTYzNzYwOTIwNTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjM3NjIxMTkxNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2NTgzNTMyMDI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iMjM1ZmMzYS04NmJmLTQyMGYtYjFiYy02YzY3YTNhOTU4ODk_UDE9MTcyMzYzMDkxNiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1aRnVHc0Z1c0Q3TlYwc0wwY3g4amZYTHA1SWhkMjZCS05zVE5DVWtOTkFnbjFsZEdoeXR0WlhIYVhwNWEwM2YzN0pYTHVtM0tJWndlWURxcSUyZnZEcSUyZlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIGRvd25sb2FkX3RpbWVfbXM9IjE0MjY5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTY1ODM2NjE5NTQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjU5ODQwMTk4OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTcwMzk1MDE5NjMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MzYiIGRvd25sb2FkX3RpbWVfbXM9IjIwNzA4IiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MTA3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:748

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4389.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24591f85e9569269a3b822d0da2e0626

SHA1
62641ade4943b93983b4e59ffd6ee4dcbd77c17e

SHA256
d29bcf294dd77568fd173adac8c705d991482d645127baccb7efca20f560a5a2

SHA512
d0bfe43ece2c598a12fe7d3f2cd12e0685b639aec0fc7a1bbdf0829b886c22208e4236500d8e6540d7faef1514769b87bbdc666602c5548649e50aa61f2077de

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
d7ba38896e5a676cb22f4c3987c2c8c6

SHA1
bc2214e162b81a7bf3957c6b23aebfb382c21803

SHA256
825465424621972a4aaa4d1ca1e9c30dfdd70b648667efb9355d8052627887d8

SHA512
16b1132ecefb3962ad0678cda6567ac38cf408e41c4be949d0ae87c20a4f530a21be3b5c659a75d4c037d343dab1cb35bb92d9369f7769a527cb49172463910e

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
67KB

MD5
4faf1b958d81700b0c111061c3299a95

SHA1
6c380e797070b0c37f18ed6d4d9ff56f4437f81a

SHA256
767b08e933a3554499cebfe07c99a2f7a7cfaf1767c5358e326a327920face8a

SHA512
6ec2381c6cf2238e189f55f74f0feadf3e578c459d8beeef1e6bbd70458cc13fc7cd99fd2819aa6be89b230aaa93e4dc0ea23fd55d58261852455c3b3be96f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
51KB

MD5
0a7c0eb14fb4f288d5c61cba111e3dc3

SHA1
48f6448938e1b8df723a9f7c6490a78887f240c6

SHA256
8bef2cb55b40f46f7e2fadfe280e4c41b71a657081858a8224c6fb639d910e4e

SHA512
a63a2651e36b03846d5818a4e03f7582ce95a34d9b4d4be9a5ee152ce22c305a14fec2618aa3f904495bed4c94a3256951ba75dbb0fd0386b3f570096ad4226b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
22f796b517fdc6f8d17870981d6e4fd8

SHA1
e4de6d7ed0002a3a3f402e4876c24e7ac22effcb

SHA256
64d1d4c167c1cde5a400a99fdf7b9609f20f4fa5753235bd788bb230130f8f3e

SHA512
42c886aebce7a9beb4e169c3477ae5f078a0e29ccfeb8e95f62889372ee409fd8572d09d703668c73ce1a54c27b026c22961990c10860a915a842397451b6546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3740a752015d86f13c41d167b7db770d

SHA1
e00f8bf5bc689aee810ed51f3b4b4059e58c3f6f

SHA256
45eac5e486544467cba69fe27b30b6d3591ed3bbc92eb83b8fb199bbc7c1b88f

SHA512
294f6d774af9909230290e7c8f01db76662ee9fa4e139e54d12f9a899c78d2d15e99ec0b55f76716e03bd267b47f32041f1024d38ebd081c26bceb730029e0bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
932c4e056b8cb0fd10374c37d5a7cd5d

SHA1
4ffcc2c3824c1212e21784e202fc4a5dc5b34fff

SHA256
d8d68df53a0dbe8b55ad5dfef173c0c274dfc8f2f16abc79029510909d5656c0

SHA512
20768f378930b14d2b8c6d33086c48d971a8dc17d72aedd198f5cb91670a50a8b8ee7b35455cceab5f4b1dd1c78845e21d077df2e44124e8c90b4f311eca80fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
54a9faee2708ba7ce1293c0f785b9add

SHA1
8f6568381b1c8ce297b9e8470d9784253d7bc8d4

SHA256
aff088e584bc373654627004d884e67be8a7d620528cf7e57152ff653b151a21

SHA512
49c90b2606868ca5f74c20f6ec22fb191ccf8a4dd66b398d94003df8dbe2077c411ef0bd1ab7d256fdd9882e80cd64af2011139142c74d2980be1e5e70130a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3076239dbbea2f711b0fc5607635d55c

SHA1
e8ecd82ab8aaf9d426a10f8c7af954f9de89be0a

SHA256
0120b0236565626d01d0dbf8702dd4ef04ea8ae8a1c9f4804c6d0a05349ed8cb

SHA512
b8228f9101e89ea08d143e328fa914a450b0a69a9b88d6f328a500c4c0b870cffcb662cdc1bda5c9d157c11b1968a56d92ce5fa8064bfbdc78d75686cd3a76f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ae325128e77868a55ab23187fb1cadf7

SHA1
aefb6ff6bd7ff0bcc7cd08d628721035462d49f2

SHA256
4186f840349312db5df8764fb9029a1c9ec9eb1976f4e3784723f38196a274d4

SHA512
9a5362466a391962d4774565b80ce777a53a26c970a1be0b896c9e5c2bcd1e36a3f8bef72bae094263a3cafc0b369572bfae02670a795fff0a097ba055df42cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
a41f9abb18f70ec8e096c2f1dbc93416

SHA1
a12d989be287fed660d0c6e900f2f3f0e0f58ff8

SHA256
fd9530f91436551f9a4b256821196eadc073e652c680795a6ae8c3a43cac612f

SHA512
0c27cc43a7e98047343137368ab58f30769f529f5a8a39f7aa8351159dd02ca8b300ba10df34d1e023e08c4585c58d81ec0b9a5307a8b3da44bb5a0096f59fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
2226e6423fe44ce23b7667a261d17c26

SHA1
41bdafc22c4f3972d8b9ba3fc62b95e843759e55

SHA256
c7ecdc59b581e33a867a5312b05018aa785bb4392c586e9e987597728c3b8171

SHA512
04f7ad43b51493c595310b3ea5a80f90730e44cd27cacedebd027201ce51729aa6325799356c77a0791dcd0af251a0815edc1e07dff8a7f5eca33cc14b687d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
4d7c34cd80f236be2a44f8e3d727b902

SHA1
c34acb3042ce1766c6f9c9fb59d6e8366716e0a0

SHA256
e3236c3d8c6badc399922723d538f12f5040fc6ab8ac5b2e618f66cf9436eb6c

SHA512
e8779d85b358e4b90d02c1272e529d05eb39db1e6554bfeba259cf274527d20e760e7891d1c5cbc79aa747b47708f7fd8dce604595e8bfde9058f467947288d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
d23c1303f938ddda9b7a53800f39f060

SHA1
f0d629fe4195a22dc8e0be6a18378907c2d828b8

SHA256
c14d72df1f3530a45b166bcce657929084275b1dcac54adf5f80232e7783e473

SHA512
c78c10f8d3b43125c4f48e04581057d64fce1beb234132e9745ecd5e8f4342367b9953928e5da84dbd87e3ebc9d53a7e8821dcbeb698c9e3385f44617f1d7ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
cf2581d76de72e39be9a72b83e510048

SHA1
6eeb0851f4782a5193bea2e0322a8f844fe592f4

SHA256
b0b4a06afd6fa4241de7589bc80fe5abbd451fd6f00700b7ca71168ca13af82d

SHA512
58b2f6ee1335a49cf66635441e13b776b94b86d30add456269db6308c7f65d8f69a4f2a472dfb211501360a9c13dcfa534ecaef2147675044b00f7623f69f91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe660f0a.TMP

Filesize
673B

MD5
5e22e5b919a74843852e9933a3a85249

SHA1
4503498aa235584bd1d03ddfd33008da7759bd79

SHA256
69a07466bd1e60d8cab29aef190a592b266c86c628c4a85fb69b310b4f8be2e7

SHA512
cbe686fbd62803e10ae271be940a572d229d5be81cc5088efa75f68c85d6311514e2e37d07defdb08bb8905c1f7c7943a829647cf73972541232f4dd56c75656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
d552d4e6baf84d71cf72db3f2bad5a30

SHA1
be88cdb4d1a2c0c489c1215e82fda5b59d176b86

SHA256
34510300917876a00b4fcad143d1376f4c0d7d6bf7baf2856c84b65610ddd4b6

SHA512
eebad770dae5729e111db615e431843f1691de838d306f53caebdd769b6fa14d98f589c39c45728286f409146b59a285e04b510e33897bfc86789616647c4d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
55e4a1083208cd6e13a9450f9984dba3

SHA1
589865ac5515e00aa860d76a6c62320a69c83add

SHA256
8e39150868b11193d82e1823aea13daea05afaf8798c0a5618bd729a24bf1bb8

SHA512
44468187f7887fbb3c2f6f5d346bb0aa401bbcc1b73e12699a8f4d74c83fe6821ef61199b7cf7bc3028832ac433ad4d7c6ffbd7016f7b0ba302ae0953fa64ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
50901308284e41af7b3273ce396a1ee9

SHA1
30ad706628f4fafc9e699186b24844f7b277d520

SHA256
cd2a611fcc85e6d35c4c3c51a58db5c4c1e63c029b05d97a670775132b0cfd10

SHA512
df280d5cfabf0e2f1d2033b71de5e95a82b517e36516688bc94957efc132b9f0a283d8d02a4fd83759d52dbe62bb84eebe059e96aeb49d279297fd03810e57a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
b41b005fec3e8d184fa2cc55c0936fa8

SHA1
ca0814e1063073e78082be8dcf3b346d3acfd056

SHA256
a3a01bf403d5c0c7873449f187d9a0183cc35d292a66216a5227f68f14e300d6

SHA512
041e9092cfd0711147dc7adb82e7a53b16ca1391e5900addbbd43a72365639705e3a65630d116fb8bd82f4af0b8bf19f5c6030505dd99db51348a41f2dc320c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
da04379465cf36601f9bfb8f2929402d

SHA1
187a790ad7e35d01ee7841f500d76d91f15e8906

SHA256
f88943b239ded809d9708f10f872c768ec1d316f2e37180ee97d23eff2f30c86

SHA512
4a8e917b39a163bcf02d5693695a37ff7c2c7f518266fc63f69cd27165fd94b0c5bf16d38226a64db1600f394db42b8f14573c0874a9cfa4cd05a198e4687c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
d21cd442442f1bbb414bebe500c993c5

SHA1
302cb994e63408fd09cf98d12f127d0409b30cdf

SHA256
5a0dc9fed7d15850c23f977132e342f5214386f89ff4188268745a71c1221cba

SHA512
1e8326395be23972b5ec69490a1fd166dadbfb0c57450aae71c94df7e91d1cbe9d7049c7c8816245bbbd24b460b2840c4b71be03752550caa8af4fbf0925382f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
670f9d24c6d12461b0247274ac40b8d6

SHA1
bed6d23a8ccee9bfcc0bc9f8c93806a52674f434

SHA256
99bbd185bb35877a57053f659d39e3caee8c716f322bff66e00fe6997b17f14b

SHA512
6c760a37a6f7499bb841fda8bdfdd893fb094638e96d2289355cacdc15fb9d44b07b84b53caec21df36ebfde642b53785719c108d6467bbe7b16c8b8f976651e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
933dd25d22028305d6524aceb97cc9ea

SHA1
2b7456340f74a548d66bcb545afc3e3c7dda6a4a

SHA256
42e20a9f4fbfd0a6d9264369e66d54ec2b9f94bbb1e2f8ee0938f2fd9b798967

SHA512
c12b97b167b368b2584fcae33da2d70c43623546a55d4bec3e9afb7d5ac26851a3059cbe9e50c45e125d08bbba4519b0609d481003f0699aaebb7388b3dc05bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0681e53d4209e71fdf7e29b61fc8319c

SHA1
8cc4c0a0363ef08d696ec6735f5a69e5afa693e0

SHA256
e4fe684e1dcde8a49771ffe9bc17def1a0e8e681e92b5d9c71d395cf64bdd08f

SHA512
2a2af2c12d2203e629513cd76db7c18b84bab0507338846ff96087bad44f217a8271cf260cff1bb7aae4e5f83ad3b03523574aebec24e066469460b4cc67cb09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d502b0f55edb8a762d945d93f46566c0

SHA1
df4b7773988e6c37197e2dac38440ab38d0bfb8a

SHA256
e184a7fc340d19cb4b617b4d414fbc59dcc7f8f1fdcb9b7fdcaff88313a83ccc

SHA512
b856906b006af566ed2ff00b380533ddb81cf3574a6e117eb38959332e12a57aba7b03ca3110d4748075251f6954bf6f347db26e256a340e1ce3a687e472585d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ed3e4257466b26411947e1823ccc800f

SHA1
dc5bd309b2ea70872dbb645df268181adc225306

SHA256
7a9d56064778e9b3157a9e63d1f351392ccafa4229e4f96a9ac0d89e614bdd7d

SHA512
946a84b959a7d3e80d078a74c22da2efaf2f7f53cbdccdfd1ceab35e5e3869e5a42fe945beef491a2ca620fca9dcd0753f141ad01c599becc2da4dfdcbb197da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50dbf2d07891621ebdc2374257d6d1ed

SHA1
0f05210679210b09bbad087a6c5d84cfdce53a6f

SHA256
02e76c39565bb459a7d890d374d0778a50f09385b18d0cc6349aebe4118fdb83

SHA512
8f36c2c15a2d555f913bab3c2f08394ba89092bd63929cb376cf3ad00dc919163db1df2a182e03cddc72ecde7a59d34dabdb6aa6db0ef98e1ad5a1e272daf574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fffa91f84629ca12a4304dab0dc52aea

SHA1
09abcc6b8a658f061658555d06102b570318f30e

SHA256
2b26c709438acf3e6587af9e6a5579dfa517e203fe7c77549cec720ad45fb69d

SHA512
b3c5b0d8d9fe5d04f2d224a88f93c6496c2f0beddb3a7db0e03b4b0fa36fcb10d881c5b1252888cc26bcbc4360ac1bf5714456cb644af9e97799e39a523f9864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2f615186175f93bf80111933005c0f83

SHA1
0da79039924e1671b2a351c2854236e07a51e95b

SHA256
4244fd16a05a1542bc64bf347a90ce25d7673362fac57ff5c94d7475e14cf1c2

SHA512
3ad0d5b097fd7be4e1b59906bde7fb5dcff5b31b3fc0c1d31781f60c482c6d441b6f95ad472edf6df1588069737ab3c595b2132034a16f1cf1a2f0cd50e2a5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60dec82cc6befbf93bffd9211b92f108

SHA1
f463f50ee00395a2bebbeb898134db7917075436

SHA256
2ec696a0e3ffd38fe35152e5fab363c5ee6d8517d5049659b265d22c653d622d

SHA512
d278aa72ee29970f9c618db11565575c807598e1b37c974e52a61c0ad59c8ca9b4fbb09330e52eab998e84ab28bbaa93d27709afb077e910823d908719a9805e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
de31b272439e21e1e44b87025621d51b

SHA1
edf52d6c542f983452fe820f62a98b893c37fddd

SHA256
fbd2c0999dbb52ec299abe74e5b47e0109f1017675f2ed5b91c6bf7c9c514877

SHA512
ad2cb7e74d9e03b651389fcb7df172d37c167d9417cfbc4286f4fa6c443c56b2b111ba6cd25b7e636c5d8b6b9f29910c84fba1dccc38a184623296f2fbb4442b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2bcc9bb26c2f7011c67903a101d31ed7

SHA1
dcdc014011aa5f0a8ea776d8d6be4f3400e7c8ad

SHA256
4398d9987f70c85a3533b3061027d68a98041619a56d7255e73514a69e776b06

SHA512
5160715d07359cdcb9b2e3246a91d00ad3c6794ee01de384aa599a8f4fc58f3670db43551194c2a0ebd421e28a3edd6ebd9f0daa8f9c5d1dfe8d07bd5ec8ede6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c5886c7fb16788c761a95eb61db9805d

SHA1
c0baa1d43c00457c253fe971e4cc8e1c43a1bcd3

SHA256
dad8140080fc4ab5d77a75be16fba1bd11453ee3c133a343924984e528dc795d

SHA512
b341335cda3c31a7cfe2356177cf8d8cbfa0cf9b46a92d7f46a36293d366ada2b3f7637798504c2fb8a1a516ae0c0f6f9ed2895c17c89c8782d1cb2e3ed8dd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4218ff88afd1c7108c425acf5853bf96

SHA1
c968387400895db566ca3171239fae4ca1dfd024

SHA256
a82c9ab7b0aaf2eed5857926e86fed4d4289bf6c49224ba10b0af5cb52637b09

SHA512
d0c7720ea8b24223274ba76b4a9000a848983ba1af85db482dfa8a1e2dcac23364065ecfc28ebc10c913dfcb0969abdc172130eef882497f4f177050b28d1584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
df24ae81f0139da39034b7e575610030

SHA1
350a0febf19869da141c8e3d13c760e62013ada2

SHA256
d4f4590171b20782a53b021b1473482ce35f1f2719960e9067f557a78a3b2479

SHA512
8c97617ad1b30ef14aa3ce579e9e34e568339a06e1c38c40576e44842402219f5eaff7ca1c7f1bb580f0a81011370a58b4aba3ce7ed34dfdc24258ce24bc6dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3ebb4a929339d31c59dfd372dcaff2cf

SHA1
5119d85a7fcabc409afa85767f4d3c4ad92dee2d

SHA256
c83d80aae7da10bc48af7659dfacae57cab673a9afe1b63ebc89310a48facd75

SHA512
79574e783952facb736090c254f2ac08349ac76de245136dfa5e20d97a707f50e2eaea49f39c90eef6f05213b16e7f8fe02b1908f6ceed62a6c6e57c89f8421e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
02df9deffdd54d69531c9b7e138cc52e

SHA1
6db56b01b444f22e6577d938aefcf282210ce8bf

SHA256
6a1ad09c51671ea192e564cab612858e471f6c9a4b2983dbe040f9f4240b3620

SHA512
b84b5fc3e2b2994689c9c821d8967b5d8b45b37627f139508728b0c7a5118eb2b99c600c4a2a78647e27fbd76ff220cfc573b3e69d2d211fa413a98acc716ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3e0f1a7f13f87bda4c2ebb8a47345a14

SHA1
be75ddeb039c6a729e29facc617ebebb914e4dc3

SHA256
398bd1c0b0eb71e801bc45d3d44230f904c360104d133a229d84816fe96a4ee3

SHA512
04288b77aad778db23c14db912c2286d052bc4a32d824a022c6ec5e168c9d8df1184cc2da2f0da653b5e590d21bbb75382a9a04c9cb5ec99fe98dc13457a6c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f07be25530c7f46148294cb9c6cbbddc

SHA1
c2d1d1e8eb8e3917f2ec48b900c7de6b7153826d

SHA256
f09ac3337a195a9e6f6dfd63486128ed7846a4fbfa1919eef8039e72f6bd8137

SHA512
4f7362000ae845d14af09ef98cf57eb21b82c60a69d1269dda04622619dd55c5391377f72cbf7bb2fb9911985361f804ce50672f61fa724e0c10e069e2415528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7283598be228baa6f9badcc67d8fb224

SHA1
eabaab2ce2356b6a2fb800188015b853079a6ce5

SHA256
9e3c558ee922f9126c812413a348a174872cf4dab71cfc727b2c53d5e8a15fca

SHA512
8b960f71e2ae47c08a5815c60a6c4c9d28592a822bc2de0444ebbd2f9ee59108af0654ba45c73d003daf8a4dcaa50e11bd0c4411c631382a380e1588509fdff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01bb184012b72f20551b96c7f12d3f5c

SHA1
511d0a2ae876672ec5ec662f058910639464e09f

SHA256
3147374e6da5c6f41ff0ec4a9eb02754c373b9e2bd0a332b1326078b8a384e4e

SHA512
2a34d7d1811e75f98d3cc96b9da9e9d74390a5466e0af926ba484f14932305c1a48298bb864ad28464f8495c9feb3149c7cfecf88207f2be570ba40503531395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ec83ee8ce74c145e0856c24310fc91a3

SHA1
206cb7a421f3344666720270db2963615a4f7353

SHA256
bad8f3995d37be9263ee72ea8a0e4039b101493b14213cb329af68d495e47bbc

SHA512
52f25c68f92e951ac4ff44f0c8fff915e96b65a92868e3fcd8809e0033b6f67c06f5cc6f99fc59d763cf05d777d6d016ae636e867f060752a6eb296c94c89c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f546ee7404315fc571658b195a5aea60

SHA1
efbecce39a588d7a991f85e59d86b89059c3131c

SHA256
1b079220ffbfcfbf3c696f346874e3717ba02ca254e9e319ff9a84612bf36b0c

SHA512
6ff3ca51b0d8d59c2c8a8c3c44b587d053f1b151ccf30b26108f954c5c8392a6b1d9285e4de958f21ddd1f5416b5c30bec5cdff6f7b14fe3195c92142bdcf5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ccab1c870d8361e0172d502749a3585

SHA1
ba7ba8c9fed7086a1d03b9f49542f920c6b65cf3

SHA256
a97d019d58e57e267c83cc929f5fed317a33c1c76debbcaaa95da9c0854c5c4b

SHA512
67e4f117d088740ed6244f5ebe0e6a3336a5868254a64c45f925633ac05f4cd6ad217c855025bc0b5cc406ec6da7139aa9d81358f8f65b4b49fad1337287a6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c81777c3a708278a73c3bff16b615b5

SHA1
57a3e6a4d61c58323ab0ae48e6cc146b5960255b

SHA256
9b2a21a6ab8479be9e2a681d4e2a70e3c00f9145040b2e864730208f02b79283

SHA512
b2f0608a4df6c6a01e8081a9b661689f20e1585f06bcec67157dd0216389069f39de0651869381be48218c54fb57776cfe07dd3b67479fc5ee9948565109cae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
356a2a2057e8d3d0f2b0a7f00d7e99ac

SHA1
59e4469b9fa05da5a68e131c4439f6aa927b4b1b

SHA256
132d23a30ccd684292569b37f9dea9b430aa4c1c10c73713091ecea31fe1ebac

SHA512
6d11d1c2db26ef23ca8a499294a4b9aa25a11ed0a1af07cb40ad6e22f1d520d07fc2d4fe12b6684747f73cf844a32cd9bfc75e654158a6e42f2faf428ad01e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9377a727a816d28514942bfb34bce078

SHA1
dd0750fd725194154889a46666496956c0d9cddc

SHA256
335f5c35f914e0d1856e24d3ff2e3288e9224f6fa763806fc3e53d8867ee3254

SHA512
60b5ad404b08b7fc6186b2b3226f26e9dbc1abdb5f8b4f8e31732560beb100a6092d5c18312f8177cfe6a99c40bf8434bfc8c68277fd0ee6bc70388aff815e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b55484312dc00a55cc758bc069dbe470

SHA1
5c384200b65db9961dedfebcee916db4c337855c

SHA256
ae9be13e75a614a77bfa3ee294f6974a627f95c43a94763cdc6492ac83049e7e

SHA512
9096b8a56c7f411aa25bc31083e151fe742bac0f42435bcbf9ba1b248c3a67a790ce6c7a29a8f8b08a478bda2dd768b69dcfbc0c09be32771d8f2bc3cb9b3fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2168c54b4987b5823795af60dcfae7fb

SHA1
d2591e302a43f618cf4b5135df63911b2b283305

SHA256
1f31f3f498bd88d532303ea0ed5b8b063c9f5e67a7406e851af778c6180015d6

SHA512
6b2852b0a1fe566173cc714e62beeeca850c29e7bf86044d957f6ca80c4f0755483ea22d867ee17a1d2c83e8729214dce43677eb01b059f588a6f91d35cf2f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5a78866164c1066c20c140b717408ce0

SHA1
f299f2ed1591550583d42271d4bbee2ed4064169

SHA256
552643254514aa909609d5804577b7fe2c215f3998335aa24f5f57a9a8933a36

SHA512
204a23576b1f362abaa57d23b0121510284cbe5675122a95db28f3144d41227b025cbc84d77120dc7bbccde65714f31f6454fe499e60b983a4077ce82c75b5d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ebf2b0ac19e1e92fbb36cdd08ed95f27

SHA1
f208a65c86342c40829129d6652d7b2e7bbe3df6

SHA256
0b1edf90f903e69af0f214c23ec515e50960987181fa33984596c6e1a0bc1647

SHA512
3e364e8514b792106cb9b49d9f5086bd8a95a03eb7c5c934f0471146e9db323e28e1cdb902288483c4b69f399dd138348b62fefd1d08527c31c47899bf9c3f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a16520a5b637311b94abd8f4db48e2cd

SHA1
5b8c05f2e03079aac0e105f7beedb54ecf01fb79

SHA256
a49d391a83c78a7ad7a71486292b04804d198349152ec0d1d2ad8893d37eeaab

SHA512
51f99f5118c6555e8961d8556774ac79d8045bb8768829f1228dfb382b4d82a13306d75493ba9864ad660943925228214aa89451500b49b4bf603bdf0f1ddd74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fef19bffe1a50c4db64afb09823bba84

SHA1
75eca754e8e9d88f44b2e40d2c3784025cf1c66d

SHA256
57d03225edf69f2f4307558d70ccf777ba172a253e3204288fb8ebe7cfc9dc17

SHA512
c6d7d3107ffbab1b9d8e09d5b850d8c4208f765ddd2c88ba994229263e67d9eeb40501616f494734f34196f5a6a4d75569064caaf096fff32937d6253b21e6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
97bbcf547309d3ed05a96fb7b8c70906

SHA1
eb4dad52914b111b92bea013277b1ac8c59ad058

SHA256
379c9bd4f12418d4b8f00028084043444f8a1b6204420d2a3677a3aa05f3d211

SHA512
d1a4763e053da96b025540fab5e4dec902ed84b8cc26e2c3cc9735ba6850339f8c585af84a478207ea4194949351e626870483bf7b5732eb359075e9d9485b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
672f9a1256045a3f825d04d1a5f3206c

SHA1
868c3e2b0de37b4aa45706fa11f24190f0b25703

SHA256
7e0a863725faa5f5749b1d49c81f40c126b8b9cff324daeab6ba751d0e9b5816

SHA512
77b3adb0476dbd85c2402dd0b06503097747066a359096e9d3ab28264a409d8a75fec7d6a9af5daf0327d5abc80b356634da13ed8bd960edb1c5104796ffc0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
006754868581a6eaed1444f6bf67d331

SHA1
acdd642990be0a02a116477e92ea721eaa2f1929

SHA256
eb4798388979864da0c3905325cf0702c0d56e0269b950e02899570bc55335f6

SHA512
a9e03698c6b8af43a76a4b3ef661cd56ef367649f931d5cd7266a95631c39295bddddf7eef9830840f4ba0a94296d2b2a1df946d96ceaa3e3b05c677db4ab5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f6f70726706ffd025599d734757ac505

SHA1
4e8e4c2a276be0ff27474282470f44ff09e3bf79

SHA256
ff07523da4e268df68dc62826d0c4acf5e5503d91f433c312ee12828cb8e677e

SHA512
c8184413cc65be8627cf97f17dc9e7c99522efc13a7cba17af641e19af9333c687a40292adf17cf0d9362ae201162a651453045aa9a822a33ab74b5f6e898e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8b8991a0ae43c131bdb04eae90883a09

SHA1
64c8168290c9ded9a6343fc851499a52cc93fdc1

SHA256
78dcd4a1948088a10d9ed7dfdb9f0bb242fd73c8caf2d93a038d7543e84e0271

SHA512
6ae8d83237607b5fb1d2369ac5611a77971387532f5d8cbabb97b61c429107d34c9f9cb4f46bfec81df08a83d4056c233da81e512fb431169632e578248d6309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
cda6c278d018e500ece304187d2615cb

SHA1
cabba975a856c657de56dc3de2542068019fed25

SHA256
3e35198ffe6c85f7bcca559447497bdd0679a12d3718157e66151aed067c128f

SHA512
f6ee4f69eb5d4705dd01597514cd51cf0e7e284ff92f4fd836349faf250b8430fdac135c1e0cecd1125f2d2d5addc1809ddae083522f466bc9bc1bcad68c6b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e7c887bb5bbfdb5978b9699cf06ff62a

SHA1
aa7cbfd5b1565cd963e9b924e2115f50a4cca5ae

SHA256
1b9364c859c1ffd3de0213a2afdf8b3f7d7bf6b4562c8cc925549a95967f10bd

SHA512
9407dab0e2972ec5325eec91cef055cf603f128c063c1aa3048292bbebdbf27f2e24333a07366bea23a8aa6d0347f502699181fd2c0c41b80f50b939bbc64bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
10bafe0519c5b6ad7419b4d46374173d

SHA1
84270cb653446a064f6ac0457665520aa3fee33c

SHA256
a824c7e6d88bc0554b3ebb9ed13da130a679a9480f210e9ff844c3c2b71aed20

SHA512
1e5173fc373b6252a9a16308f811e9577c635db5eb0fce386c71a14d1b2a3e93cd9c1ca0461abbc5be0c7f80cdfad0ee4383202d74b4a01bfa9e56e3a9ab3fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2a24214a2e81f25aab16ea1e133935f7

SHA1
6d6603c98b4235346423850597d18846e73c2d04

SHA256
b758f75e8bda6040afe3d7649634dcb583a1d394a8d9633f2ee7348e01007544

SHA512
75fe2a280c2b3dafd38aa73078c9f0f10f0ac620568847be21cc64c4ffe8bdd1242f92a43dae8579b2eee31573be5e986020dd9aa9fdaf851f1ef016d9303695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
999ed90361e21b4d9035694e5069b1c9

SHA1
7df0f2053c5e077a945b98fe5e431879add754b8

SHA256
3cca223843ede002f5e8a81821eacbe44c267a76e829cd091af64eaa50dba59a

SHA512
4386e5813c70d5e4bdd09c5fabff9cf50d7557d740246f51d64ad93d2178860fca410c53f83eea6d105cb289d971ef42871cc241a3f02fe3278df4af5fec6c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c43ac8df9ffb6aa70c9079b9f8fd2e0f

SHA1
b30748a4c692453bbf3b5e79fee896d24f359cf2

SHA256
0ec58e4b7011bcf37f7a2b3e32cb5ab438bc855c3df27580385be3a7a53ca572

SHA512
445fed34c359f3c55c66947b73a6b15cc56cbcf65bf908a914036a5ae7d3d45c16dc47dd14e14a3b9c0c5fbf3caae7fa436ffc4abd216a05ea1d2b81787a07e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c1959d2441d41a60ee1f1286afb1d10

SHA1
b15b0a17e8b03c8176861b28e1bf960ab10ad8e1

SHA256
b7c2c5193e398e13f615d60860c8037558784778e713a9563640c96ef40b7dce

SHA512
0f0625630c468da1fb9cbb9e5fd4311a7fccdfb64204832e4abc490b3b828010c859b81686d777c1ba7f14c5e08b91f9671f62e9d3630d0e2cf7334223531fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ead48b6e9a07f2aae83bbab90f80e399

SHA1
1e9cc762f3bab9dd1f7a4c5400742dc1192b381d

SHA256
5f88f6076d4ef81dc574aa2a5671a4e10cf19b3c3383e3d5d61d0c2cbb179c36

SHA512
a29d170aebd53d802c0a702d7fc436545c260836d6e9af79c9cd06aaef15b76af44d1ce95cb10e18de2c2b37f44d326cb943b02d525bb1313e3d3308a3d0faf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2e3fd4ad1f9d47ebda0945b3872ef559

SHA1
d26571c53ae8fc5c6b23c95e5b6950e456049ddc

SHA256
690811d93f641fa06de51b328e0648abb78e61309c851278cefe521f5d185b9a

SHA512
bb58ed26276dae48703959670c0d5442e727798158833eb42f5c511c51f3648eb1437621fc35918016eed5fd8129ce76f12a4dc9e29d9d6584387e8d79778ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e2d91fa42fb3b71d363a08ef51afae40

SHA1
9926ef6ba85332e54989d53ba047a2aaf0ec84f8

SHA256
79db090816976d40cf457e973586704869481353c2bfef24c2d3e6ec31d5d825

SHA512
35a73dd7a2207dd41b13a729ac78c33b0ec9cf2e0276538f165b4782206ac468900461eb65d0edc9e902974636c42c03dda7b92b8cad0a3cf810d493fcd77f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ab155d1defaf6b9851c3b34a08cf6db7

SHA1
055abb2e55ca5b0ffbb0e99f80c5d9f4c727a3bb

SHA256
3f3cf96e475fc801fd73e444636109da509852df02f223519eb1b2cc96f8b5a0

SHA512
c6567803330f1c84b2d8fdf9d322b4773c8fd9a8ecad0aa0bb48e9db09dfd232169eac687c7b5764539047871835494f0e3e78f616f7f8545846aec795a89150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0209dbfa813edb411781e15b1e74466a

SHA1
6f2c0e11b8fa583e1696b30a093bacc147c0410d

SHA256
a634c5b6e9186e7b5d974baf5fc00310a825fea3cbfe7864ada8b265474851ea

SHA512
cf9a006a754a2c2a147002a292893f6ab54d2ffe8b6af7d85c8240b638ae1895ce467820080ada9e85c147aa0775652debd71e0467fcbb427fe311bc38cb2cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e5ff4f050a4f625aeb07e2a5ed83a933

SHA1
608f40f8e9ea851f78dc91796a48dd02fbd7703f

SHA256
3b0a51c2f4775b7cd787c33b11d1203a87e01e85f0bb0d32daca5c00d7e7df0c

SHA512
7f1b7d962acd3a335f431834dad719d00ce5277005778c29bc9b776ca69aa55b0e56ce447609c0862f739314203afb74271e8d4d2ddea4e884ba6ae94ebd6009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0d252380192674a52b7fe3054f711f64

SHA1
f4ccf57f61b76ad28fcc6b9b1fa12be9f1f94cc7

SHA256
dd9f64e3dad33f76cd2d794dcb913400208797bd4082daca19f43406e63449f9

SHA512
4ab7817c63bf61a6cb8badf758b9ea8fa87da272a1cae29d3c63fc8737e5c3f03dbc391219766418117b6614f3da871fc7a397e869adad0aa3ded98d5d7f7f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8fe83a8d2265ad39625461f823d337f6

SHA1
c80abab59aeade5a5d4085d9a4508175dd22c12a

SHA256
1a8fffa224e3c52b31f2630f98c593ca369c362e58fd34c8d7c3ba23f947f9e5

SHA512
e2e807a21279aea37dfbead0f0b66bbe7da26af207531249b42d2a4867a7cdc485e3a8214b4629ba314f0744b1c1d8ba247ce3bd3534abe9c9a7b4266518ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5a325aa983f452442046f627f6f7b8d7

SHA1
03d84d6a34106feb20d4321b3dfb2c3aeb63fed7

SHA256
51c67d6374802695a4df16ac515d91aff96f784c6b3ef317533f123b1d0226ea

SHA512
d3e8612937fde01a0a23d30db8b93ab4dddc6a1139262f5fd3166ca1a55f9ec57cc512a18c4258bcd85654a4530d7c43f2e58c4b088423ed3d73d5a44c089fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fff56076ac7e153199c374f18b856582

SHA1
16e0a8702c9d72bef3ccd91cb51f7ea57396d48f

SHA256
31d4452bab6aee1284af5054d47b9fa24bc13549768ba33dbaa5baa0d8d4571b

SHA512
966c33dc2db55b8987c0f343bd97a6e58882f783c26fe242157fcc032cf2452b6e11185a32b0fad1541c60699219740cde955482cac9f318e99ddb0321a464dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
548c7c4db7bc8220ce65506f01f13680

SHA1
b943a38364216a692341941be49d23db8518bafb

SHA256
0f96592bd6c6803ab64656a6506bdb693e9be92048b05315867e8ad83bf0b987

SHA512
21684fe91a741d58aec09db46eb1ba9aeda8978912edcf8f2cb186044b12cbf8ab6130b61a1de77a8d430e4e710e2420426aff9a28b1aaa9a22b832c319240d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d5bd995eadefc297b875ab4345510925

SHA1
51a11c50718f9d48a0cab0266984322de8116569

SHA256
400ea9f50c88cc311fd5436ddffdb70dd58196f8085f508e36c6e557e02ce8ad

SHA512
dcb449f9b5b0e1c5f17ad7a630bc045f9d5d8f499b6b367d3b60e77cf18d6f3fbeace0487b564c9ce22e8dcfc2cc0141e200d8f15214a92a25b2b56f37629874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
67bc596c8b106d48e07b7fad775fffae

SHA1
a3a3fb7f00090a43954b1417586983b375155f58

SHA256
79b2e013bfa72a814de7a708a647852878486629a90e788b3d91b7dddadc772b

SHA512
08c5122d1424ae7640478608ff5b449a8809fc6e13b2f6191eb2e408f8ecb0379a2b4bd781291f61aa047e6f190e34b19acaf20f52ff84ae34537f7049ede608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b6ef8e2233a6b2247949bc7e5d3ef327

SHA1
bba7d86aaeba70c64730873db84caa6b161657df

SHA256
8950aae3d5f9fa104f29b17451fede5d3f83541cb6e7864cc3f10dc8044f0a38

SHA512
4e026dae1b0f6e47b4cff5fd2ef6fe1e097779216dbc8c5d70c919db959487d5d2020aa55d8ca6a4e2c20375c81c763c96b3a8125bbe07c98be0a8231bb824d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2b39125d82a39c7a6aa5f5d474fb0fc6

SHA1
4a7cd98e97ed834854cb1b8224c3eb966ace9b21

SHA256
47b0e2856e9ce697cd7a29e75279d3c6b1c742668cb29811257c40cba777752c

SHA512
af38aacaac5b8a3c020a0e93b8bea62dd38f5266783ccabca67b6ea64c80018c01c97201dffa429920c91d314cb44a49f7b8e876ca7d56545147db11640c6e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e7803ad06c719ae773dc4db35da2ff30

SHA1
c36d8491a0940971a6891251ddf27afedde84283

SHA256
0bb8b830008666270c55c9575dceaaff425b1baa8d2d8f919dcf8ccac9123474

SHA512
a37b363de11b1d6302cd2a0590f6f1a5031e0988c0a2737dc2e63b36f8e35c5fb4dc41082931a227f4d4386deab86dfca6692228219a7bcdfaf5efcb7ef5bb63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
224127858883b5e799e62b4ac4f7c9e6

SHA1
9eab4d3e360c9e46215aafe4516688f01210e7cb

SHA256
054fb7c90b5885d7ecb76b91c9a2d0973caebed83ff6ff50cb2e303374ba062e

SHA512
2b26f8368d1fdcf957318ab8b1e1b4edfaab4576c90a6c8fcf7362e0b30f9d2fe22c0576149ef130d82730615cba0cff742f4b061d959e9f1f129ea9a4500f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ddfa02c017a3664b820da23e3664a67d

SHA1
525866a522eb3bf7d6299bce3dcfe9b7ec9796bb

SHA256
7193ed1a20585f8ef3848c75612be7dad923233362a1c6df0404248624bee68d

SHA512
e2919cb045a9f638bf208a38937374d7b6bcd99e3a08dc42131ea691bb50bfbb96216cea30564c5be9ba4bb385e84d242a14c330daae7e4e1230fd572909e44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ec5e249ab210893895f736b7edef5398

SHA1
fcc29649f0ee578a4d6957a5c69ed7ceb588c18d

SHA256
a4539119a05f4f20d2ae38b83f9cbb2e51cf69e7658f898f90b9b1467a0e3754

SHA512
f870058ba9290b2a4797e63331125c0f14860384344fa0d67af61d99957926d0152566b72e7011e23dc3f5c6b57178fe875ee123e1246e96e5431ce32393d9ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c48a69f3a495b1af9ed61e32766bce6e

SHA1
52e1c7b29023a6ce42f27a9c71846971b1c904d8

SHA256
0b7ed972cac83d951adc78b47e65e16de460f0d14b5d7141767296adc0cd2513

SHA512
3ec6057e0891244f098a3f82d87a1abd1c854ea43e9bce3d8cbbd821780028b6b3d5aef7e24d3b4eacb1833dfd0cc581fbd40751b497225effe69a0febbeaa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
be2b786330da609e9399a057835085d4

SHA1
777890a4209b18f49c7124e3b7507c8dd7210a2b

SHA256
03a9bbef1a9f6fcfbab308d35c477200d3da7c58d5f2f3086cffc69d3784cb57

SHA512
dca8e599dc55fc52bd0db41b408d33505e26ad1258c25b89b5b36f3e39405c1999a55ef9bb0298956a14a5d60b8feef1b9705185aa08447953276ad4e67872ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8e20e9c4ca1569af4294d39102b46f7e

SHA1
4e92a05a70dad89917e94bc952a9bda38f2e012a

SHA256
e4523ca7fabf0720249d9511e2eed2ffc94ccee51feb3276170972843cc0bf85

SHA512
d9d33a159707bd2db5e9ca6fe497bf8d6f6b1bf146e5e14d135c61e0ffa3fff6d57432b6c849653d4f10b8923019ce5dd1750ce38e919c0d9622d1ccbe352f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
25b9b8c45894fde38736d891ce5c3061

SHA1
1908f3bbd596f7c9a192d6b4eccd443bfd444da4

SHA256
93b1b5bd826a652ab72d7df746231058ba920fea6a88be99910cd21016c3fc57

SHA512
0a633247c5f884a5266f42addbc5907a41cf7d330fcf971b2d7efe6a787080f748476a7f25045a4f5b1eeb241d31237209895770c9f8b56852937b9b2f7248ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6f7a03d35b4980845fe7c1fb10da2bd3

SHA1
f148dc4dbacb46756e908c255c17d9fdc0d2228e

SHA256
32a628347a509818f20ab895fe00855101b2c51c53e97b65792f0c185ea7ebb1

SHA512
e592f4aa41b633557930702b61c3f87d6ae7e11c0a0c3a1d4d8baeaceccdb4063bada7da32fd339d9f65f9919f8e7c7f3e40e5163fb426684fb4d413c9693dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9d51efb06dff53058973a3bb46fb431e

SHA1
da7f935101513f4c366392c2b42782da764614c7

SHA256
d1127257aede342fd6af2069ec7d197ffef45398eba942f3325036ff2fb52c30

SHA512
aa714091b5fd811d15e3e2ae69990c4e434c3609cb051df761038d83d044dd9a78f470dffc7e00c38f28329fe6e318779c33496cff6d41665f523bb920690298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e17f9123d2cea963d87b204b75ff7697

SHA1
856bc2796d22faf4f720aefd83e49186efc34ddb

SHA256
b1a4cde8f3bb5d054ce96424cefa26abdfdde6036b261dd275153b6a74ac62e4

SHA512
238611fcd2b8f1e327ea66cb524cd3b1ac69755aff858db231d8e1a45c628ab53150ef2d55cf90e334a6b33b5d8473582c814b00238a2ff24e6ba2a025908d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4e0b7abb85151e574041a90aa6e968ec

SHA1
6ad4a690939db601c37ff8c274f406ba5d1b63ef

SHA256
470a5fe4ee7d60c149cfc8d4befcc810c81015451dbaf833150604ffbccdcb4b

SHA512
9d2f872eaa7b13f192892d6ad048f6c43ffded3f7f73320562b4162a9916ed6d9ea8e84fc8a3beaec3f1cce7f1c3b5a3ecd15348b908f79791d2f44b8b01fef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ae32e9b5d920b84a680eb5fa1e06e108

SHA1
39b927baed058ddde0e380a0ad727ca98ae837bb

SHA256
dc245fda624034e5913a8e3f1c43c674b27bc5f61ae2caaa9ef6465eb5160a83

SHA512
5e9b4ab5ca2d449d9c3801a9b235bad8c27fdb8dd846c94385f91ede7b9eecaab44da36b15fa3e5b258e5b54a56200271c10705ae3990e662b4ea86f00073e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b459b51190d2fdcf30296049e4447465

SHA1
404059c47a57dccf18138f2236b96e086b00b87a

SHA256
f500f6278ae6a63fb8207eef7eecd5f1499e51ef17de99b1aa8818cbe98ae434

SHA512
5fecaa9bfa118e2a78268afecd2ce4ec98ee2f218915369462a1bc0492fade2ca6366ac1b9540e266881a151aedf773175cf43610dd45544673e94507dc658ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6854af889a8b2823de5f2abb3db3acd0

SHA1
274ce199f426f63af84f075b7c371d6584279d6b

SHA256
9e91152591e99309e0f7a78320fcb0a5f36d4ff57a1dca68f88c555fa4c5e410

SHA512
b3e4cdf3c09587d7aed5ecc8eb06d1be158094cca82b60dfc7b8e65712306c7df102c79baff346d723dab8102246600d50a610f5cd708979fec7362249aea79b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4e6976155921a67091c6be3a0f8c0335

SHA1
709faf045d7eba1c6a6f748a0b56444305a8d58b

SHA256
6b620859629105bf672c5a846d58ab6c7bc862d54fb9614c4509343d52b6f2f4

SHA512
b58e5dae600ec78c7857b244dc0bae28da76970898e45b67d2e896a07df1f5561c43d2742d91d1a2884e3b428bf26f42786f4499079e0f56d27d029b2086efb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
96d9e28b1b093951741dfc6cf905eb2c

SHA1
256c36cdeb97376bc657ca2985cd42412f6f4106

SHA256
cd5349763cf9c5352366519aa8c66e0333bd9fa2fd608732ed9cf0b8f44ab643

SHA512
acf48db1fbfd708e8e96deee23b1dceb8c40ea8b04fe76437f5ff3b7859f1202c516881096ce94e28a7e29fd8dca874641b4e7d4e9ee9faf1276059f4c939d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
82359de3d132a3fe16ab6afa02c68137

SHA1
30774830f454b9d9b11fed49b028a040a428cc9a

SHA256
6e26e6a36a0ca4c164400091c5343aeea1f93036b8ed1e3990df0a757056cbd1

SHA512
bf40c797d28135de7ab219f07133e587456d914cd55297b6c12f4aa389de87b6e9bdf3b319a471cc6d05119cfd8a77ae5f4a8a172ac8b177188a8dabf0444ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
94f66f3b375a29b3aa994cdd2fe28d75

SHA1
134d0200a2cc2c9e47b331b09614203cc259e177

SHA256
a625646c5132b802c4eb2b469d35743fb7dead4246bb4a7c934a054985789074

SHA512
793331176113f3c6abc714d43052254f2a03a1e94863b5997dbc1fc6d428eb8496646e12a70a6eb771d15e314ee138d888027db1dbc90a981f611cd71fa99b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6d8f351318c1ec04d31fb1e800903d6a

SHA1
2a17097176cdcc0b9aaf391a27cf7bd30448cd68

SHA256
1b2d2352c3afc140cea8d761d25e45447156c02b4e2c5982c8e39cb5b64e1e2a

SHA512
e7200ee5ec3ad5504b08a4f788de1d2acf514b9a9e785ead03b651b8c225bfb57b9ffb9f40d38ea56f089e57fdcd818be2e76e36fe7b6b45308211c709fff197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ab33b3927e382e4bd7cc9f8989a0ccc8

SHA1
e88ad26c4179546757c3d815fdbbfef7aa1fd1e5

SHA256
155aad4314d9b07ce5f9025a1ec56bdde0883521baf7e1784875edb17bde8c7b

SHA512
59b78170ad8666095245330331e99211b263007000aee8825b86c8a46b4ebdf7a47a4d220710d0343026852b51c5da1914f69c8d4fab72840be7d78565d1d20e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9ccc018a384da448e5b3fed51d32ba37

SHA1
c494a5af0b6d987cb487dfcf8e5ceedae54c4be1

SHA256
4fc35b51cbab62c529647ddce1656ea7bf37b806e6530eec1b47559bd1044f32

SHA512
3db00ccbd9b55bd94a2809f7884f5fda62dfafa386ca353f6fea5d5fcb14367d439b3fe328a9f24d6d40e8b53174bfb3f09e417788ac725a17ac7786da088a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d4b922c8931967f930e301976eaae74d

SHA1
245916dd26dac0f92700348200c0956e2d7878e9

SHA256
c3e6560fd4a698045a2676ce97568dd6722de5d15f36a23feb646c817bf1d569

SHA512
5f7386899c8b7ac6ee5bad6a52d52b535716e5bd8f243bab3ab3ffe1eaf90424e400025f2155ffbe3a13fcb26c047570bd266c2e970721ad0b330b87b6f0efde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c7b48f2d8e2100d0213a8872ac536258

SHA1
d04de6b877f4b10a2f6461540cc7081b3419b37e

SHA256
cb248d434ceab30fa1413b59e0c4c403dea0e7c904353d483bcb127c2e4f6303

SHA512
d762706fa50130738484f4d87599c0622e3a5b228faca63a7f4646b685653bf1cca2b68ec7cb89891445ba3d87c8a7fd59f0602bc48b7d860082c4278585d06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b1ab32071c606e3374dba762fd7a2427

SHA1
58e206a8e3df7745e662fc0afcc2ca0178774d5f

SHA256
b635bd677d1bbdd0021a2dbdf3e9c3e1c3c33d43169d1e48813dbeb2f19a9b3d

SHA512
9c013b258322f6528167cfa005efcc9b8b647d2f80dbd0072e50f4330635f3b0a18539c462427a4705f39ebc1a61a333dacf9817705713fd90e9867ec51907ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9fbe9427da5346fab8103383195e3918

SHA1
d22cd9f41268f0b0eaf1a2dac9c8f756d817ea9b

SHA256
01379f4c30e69480a7e63c0969600a0bc730ef0ecfbdb27a7064dc540f2e1699

SHA512
4eaaa76b44fc38c9ccf26d2e079649f8ee73d0a06ddabcce0fe3f0373d47f78f2765151cfb5f9d256fbf39d4c88cf73e3821783085c6efaeb21b0cb686be2c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
86c2767fcbfe67dde134f00b1691b65f

SHA1
a85bb5a1bd74e36fa6a4944d917708c943989f27

SHA256
f63b9c0dd5e7879cca4a012a9dc8798107c30380545a16fe3f2f1673d0627d64

SHA512
2b53dcd446013ada5f9487fb5a86b6c91e161b10f3856662257fea0ca7c585a9f9108820608de87561b1b085fd9d28c40750fd1fae8d54d1465fa1ad487ef4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
af5a2e6e47a6f7419e5779467888087b

SHA1
e81c48f680fb6157e1020e805c5656844a251e53

SHA256
1078e4069b2fd062715c2e8ebf5a3b3143f5a4fdd0319f96d3f0e779c5f10de1

SHA512
eef3abf46c10dd2ef254136e4dfb7eb058bf72d21ffe618e1af87b7e7efac328bb6b3b7a25755cb3853a514d2ae6916c1b8ccf7b63101db1c0d3f7f4d2f6e9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
734afa7d583fd51285715b45a3557f10

SHA1
324623aa0cf131186b9b2a265db36e71dbe385ea

SHA256
33422a605c1e511ae6d3b4151b6c7b4528f86a8754d5fe4e4ecb7d17b152f190

SHA512
bb8ad343f678ca729f5edbc57e893e9fdaeb25b9736d7f22a13ed5cc1836ab0abf4ce74034007638b434ffd0746d26e0c1fcdabc2a8e9d1fb13e0b96d3e21cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
52f5dcdfc5d59d0f21f0a9e2a8a0a4e3

SHA1
79be2d08d31e1d471c2f8f3c25dae99d5e59239f

SHA256
a834ca731e8350c8607878c70d83a44033a0dc0290f1943b9ce822771069e351

SHA512
f05e8791ec26ff1066b9f7c766801e56db0b7e3c86f2313a0067c4194f904ca26b4c7e95571d16a6e2f278e93121af5439f694187271838a0975b2da3b2b5909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
aafd7a82b4087cc27fd52b6efe2c49a9

SHA1
0e977c57030ceded7b85038f1825720f2f1baf61

SHA256
348fc05dbfab95d190b4053fc954fd382948b0ad9f587cf701d6ce38e2083fd5

SHA512
2167993cb97ba5a682d240fdd03d073afb94a9c74750e2feca2b9a55584621dea56211fa75d9826eed63966eefde2a6dd178682d9c1e90c9460ac212a6fb86a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9fc32ad8e45570dd1f9fca23d121a350

SHA1
8b16609471974a36319edbfdb3eb026154f032fd

SHA256
b5067d161bb7b6527e77abb12ed46ce23eb1d79477638ea4a1b02b0d60c6b7e7

SHA512
464f8ac35b650248f5d38f231223c3474c282c9f1d942376536ea32ba4070e4c1299e4150030d235bf4689353f815fa7f60c59f9136f17562a31bcb59449e0c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9c215efa8155e26efda2c8979e050056

SHA1
5492af2c16488cdeededbd275759945400650c37

SHA256
962acf041b9c5dd1ec2fc130d5b7054f30e00fcfe6f00cda17c13113f6636270

SHA512
9c24357d326bc80a57884bc811eb0f683633edca708e61ed131d3f77b683d7240ddce9f275bb3285e418cc1077213ba2f3474e54f493bd8512f528f1f7e686a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
be8f75cfc31a21e3ecfb5df70abfe3f3

SHA1
d3bcb113eb7145dc6bbcd1b9a87b83721de0f4be

SHA256
718be98e48937d4bbafccc176b69442a69a98aca925a2e98c05bba0d4bd21ae9

SHA512
eff31e234841a9ea20ca6e2d72f70491aa2b6ef78c43eecd5e815826f62dd5eb23ed99584f08aac6c64080681d9a13cd926373c004e9fb21602fbdb79ac47151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2e4b93f55b37af94784d973f071141f2

SHA1
d1853360980b27fa23af9f0fbd6e708fc26202c1

SHA256
54de6a34d835ead9906a4ca49fc281fc6af3a2a1da73b5078056566c03e6594d

SHA512
2e6cc675925fd9487665aee8d89cd439838a07f1e324b099ad4afc46584d75e51ed588d9af696c24871724f0e108f42e9b0b900fa7df4db46f26cb85200d26b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
112331ab75199684d3617ab356900b3b

SHA1
6635ca5582b06f920edf6cf64895fb392d548abe

SHA256
c6790b5e6859f5ce1f22506368a466ec8d998a8c3b00e92664f6e6e2544f1eee

SHA512
d3ad5144cacdb5d68ebc7a83ccfc2da2c7291e18810c61b39b183806a9da14bfbcb2eff1d9a4b3ea294a278dab64b8c056a59834bc92390c5e993e7505a469b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
62a2610320efdfb88d5c41ee22d4f07c

SHA1
9b1fa0ac4c87c0edcb8be1d8211ae2795edb2da3

SHA256
c95a981bf9acf39bdaacb65e5be0b9a3c8d63fc02fa90adc3b4c9dceb22835f6

SHA512
c6bdcbcfa0c2a6a6cbb39ec2e0319a28f6e09278e5e044b0e99af2d85dd6de796a2b1430dd92ccb2df28f3bae744356731684d1d630a05ea462b2a39a6670bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
42ce87b365e364c4a7117b14ec334548

SHA1
af7004db708793933395d86ce1c7655fa4646ed5

SHA256
100cb31d673e2fe806203613f1f7a8fc397582728e6d75d068d3521bad07f6e0

SHA512
38cb461b8542733dee1ccda5f6054ec44fb4ffdbf1503a0df2ec572b9be32f395993c5f98c329f31ae0b6c6897d628a3d281fdc45ca2d60132ce737862f99df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5a98c0f089812a3897ab0415789cd4fc

SHA1
599e0486f0c324d8e5271b305ee7d34d673f805a

SHA256
a06f07883d1b92b0ee6e629a881672b1be080e05e33c9787fe19d0ca4b4d8448

SHA512
a92b4b176e7383c6be3dfaa3409a8a11bd352bff6dd0544850ac5cb8c250ca847b100911291c23a6646b1ec4082b6ac0848e67db9e8cc2f1290e48fb7337547b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0da47a8307e30d84bface1e4dd8e2fe4

SHA1
262dee1c1beafab846b191ba31a3b629f32b3b9a

SHA256
42e12b5fe314a90a6944989874a01f41ddb633aad26f89b71d645174d3d386dc

SHA512
28c3f1324846ee33f9f519e839711b73e54ec2df8ad3d3614b8b1c3f7cb31a2ee46109f00135544d8c656d0d8abedcb8a3ea4f0fdaefb68df2dba34258857faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6fecc201831c618d2649f83ed8834814

SHA1
cc79a437a9fc7335b3c7a122b6e881d0fff865d5

SHA256
751272e1193083ede55edd8cde59f74fd5f03a5b92db7b928c6cf9fc8c4e9d41

SHA512
0aa6eedbe51e1e0a4c42f48b0723554bbc89756ac7b8c496d88ad6feae29093da62ac5d8667aa903a97877ce45c714e31dc8aa67fca646449b12914c1a588f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b5e2cdc82e8b2eb0b019915d6e238bd6

SHA1
8e62891cae319415197fb9e9fabe635e9217a1a4

SHA256
3062216b281536534ea0b2335e554d84dbca89971597984ffea3c4bbdac5c3a5

SHA512
70041ebe8a5be9d90c22d877b82338788f89230cd78cd8b60e96507bf0c2d3921d2d7dac065325c77334cb82810b1d9cffc2d8b37ea51bd3f9e27a01815f00c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d72eefe1a58d7c98fc608f04d7b14959

SHA1
2e2d937ad1137ae0894da36a31f17e5e7e0a2342

SHA256
bea091f994b640108979ae22e725d68b986af75622b75a9df8816067c5ec6230

SHA512
2f766496c9b944e34e562c727cf8e817d2ddc060edab7fd4b17307b66fe65c90ea7b80d3795c974ced172b887af554d94be34e115c94956bf64c0e1d04fc005a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9b62347657b71779274fbad7ec63320a

SHA1
b5fc2015ad2b215cf5180d21a0be656b47843c7b

SHA256
d3021649136b43bc2407092eb64beccd7cbd35a056fb3e606960b2464a5a7e7d

SHA512
f5f6eaeeda62614d1eeb599d75f7ecf76423f138caf3405e8b1582dc1d82787c3f7589c45f752498452fd975496402813c82969b76801d9cf8bdb2132979ee42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ce8b8f371babf57e5b2693a64ba9ace0

SHA1
d4d249acb46315b119f97a6c72e5fd2cea0d6881

SHA256
f9e5e7b058822b2f42b3ab63898667148ad7c566c0542d97d3ea9a7f57cfd955

SHA512
e0f4a8c55852bbcb17670ef4343dcd5abb25234dbfc763c80dec140b6710f6909b5706856913b96a9b9a70cf95196c229e31e8dac5e305b0b8fb7d6710303709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ae0bafde55bc0e7b4a7f9dcf37753617

SHA1
8cb1e1c03a341691a427c46166bf9f9253bf2c39

SHA256
a5e8f49a77b6ff9b7a30a43c8a5df5fec2a3cea58a57b607271e38ebe5113229

SHA512
f4eb726dd03e75a556bc177e9f7b41ffdceb7627a3bdf1f427641cdc07791e4d5a6f13b8a7e9b84d4244e453363d0380ff2fc9848ae1cb17951b0e3fd3bd1d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe63e8b0.TMP

Filesize
1KB

MD5
0ec235c20219046074546c8b3c341d18

SHA1
704b8168e7845abd3a2ac57ee58d15c331cd819a

SHA256
d9b42adbba078f3dc396c9a44733f03f6122af553127135b6e99617e8282a91b

SHA512
9c4ba9a608566892d9ddd78c2c1b6c6b1388a83ccd38e31d0168c74dd4982beece00acd9bd0b8122a1af924fab238bab9aa5da286e603ee0550fe2e62370d7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f0d2909f7caa5b365a6f211f9fa785ce

SHA1
bf4e0dde25362050158130ea1e9986ff705d1a50

SHA256
c8fa961da8f351b01ddfdc069519b66ad83512dd254eb700cbc241592e369543

SHA512
7b0096bb20e28aab060bc03d7654bcd725c3309172d98dac654bde19736d5dde1f993f874048b246795637f7571de92feaa2f83978d7ef62463801147c110b94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a77af3495feb57e36c124fa818eaaf45

SHA1
9bc948ea25ff8c2bc18dba9b3d20a15bd64e71f5

SHA256
dcd53c93efce908a6e4e9d9d52911a94104ea47bdc0b437be4dfe529e83a2c16

SHA512
ffa73e19f464cb1780c94967a972f10b582f27404a62206431fa80ac71d294e0afe94d44a00382ce5709445842b4258e37a1b106f24015b85e55772218d5e612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b7172598d8c9f2943ed3686348e83ed

SHA1
8046520a4188c1bb40c6702355d68c1a51c35ef7

SHA256
774f7c87bc37ef20df1b8ff66f4ac35465a14b0f31a4592fc39687f9e887b85e

SHA512
9c1f80ef572b61db9d5845191f73f93436b260b2d755603898dfc4b9ff139a400d1b9c1c9bac9147c71b0b6c56aeca07a3ecff0e72f99d83ec48ce4c4ac491a4

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4f09eefc418c08f275c2fa3f4b8d4dcf

Filesize
5.9MB

MD5
4f09eefc418c08f275c2fa3f4b8d4dcf

SHA1
1eabecb044e73dcfbf5326ab4fae00afdd22312e

SHA256
e9d623c447b1a1f3a279efbc835ce8e8ac396d85e3700b20c5c5ba6a0cdfab06

SHA512
d5515e3621ed19861eac2683b1409c0e34174920551058562dfa1fc009ec9973567a4109afe75577b960d42f1e876ea9cdcd09354c0d9ec48789767d534c6671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.5MB

MD5
6399cb94a0d00b72ffb53432cb26c891

SHA1
d18c3616da0c6807771c0d7e501e811a9f2e7ded

SHA256
fec985e0648a7d41c434c8fed666139090f7bb5df85939da743a1f8859765811

SHA512
5f06f6e235c1e1c68255cf34fa22713ddd8a8667d9584ba316358c785801a0d9ca68a93ff2c2b20d55bca5c0502a2edaa2a06a8f45fec2292b880725f8ee5097

Download Submit
memory/3228-2410-0x0000000000010000-0x0000000000045000-memory.dmp

Filesize
212KB

Download
memory/3228-2411-0x0000000073420000-0x0000000073630000-memory.dmp

Filesize
2.1MB

Download
memory/3228-2469-0x0000000073420000-0x0000000073630000-memory.dmp

Filesize
2.1MB

Download
memory/3228-2549-0x0000000000010000-0x0000000000045000-memory.dmp

Filesize
212KB

Download
memory/4996-2594-0x00007FFB122B0000-0x00007FFB122C0000-memory.dmp

Filesize
64KB

Download
memory/4996-2602-0x00007FFB123E0000-0x00007FFB12406000-memory.dmp

Filesize
152KB

Download
memory/4996-2557-0x00007FFB14CF0000-0x00007FFB14D20000-memory.dmp

Filesize
192KB

Download
memory/4996-2561-0x00007FFB14D80000-0x00007FFB14D85000-memory.dmp

Filesize
20KB

Download
memory/4996-2560-0x00007FFB14CF0000-0x00007FFB14D20000-memory.dmp

Filesize
192KB

Download
memory/4996-2559-0x00007FFB14CF0000-0x00007FFB14D20000-memory.dmp

Filesize
192KB

Download
memory/4996-2558-0x00007FFB14CF0000-0x00007FFB14D20000-memory.dmp

Filesize
192KB

Download
memory/4996-2555-0x00007FFB14CA0000-0x00007FFB14CB0000-memory.dmp

Filesize
64KB

Download
memory/4996-2554-0x00007FFB14CA0000-0x00007FFB14CB0000-memory.dmp

Filesize
64KB

Download
memory/4996-2553-0x00007FFB14B90000-0x00007FFB14BA0000-memory.dmp

Filesize
64KB

Download
memory/4996-2552-0x00007FFB14B90000-0x00007FFB14BA0000-memory.dmp

Filesize
64KB

Download
memory/4996-2562-0x00007FFB13530000-0x00007FFB13540000-memory.dmp

Filesize
64KB

Download
memory/4996-2568-0x00007FFB135E0000-0x00007FFB135F0000-memory.dmp

Filesize
64KB

Download
memory/4996-2570-0x00007FFB135E0000-0x00007FFB135F0000-memory.dmp

Filesize
64KB

Download
memory/4996-2569-0x00007FFB135E0000-0x00007FFB135F0000-memory.dmp

Filesize
64KB

Download
memory/4996-2567-0x00007FFB135E0000-0x00007FFB135F0000-memory.dmp

Filesize
64KB

Download
memory/4996-2566-0x00007FFB135E0000-0x00007FFB135F0000-memory.dmp

Filesize
64KB

Download
memory/4996-2565-0x00007FFB135C0000-0x00007FFB135D0000-memory.dmp

Filesize
64KB

Download
memory/4996-2595-0x00007FFB122B0000-0x00007FFB122C0000-memory.dmp

Filesize
64KB

Download
memory/4996-2596-0x00007FFB123B0000-0x00007FFB123C0000-memory.dmp

Filesize
64KB

Download
memory/4996-2597-0x00007FFB123B0000-0x00007FFB123C0000-memory.dmp

Filesize
64KB

Download
memory/4996-2598-0x00007FFB123E0000-0x00007FFB12406000-memory.dmp

Filesize
152KB

Download
memory/4996-2599-0x00007FFB123E0000-0x00007FFB12406000-memory.dmp

Filesize
152KB

Download
memory/4996-2600-0x00007FFB123E0000-0x00007FFB12406000-memory.dmp

Filesize
152KB

Download
memory/4996-2601-0x00007FFB123E0000-0x00007FFB12406000-memory.dmp

Filesize
152KB

Download
memory/4996-2556-0x00007FFB14CF0000-0x00007FFB14D20000-memory.dmp

Filesize
192KB

Download
memory/4996-2564-0x00007FFB135C0000-0x00007FFB135D0000-memory.dmp

Filesize
64KB

Download
memory/4996-2590-0x00007FFB139C0000-0x00007FFB139CB000-memory.dmp

Filesize
44KB

Download
memory/4996-2587-0x00007FFB139A0000-0x00007FFB139B0000-memory.dmp

Filesize
64KB

Download
memory/4996-2588-0x00007FFB139A0000-0x00007FFB139B0000-memory.dmp

Filesize
64KB

Download
memory/4996-2589-0x00007FFB139C0000-0x00007FFB139CB000-memory.dmp

Filesize
44KB

Download
memory/4996-2591-0x00007FFB139C0000-0x00007FFB139CB000-memory.dmp

Filesize
44KB

Download
memory/4996-2592-0x00007FFB139C0000-0x00007FFB139CB000-memory.dmp

Filesize
44KB

Download
memory/4996-2593-0x00007FFB139C0000-0x00007FFB139CB000-memory.dmp

Filesize
44KB

Download
memory/4996-2584-0x00007FFB133F0000-0x00007FFB133FE000-memory.dmp

Filesize
56KB

Download
memory/4996-2586-0x00007FFB133F0000-0x00007FFB133FE000-memory.dmp

Filesize
56KB

Download
memory/4996-2580-0x00007FFB13340000-0x00007FFB13350000-memory.dmp

Filesize
64KB

Download
memory/4996-2581-0x00007FFB13340000-0x00007FFB13350000-memory.dmp

Filesize
64KB

Download
memory/4996-2582-0x00007FFB133F0000-0x00007FFB133FE000-memory.dmp

Filesize
56KB

Download
memory/4996-2583-0x00007FFB133F0000-0x00007FFB133FE000-memory.dmp

Filesize
56KB

Download
memory/4996-2585-0x00007FFB133F0000-0x00007FFB133FE000-memory.dmp

Filesize
56KB

Download
memory/4996-2572-0x00007FFB12880000-0x00007FFB12890000-memory.dmp

Filesize
64KB

Download
memory/4996-2573-0x00007FFB12990000-0x00007FFB129A0000-memory.dmp

Filesize
64KB

Download
memory/4996-2574-0x00007FFB12990000-0x00007FFB129A0000-memory.dmp

Filesize
64KB

Download
memory/4996-2579-0x00007FFB12B00000-0x00007FFB12B30000-memory.dmp

Filesize
192KB

Download
memory/4996-2575-0x00007FFB12B00000-0x00007FFB12B30000-memory.dmp

Filesize
192KB

Download
memory/4996-2576-0x00007FFB12B00000-0x00007FFB12B30000-memory.dmp

Filesize
192KB

Download
memory/4996-2577-0x00007FFB12B00000-0x00007FFB12B30000-memory.dmp

Filesize
192KB

Download
memory/4996-2578-0x00007FFB12B00000-0x00007FFB12B30000-memory.dmp

Filesize
192KB

Download
memory/4996-2571-0x00007FFB12880000-0x00007FFB12890000-memory.dmp

Filesize
64KB

Download
memory/4996-2563-0x00007FFB13530000-0x00007FFB13540000-memory.dmp

Filesize
64KB

Download