Overview

overview

8

Static

static

3

NocturneLoader.exe

windows10-2004-x64

1

NocturneLoader.exe

windows11-21h2-x64

8

Resubmissions

07/10/2024, 18:32

241007-w6nnfavfja8

07/10/2024, 18:22

241007-w1dahs1djm6

07/10/2024, 18:16

241007-wwl2vs1cnr10

Analysis

  • max time kernel
    1047s
  • max time network
    1048s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/10/2024, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NocturneLoader.exe
  • Size 607KB
  • Sample241007-w6nnfavfja
  • SHA256 4c3fad8ea837861fe54356ad6e7e40cce2fe305b9cb323f07d8802c93a440b70
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwaredefense_evasiondiscoveryevasionpersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 43 IoCs
  • Loads dropped DLL 40 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 24 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 63 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 38 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\NocturneLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\NocturneLoader.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\NocturneLoader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\NocturneLoader.exe" MD5
        3⤵
          PID:1408
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:4256
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:4084
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
          1⤵
          • Enumerates system info in registry
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2316
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb92c3cb8,0x7ffcb92c3cc8,0x7ffcb92c3cd8
            2⤵
              PID:4676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
              2⤵
                PID:2464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4968
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
                2⤵
                  PID:3592
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                  2⤵
                    PID:1540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                    2⤵
                      PID:1960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
                      2⤵
                        PID:416
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                        2⤵
                          PID:4944
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4700
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
                          2⤵
                            PID:1628
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                            2⤵
                              PID:3128
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                              2⤵
                                PID:4688
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4064
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                2⤵
                                  PID:4760
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                  2⤵
                                    PID:4124
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                                    2⤵
                                      PID:1980
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                      2⤵
                                        PID:1564
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
                                        2⤵
                                          PID:896
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                                          2⤵
                                            PID:1624
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2364 /prefetch:1
                                            2⤵
                                              PID:2400
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6468 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3836
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6624 /prefetch:8
                                              2⤵
                                                PID:2608
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6628 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2860
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                                2⤵
                                                  PID:2100
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
                                                  2⤵
                                                    PID:3772
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
                                                    2⤵
                                                      PID:1528
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7256 /prefetch:8
                                                      2⤵
                                                        PID:1696
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2628 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3076
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
                                                        2⤵
                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                        • NTFS ADS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2976
                                                      • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                        "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Drops file in Program Files directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Enumerates system info in registry
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4764
                                                        • C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                          MicrosoftEdgeWebview2Setup.exe /silent /install
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2820
                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                            4⤵
                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks system information in the registry
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2064
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:2024
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:3372
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies registry class
                                                                PID:644
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies registry class
                                                                PID:648
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies registry class
                                                                PID:3136
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQyM0NEODAtMUM0MS00NUIzLUE0MjEtOUQ5Q0FFM0YxM0NGfSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEN0NEQjBGOS1DQUYxLTRERjgtOTQ5MS1CNkNCQ0M5NDgyQjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyNjgwMDMxNzMiIGluc3RhbGxfdGltZV9tcz0iNzM0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks system information in the registry
                                                              • System Location Discovery: System Language Discovery
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:1188
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6D23CD80-1C41-45B3-A421-9D9CAE3F13CF}" /silent
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1764
                                                        • C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe
                                                          "C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4764
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of UnmapMainImage
                                                          PID:4892
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7148566368786080863,11951353954783048507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
                                                        2⤵
                                                          PID:3736
                                                        • C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe
                                                          "C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:_ltAnyMZ9ZYcH-KFwvvfjpy5WUO4nI-vZe8KCABYOcJruwesxD0f9xgiU_qrccacP4Dw2pCuHXt9U4FRvCbgs3o3ztm91C1yqM8lh564e0OZNMasasBfYZJH4UA5R8G1xX2SFFgjtOUsUGdYiehGI12uBvMMN_teDz-je_3K8rqkVmK0y6teN5T_OT4bpYor1IoNP4LSI2UcAoBPCh_7J_8b2t3HdyTbbu2fOzBQ5es+launchtime:1728326384630+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1728325984642003%26placeId%3D654732683%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D995c9874-755a-4833-af2c-0647152552d7%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1728325984642003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of UnmapMainImage
                                                          PID:3712
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:656
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:2080
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:1956
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:3836
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5012
                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x0000000000000484
                                                                  1⤵
                                                                    PID:3424
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks system information in the registry
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:1424
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQyM0NEODAtMUM0MS00NUIzLUE0MjEtOUQ5Q0FFM0YxM0NGfSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMkU5MTQ4OS1BQTM2LTRFNjktOTE0OS0yMDA5ODUzN0NFRjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyNzI2NTM0MDMiLz48L2FwcD48L3JlcXVlc3Q-
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      PID:1564
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\MicrosoftEdge_X64_129.0.2792.79.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:3968
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\EDGEMITMP_7A59F.tmp\setup.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\EDGEMITMP_7A59F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        PID:4128
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\EDGEMITMP_7A59F.tmp\setup.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\EDGEMITMP_7A59F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5D38CABD-A6B9-48C4-B576-5536A26A9907}\EDGEMITMP_7A59F.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7e90176f0,0x7ff7e90176fc,0x7ff7e9017708
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          PID:3864
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQyM0NEODAtMUM0MS00NUIzLUE0MjEtOUQ5Q0FFM0YxM0NGfSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2Rjg1NDk1QS1EMjU3LTQ1NEQtQTNCNy01MTU5NDJDODdBRkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjkuMC4yNzkyLjc5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2Mjg3NjIzMTQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjI4NzcxMzQ4MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0OTIxNzMxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMzZjMwNjU4LTY0NjMtNDE1NS04ODY5LWM4Zjk2YmIyMTQ3NT9QMT0xNzI4OTMwOTAzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW5KbzRkUmlRYXFpcmE3WUZHUEJVNmdLVlUwMWo3SE8xR3dxYWtjYUlHTyUyYjN2bUVDeEZBUUxZbkdHSm1zakpXdERCbEl2N2ZDbU0zb1ZnZUtEdDB1Y2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM5NTU2NjQiIHRvdGFsPSIxNzM5NTU2NjQiIGRvd25sb2FkX3RpbWVfbXM9IjEzNDA2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ5MjI4MzI1MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY1MDc4NTMxODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMzAwMDM2NTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMDU5IiBkb3dubG9hZF90aW1lX21zPSIyMDQ1MyIgZG93bmxvYWRlZD0iMTczOTU1NjY0IiB0b3RhbD0iMTczOTU1NjY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjIxMiIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      PID:2672
                                                                  • C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe
                                                                    "C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\RobloxPlayerBeta.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of UnmapMainImage
                                                                    PID:660
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                    1⤵
                                                                      PID:3476
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1864
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4408
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60D83145-889F-4B90-93CF-C316177A6397}\MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60D83145-889F-4B90-93CF-C316177A6397}\MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe" /update /sessionid "{5900197F-CFAE-43B8-91E5-E8C7BA102FD9}"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2016
                                                                        • C:\Program Files (x86)\Microsoft\Temp\EU692E.tmp\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\Temp\EU692E.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{5900197F-CFAE-43B8-91E5-E8C7BA102FD9}"
                                                                          3⤵
                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks system information in the registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3508
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:2012
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:1148
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Modifies registry class
                                                                              PID:4028
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Modifies registry class
                                                                              PID:4068
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Modifies registry class
                                                                              PID:1444
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTkwMDE5N0YtQ0ZBRS00M0I4LTkxRTUtRThDN0JBMTAyRkQ5fSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QTNDNTA4QzctNkYzQi00ODFELUFGNkEtMzRCNjgwQjhFNzczfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMjYwOTkiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTU3NzA5NzExIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Checks system information in the registry
                                                                            • System Location Discovery: System Language Discovery
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            PID:4704
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTkwMDE5N0YtQ0ZBRS00M0I4LTkxRTUtRThDN0JBMTAyRkQ5fSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntCNEFBN0Q1OS03NjQ2LTRGQjEtQThEMi03NzU0MjVCNjEyQUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2OTc3Mjk4MTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY5Nzc4OTczOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1NDE0NDk2MDUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mNjYxMjQ3Mi0zNzQ3LTRmYmMtYTBhNS02ODM4OWE2YjY3M2U_UDE9MTcyODkzMTI0NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Hd052Q0NnNXZVOXpQUTM5RVM4UkNRanZkWHRJbFM0dWZXZHptNjNscSUyZmlBJTJmMU9yQVZma0MxVmVZNTAxM2NWR3A0TXBxdVRmcEZ0ODY2cmpOQnB4WFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDU0MTQ1OTc0OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZjY2MTI0NzItMzc0Ny00ZmJjLWEwYTUtNjgzODlhNmI2NzNlP1AxPTE3Mjg5MzEyNDQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9R3dOdkNDZzV2VTl6UFEzOUVTOFJDUWp2ZFh0SWxTNHVmV2R6bTYzbHElMmZpQSUyZjFPckFWZmtDMVZlWTUwMTNjVkdwNE1wcXVUZnBGdDg2NnJqTkJweFhRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYzNDg4OCIgdG90YWw9IjE2MzQ4ODgiIGRvd25sb2FkX3RpbWVfbXM9IjgwMDY0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTQxNDc5NzIyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTQ2NjIwMzI4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3Mjc5OTU1NTIzNDY3NzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyOS4wLjI3OTIuNzkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntFNzg2OUM3OC1CNzk1LTQ5MEItQkFERi1CRTkwQ0Q0NEQ1MjB9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks system information in the registry
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        PID:4416
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4720
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2364
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjYxQTgxM0ItMkNGOC00MjdCLTg3QTYtNjhBNTFENDE3NjEzfSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MzkyMTc3RDktQzk1Qy00ODk3LTg1OUUtM0VFM0VBODUyMjE1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7L3IyNTJwKzZiWjRvaVRGczVZMXd0K3hzcGVaWDNZQ0M2L0w2WjZQSXVlYz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTcyODMwMzM2OCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzcyNzc2MTQxNzc1ODIyNSIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMzNzI3OTk2MjA0NTM0MzU3Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjMxMTE4OSIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM2OTM3Nzk2OTIiLz48L2FwcD48L3JlcXVlc3Q-
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks system information in the registry
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        PID:3904
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\MicrosoftEdge_X64_129.0.2792.79.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:1644
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                          3⤵
                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                          • Executes dropped EXE
                                                                          • Installs/modifies Browser Helper Object
                                                                          • Drops file in Program Files directory
                                                                          • Drops file in Windows directory
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:3092
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7321176f0,0x7ff7321176fc,0x7ff732117708
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            PID:2932
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2688
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7321176f0,0x7ff7321176fc,0x7ff732117708
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              PID:4632
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            PID:784
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7bd9776f0,0x7ff7bd9776fc,0x7ff7bd977708
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              PID:1312
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            PID:4524
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.79\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7bd9776f0,0x7ff7bd9776fc,0x7ff7bd977708
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              PID:3468
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjYxQTgxM0ItMkNGOC00MjdCLTg3QTYtNjhBNTFENDE3NjEzfSIgdXNlcmlkPSJ7OEY0QzY0NjAtNThDRS00Njk3LUE4OEMtQTM5NzE5OThEN0JEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswQjcxQTJFMS0wNDdCLTRBQjYtOUQ1OS1DRUYyNDQyMTZBOEF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0lNUIlMjItdGFyZ2V0X2RldiUyMC1taW5fYnJvd3Nlcl92ZXJzaW9uX2NhbmFyeV9kZXYlMjAxMzAuMC4yODM1LjAlMjIlNUQiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuMzUiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY0ODkiIHBpbmdfZnJlc2huZXNzPSJ7OEM3Mzc2MjktQzkxQi00NUFGLUJCMjUtRkQwRDA4RTcwRUU3fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IjEyOS4wLjI3OTIuNzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzcyNzk5NTU1MjM0Njc3MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3MDQxMDk2NjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3MDQxNzk3MDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3MzM5Njk2NjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3NDg0Njk2MjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MjcwNzU5Njg2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDIxIiBkb3dubG9hZGVkPSIxNzM5NTU2NjQiIHRvdGFsPSIxNzM5NTU2NjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjUyMjIzIi8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNjQ4OSIgcGluZ19mcmVzaG5lc3M9InsyNTAwQjExNS1ENzM4LTQwRTQtODlCRS0zNTI3NUMyMEI4NkJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyOS4wLjI3OTIuNzkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBjb2hvcnQ9InJyZkAwLjE3IiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY0ODkiIHBpbmdfZnJlc2huZXNzPSJ7NTE0MzJERjgtMDEwRS00NEVDLTk2RjEtNzU0MkRGNUM0NkZFfSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks system information in the registry
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        PID:3112

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Browser Extensions

                                                                          1
                                                                          T1176

                                                                          Event Triggered Execution

                                                                          2
                                                                          T1546

                                                                          Component Object Model Hijacking

                                                                          1
                                                                          T1546.015

                                                                          Image File Execution Options Injection

                                                                          1
                                                                          T1546.012

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Event Triggered Execution

                                                                          2
                                                                          T1546

                                                                          Component Object Model Hijacking

                                                                          1
                                                                          T1546.015

                                                                          Image File Execution Options Injection

                                                                          1
                                                                          T1546.012

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          4
                                                                          T1112

                                                                          Subvert Trust Controls

                                                                          1
                                                                          T1553

                                                                          SIP and Trust Provider Hijacking

                                                                          1
                                                                          T1553.003

                                                                          Credential Access

                                                                          Discovery

                                                                          Browser Information Discovery

                                                                          1
                                                                          T1217

                                                                          Query Registry

                                                                          4
                                                                          T1012

                                                                          System Information Discovery

                                                                          4
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          System Network Configuration Discovery

                                                                          1
                                                                          T1016

                                                                          Internet Connection Discovery

                                                                          1
                                                                          T1016.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          setup.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Installer\setup.exe
                                                                          • Size 6.6MB
                                                                          • SHA256 dae41fa913389c700bd64b071bff7cb827c666cd95cbf106ae47daea2438a3c7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.19\MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 07f829c35f0fa4b2352b947ca0764093e0a06ebc8eb759dc912360ec69d5ee07
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          SETUP.EX_
                                                                          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E9A94051-8400-4E96-8CEC-346C2D9E0257}\EDGEMITMP_48944.tmp\SETUP.EX_
                                                                          • Size 2.6MB
                                                                          • SHA256 626fbc297f0402bc5d9f19cf073d0125c21bbd494d17aa5c4c2babad071e31d9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          EdgeUpdate.dat
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\EdgeUpdate.dat
                                                                          • Size 12KB
                                                                          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeComRegisterShellARM64.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                          • Size 179KB
                                                                          • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeUpdate.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeUpdate.exe
                                                                          • Size 201KB
                                                                          • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                          • Size 212KB
                                                                          • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeUpdateCore.exe
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\MicrosoftEdgeUpdateCore.exe
                                                                          • Size 257KB
                                                                          • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          NOTICE.TXT
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\NOTICE.TXT
                                                                          • Size 4KB
                                                                          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdate.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdate.dll
                                                                          • Size 2.0MB
                                                                          • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_af.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_af.dll
                                                                          • Size 28KB
                                                                          • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_am.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_am.dll
                                                                          • Size 24KB
                                                                          • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_ar.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_ar.dll
                                                                          • Size 26KB
                                                                          • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_as.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_as.dll
                                                                          • Size 28KB
                                                                          • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_az.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_az.dll
                                                                          • Size 29KB
                                                                          • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_bg.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_bg.dll
                                                                          • Size 29KB
                                                                          • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_bn-IN.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_bn-IN.dll
                                                                          • Size 29KB
                                                                          • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_bn.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_bn.dll
                                                                          • Size 29KB
                                                                          • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_bs.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_bs.dll
                                                                          • Size 28KB
                                                                          • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_ca-Es-VALENCIA.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                                          • Size 29KB
                                                                          • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_ca.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_ca.dll
                                                                          • Size 30KB
                                                                          • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_cs.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_cs.dll
                                                                          • Size 28KB
                                                                          • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_cy.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_cy.dll
                                                                          • Size 28KB
                                                                          • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_da.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_da.dll
                                                                          • Size 28KB
                                                                          • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_de.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_de.dll
                                                                          • Size 30KB
                                                                          • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_el.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_el.dll
                                                                          • Size 30KB
                                                                          • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_en-GB.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_en-GB.dll
                                                                          • Size 27KB
                                                                          • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_en.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_en.dll
                                                                          • Size 27KB
                                                                          • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_es-419.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_es-419.dll
                                                                          • Size 29KB
                                                                          • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_es.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_es.dll
                                                                          • Size 28KB
                                                                          • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_et.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_et.dll
                                                                          • Size 28KB
                                                                          • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_eu.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_eu.dll
                                                                          • Size 28KB
                                                                          • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_fa.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_fa.dll
                                                                          • Size 27KB
                                                                          • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_fi.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_fi.dll
                                                                          • Size 28KB
                                                                          • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          msedgeupdateres_fil.dll
                                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUDC2D.tmp\msedgeupdateres_fil.dll
                                                                          • Size 29KB
                                                                          • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          RobloxStudioInstaller.exe
                                                                          • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                          • Size 6.5MB
                                                                          • SHA256 619d6cf3346f9383988041d29a0d060d02f16e9ef4ea8f709eb9438234c88433
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeWebview2Setup.exe
                                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-d2bde6b0a05e4840\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                          • Size 1.5MB
                                                                          • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MicrosoftEdgeUpdate.log
                                                                          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                          • Size 14KB
                                                                          • SHA256 fcb7c46d1d02cb09f676d1f22884b6b2d53e5ea34cc69707b2c88968d44e57be
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          settings.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          • Size 152B
                                                                          • SHA256 8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          settings.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          • Size 152B
                                                                          • SHA256 2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          672113bb-ae23-4fc5-8daf-0912da3ac99c.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\672113bb-ae23-4fc5-8daf-0912da3ac99c.tmp
                                                                          • Size 5KB
                                                                          • SHA256 3a520a586a7252714ee37ca5ee0e802454688d8179c9cb58b0d4e6e3aefdf51e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          f_000011
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
                                                                          • Size 100KB
                                                                          • SHA256 58a0ed06b38f7886418d565ea4cdb15345b40a1d29e635e167870f45fe14ed4b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          f_0000cc
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000cc
                                                                          • Size 51KB
                                                                          • SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 5KB
                                                                          • SHA256 c7a0b90b8ab6ec51451c988ce2442ecaf9c7d90c62f58c647dae32399093ea43
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 3KB
                                                                          • SHA256 19ec0405e43defcc7ec7fd920b92cd1fff88f44e2ae7c7571b79e113527df720
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 5KB
                                                                          • SHA256 0d5abe96d9108fe17559a389ea977fb0d580b992a387677c345ea8f0b615d67d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          LOG.old
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
                                                                          • Size 743B
                                                                          • SHA256 5b0f5f85c354a18663e4e68c2f40341059b6c5e9513680f0d1ca85f0b9902ebd
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          LOG.old~RFe58ebc2.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58ebc2.TMP
                                                                          • Size 770B
                                                                          • SHA256 d2872b7da86c824bcf909d7e2fa397cefcf5bfe519b7ea8e8eeb5ca23056efdf
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                          • Size 4KB
                                                                          • SHA256 0e6aaa2747865027ea2289235add94f1970786ea096c9fa962f600e899b5b006
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                          • Size 2KB
                                                                          • SHA256 40ecf47aa01f5bfbec50f279869a8e7c7c2cebb77f7126e8038b2b6655999c08
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 7KB
                                                                          • SHA256 3cc578de7cab247ee6eab8b74dec9d2f13074ce78ce64a75af91b3eea470e03a
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 6KB
                                                                          • SHA256 c92ac8e3c4ba28694da260f4a749303da3c1a2feb4502b9b657fbdbe7f102d3c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 5KB
                                                                          • SHA256 ac5b111eec86d3dc858f76a20110248a88e743026dab6d128b7fb027c5313e89
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 7KB
                                                                          • SHA256 ceb9242a9976df2e75732900ed1c00abd3d46d188c04789a57ecd16e99d17e2b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 6KB
                                                                          • SHA256 71acf1d069f52a2c913e6880410a21ba76eb54d45673423e5275b85e2c62bd6c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
                                                                          • Size 35B
                                                                          • SHA256 8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          index.txt~RFe58f538.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe58f538.TMP
                                                                          • Size 99B
                                                                          • SHA256 ca62c5d354f97d995c1ba60ee41adff57eef853d33d7f9c10f097b511ac1e8b1
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 b8890ed653fe10f40fbebb3a71998f20c90ba2b64d3374acd6961d38e54d198c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 448176f6518530c42ed98e1f0f556c1b430d023be92e6ca2dd25d7708c08d673
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 9412e448494b5e01720d22bbe9572c88a8bbc3170dd74b1bd31c65299d30368c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 1bd66dec0c4fa5e04959513b869e6141ed03315abb18a4f617adb88fae04d073
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 f833ea5821a9579fcd381ff506070d183e5cc01bfd6d8d40245782bc02dee9d3
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d11dde0bdca676ade8e32eedeb901d2e24187032f880452adb53ea631acde5bd
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3e3841d0dbceb4157f4ca313eed73aac2b50bda276d6695d3597f76c90dd5872
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3d803deae1fd026e97c35c645d63fe9269914a1e0059af95a6192fd7f10299ba
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 4d89f97c0151fcd4c41ec216f3ad0f0f4295fea5a590ca8bb4e510caff173eb5
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 ab84637b5c69a53da6ff8eb2291fefd428b8cdb7ce5427569c1d6764618e99c2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 0ca22d9813b7ea6db2167929d2d1492ad687de4b7eb4801a4313f5dd842ae9ba
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 978fb68510a3910a7ad4191915fbe231061521b50986b089a3cead487c5ed768
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 6d8ac29cfc765a88994cf3133a45b70f9f31392016662311115c74741bc35488
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 ec8e4dc4d721262af1351fe81e1024c431c5f9e9698fe391e8885937b275d853
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d86232ec8fe82ada699d2a5be5441d1910471d302e1f9fcf85000ea2404cee21
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 2c9a890fae21051fe164b8479134fe9b5311222fe073aa2b5b2d6172c5f3c723
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 b19fbf5a18ed78a5390b5959670769bde5d97d024bfafb49614a7dbd08b8f4ae
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 ba134f608fe38ad8de79dd864168283efdc9954674283a4f9e03bf75d2f5a52b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 7144ac1e13c92cc86081d3de53faa204d59b5e4fbc24b7992b437c5703b6865f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 ec0e81d59598a41e50b6fcd7498c19f19fbd405954f8459e3fdb284f0a3884cb
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d9533d3271c20395c0a4b939c91e3ef976fc22223a361cb94b37ba7433f6bae6
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 cdc57ab277d9f1efb349cf80e3c0a244f38d147ea3793e162d681f97c6291563
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 ea27172562d1e9a4948856b433622ea1d6f3db1f3b8a057a80d80a333cb24fb4
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 5ced5cb3e23ae31008d4ed233ee6cf48537c659f1d930dfdbbbeb51d2872b407
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 944bf5a3e3d70f63563317fe4bbf244e0fd84e5ae87ba22499fb2a7020d9921b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 8d0b247d367df719e17db2ed6bb6382bf9569c2d24adc3dc3c324773904ce431
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 915013285fe3a6a6cc43b0ed12c29c8d9d7ed9c5376a241ec4c484cb277666aa
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 f555593036b00640fe3d94a104c33c106da97566259dda52c72cd4aa2ccf2866
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 a9fccfa509ee24a5d3ab8265a5884c0e827285c62f37d0148972334b7351f221
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 92cab0a458949c951471ad7f0d60f0760a219dfe5eba1cfaa144a78c5a0e1dfa
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 320f82f61f46d33dbf06138873d927bee3996757670d8cd55aeb42a0cf2395f1
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 9fb760740a0a1d8283f5b4212d33873775c972ad8490074e334571fd0858cf3f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 632180f8a57e50c32b4cd76d54e0cc790c01c0e529842341898d674134d04342
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 a1db986e1ab96b91fa8c0684e65082a76bf91469660bdeb96860602a8ea3f4af
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3468a2c2cfdb170db8c0d95d7f2c6ebe1e1300f998baa9572722fd6b677a09ee
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 f2b67cf01271d1649c5402dbd6e90e49aa9aaf35b04d45988d3a9cbf589ff8af
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 beea36d51fe2b4e060c7f95bec0ac18c55c66ad5c2d294615d297084e52a56bf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 7258bcbc5bd6a02d424d12fca8ec649cb56de61c48ea14fe1d2fdf923624f276
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d876c3099992902c684569c017d614866ddf2073af919ee1ae37663ecc490116
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3f07fb29ea66568fa31b38cd9e31fb5dad506b61c648a68dabebebea3f877da0
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 bbb8162c638f291d9178a91e7204078aacb75df7f75a43a47828611018983691
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 f993d56cdc144372cb6c6482d281ddf1f8d97d1dd7eb7600e65844e6bb00fc62
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 412a0a664941c6259efb17cd4a4c8f054a09239a26ef07f136326641798f9a32
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 543de917889f9ed1a8d1018f3baa4d5f5fabda3a289f518bec71842d5ee4fe1c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 95b5dc0098b451f97a0f198c8476d27a6ef38298ab652831bdf246e4af03871c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 63f542ec474a244b8d3733ff1f5236e9663b8285e3512e029882456b4bc8440e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 16142b3a6c37f330887218e54fc25319c7397fe6a4c39a2e6aede86854c953be
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3805775dc7b43cff7d66237a0300a4c3af12b61e9028b0ba7d99a328539e21ea
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 63f1c6b9277e5e65b0a118897e0c9a789d1f6fad13ce79708bed24e61eccffad
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 19b5c9f99fb7de7ae904a95d87a4a200ca5fb0403c301e0f778b689d29ee559d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 1832fa21fcd6e4dedb39d0e77d7f49b5dc5d6fa269ae493bc28b9a9580c438cc
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 cefbf161f3cecaa3bd28d4a9fcaf88ae596b91eb3da5586d6c195a57151d6874
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3af19296b8a9b380b77791fc830333d14a2ad0c0edd4983195aeabfd37c42104
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3fbfa82349d42bea612ea0c6a077942077c26d45e3d5fb238372d4d8fbab33e1
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 261151239aa16e81c373a87b7de23f71a185709911961c6dfe52293c6563e3a8
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 0d2c5215faa6daeec4b64aa049a4dedf162b98228c5585780c48192403ce8843
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 db3e83bb0a440781295e13d65237c63365ae163b45aea61b339fbf953dcf6c03
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 2cad4f739fc53482df24fe19aff17aa12797122851ffe7b7030e2512dd7b23ac
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3f031bfc721b9f1cb582b08132e62efd401ff538c1b238b56037f6f09fde2297
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 04e4b6944c89fa1021f947b525bcdfd8d8b4eacba2c2eb3f88216acb069f0833
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 0a377b20d94a9f94b615b0ade4d316806b70a550d044f949aa44e939fbfb7ee1
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d9e451122fa054cda715580ca875ba60ce0d80a2212bd6965ba6ed2f6146869c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 c0576117e210f0c77213efb8fc92c837810200c1ef5d4dba602ca933c41fa40c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 940d46d1fba931ea98572c7ed3f72c5710628cd17ac9ebc6c20bbfac697091ea
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 874fd198635c99a60dc6e789f598f2b981fac363f4cd6a666e9aa12e52560462
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 69b9427e880a5dd95438bc1c2a84df95029ebdce7d2d70a427bf6172627c2c2a
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 92724c9cad9751eb8f514ee74130d0a570379aaa571a047483e5b882aa730bfb
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 406201512dcd1b7d38c557264f16a1ef533d31dcc282b9ba52dfcccc0af005d5
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 0a43388366c848b6275b823dd3003a5155d053b6e0b1ba1592463cc305a9fb52
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 22a30cc9ccb4d72b9579cbee1a2988d03be7da5b010492d5a8034621c3177c9c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 d1428624374861865fd3168f9065aec0543356fc33808bc30f29c1328905e765
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 666956eacf76c78ef0f6a2e0e9d493e2ec37bf787aabc30f48501032a569fc03
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 4KB
                                                                          • SHA256 8cc3bbc51ea1d71d7a5fc4e80fcd11b64f94ef282a88d47144519c37374a06d7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 f1188870e11f5d18ff3301f9fd89b9118e17938776b41d9bddb4f7b93cfd05a6
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 107fccb52fa28a9a24051817b508f3080a69fe1b213312cfc91e66d3a6f78bae
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 daf7377ae9828cdc2e5593fb69e666e79b2796cc301c9056a4ec2a1436f0ec9e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 6cb93afc07f12d12eb63df19961f89d63a5cf0f6a8488d4f7634a371688f1fbe
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 3a81e68dd325abc68d68444310bf8ad33af04c5ce28a56c3af30acbf066751a9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 240ec8eff8fbbd96dbe58cbdf6d0f2c7cc67b9f7dcec3cad8e612e9a2fd6d25e
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 14b10b2d7ba4c1efd730bde97af2048d134ee69acf82e0ebc703be64feac7306
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 8070538f71f9ebbf2e700762fa50aaf6584456b2d3c5bffe38809903c26e85e9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 ef879fda0b2ba675db45a9779184712ac1a430b152c2339c3ec1e8b65b94cf42
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                          • Size 5KB
                                                                          • SHA256 887bc2f8e0ea3edbecaa5e31b761168b3b399fb97a135274b6b0e89ce6500b1e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          TransportSecurity~RFe5851c5.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5851c5.TMP
                                                                          • Size 2KB
                                                                          • SHA256 ab09bfc7224f142378a109a58862c8440aa7ad4e1b85e14edae16fcf3aa1983e
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          CURRENT
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                          • Size 16B
                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          CURRENT
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                          • Size 16B
                                                                          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          f033afca-540f-4deb-b4b9-3dbc948df4d3.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f033afca-540f-4deb-b4b9-3dbc948df4d3.tmp
                                                                          • Size 5KB
                                                                          • SHA256 c8e6d4487fefeebcd8df86de84aaf09262a8461c2f0ffbe6a3a22e966cd9897e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 11KB
                                                                          • SHA256 8044b646d16b725034cf892b2449220e782f041883c6a3fd288895a671ca19fa
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 11KB
                                                                          • SHA256 81378026b31b6930a85295f5f6702aabd54efa6299eb8155a2801fb3a453e38b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 11KB
                                                                          • SHA256 722a084e8356bdcf951abb84be4ef811745b38d86a99e4b82751a6f58e0b2108
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          default.dic
                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                          • Size 2B
                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          RobloxPlayerInstaller.exe
                                                                          • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                                          • Size 6.5MB
                                                                          • SHA256 9d9c1ffcedfa1c9a38b19d0f06447d7ee068276b91e37f7ca29c87de652ff261
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          RobloxPlayerInstaller.exe:Zone.Identifier
                                                                          • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
                                                                          • Size 26B
                                                                          • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          settings.dat
                                                                          • Path C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat
                                                                          • Size 280B
                                                                          • SHA256 6dbe6976750acd60e2e35bd1d749a477363f94249790b1ee463a65caa60fe85c
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          memory/2064-1567-0x0000000073230000-0x0000000073440000-memory.dmp
                                                                          Download

                                                                          memory/2064-1626-0x0000000073230000-0x0000000073440000-memory.dmp
                                                                          Download

                                                                          memory/2064-1566-0x0000000000AC0000-0x0000000000AF5000-memory.dmp
                                                                          Download

                                                                          memory/2064-1677-0x0000000000AC0000-0x0000000000AF5000-memory.dmp
                                                                          Download

                                                                          memory/4892-1706-0x00007FFCC5A30000-0x00007FFCC5A40000-memory.dmp
                                                                          Download

                                                                          memory/4892-1686-0x00007FFCC8390000-0x00007FFCC83C0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1716-0x00007FFCC7220000-0x00007FFCC722D000-memory.dmp
                                                                          Download

                                                                          memory/4892-1717-0x00007FFCC7220000-0x00007FFCC722D000-memory.dmp
                                                                          Download

                                                                          memory/4892-1718-0x00007FFCC7220000-0x00007FFCC722D000-memory.dmp
                                                                          Download

                                                                          memory/4892-1719-0x00007FFCC7220000-0x00007FFCC722D000-memory.dmp
                                                                          Download

                                                                          memory/4892-1720-0x00007FFCC7220000-0x00007FFCC722D000-memory.dmp
                                                                          Download

                                                                          memory/4892-1714-0x00007FFCC71E0000-0x00007FFCC71F0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1721-0x00007FFCC7DF0000-0x00007FFCC7E00000-memory.dmp
                                                                          Download

                                                                          memory/4892-1722-0x00007FFCC7DF0000-0x00007FFCC7E00000-memory.dmp
                                                                          Download

                                                                          memory/4892-1723-0x00007FFCC7DF0000-0x00007FFCC7E00000-memory.dmp
                                                                          Download

                                                                          memory/4892-1724-0x00007FFCC7E10000-0x00007FFCC7E19000-memory.dmp
                                                                          Download

                                                                          memory/4892-1725-0x00007FFCC7E10000-0x00007FFCC7E19000-memory.dmp
                                                                          Download

                                                                          memory/4892-1726-0x00007FFCC7E10000-0x00007FFCC7E19000-memory.dmp
                                                                          Download

                                                                          memory/4892-1727-0x00007FFCC7E10000-0x00007FFCC7E19000-memory.dmp
                                                                          Download

                                                                          memory/4892-1728-0x00007FFCC7E10000-0x00007FFCC7E19000-memory.dmp
                                                                          Download

                                                                          memory/4892-1711-0x00007FFCC5A50000-0x00007FFCC5A60000-memory.dmp
                                                                          Download

                                                                          memory/4892-1701-0x00007FFCC6260000-0x00007FFCC626C000-memory.dmp
                                                                          Download

                                                                          memory/4892-1690-0x00007FFCC8390000-0x00007FFCC83C0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1685-0x00007FFCC8340000-0x00007FFCC8350000-memory.dmp
                                                                          Download

                                                                          memory/4892-1687-0x00007FFCC8390000-0x00007FFCC83C0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1688-0x00007FFCC8390000-0x00007FFCC83C0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1691-0x00007FFCC8420000-0x00007FFCC8429000-memory.dmp
                                                                          Download

                                                                          memory/4892-1715-0x00007FFCC71E0000-0x00007FFCC71F0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1682-0x00007FFCC8220000-0x00007FFCC8230000-memory.dmp
                                                                          Download

                                                                          memory/4892-1713-0x00007FFCC7170000-0x00007FFCC7180000-memory.dmp
                                                                          Download

                                                                          memory/4892-1712-0x00007FFCC7170000-0x00007FFCC7180000-memory.dmp
                                                                          Download

                                                                          memory/4892-1710-0x00007FFCC5A50000-0x00007FFCC5A60000-memory.dmp
                                                                          Download

                                                                          memory/4892-1709-0x00007FFCC5A50000-0x00007FFCC5A60000-memory.dmp
                                                                          Download

                                                                          memory/4892-1708-0x00007FFCC5A30000-0x00007FFCC5A40000-memory.dmp
                                                                          Download

                                                                          memory/4892-1707-0x00007FFCC5A30000-0x00007FFCC5A40000-memory.dmp
                                                                          Download

                                                                          memory/4892-1684-0x00007FFCC8340000-0x00007FFCC8350000-memory.dmp
                                                                          Download

                                                                          memory/4892-1705-0x00007FFCC5880000-0x00007FFCC5890000-memory.dmp
                                                                          Download

                                                                          memory/4892-1704-0x00007FFCC5880000-0x00007FFCC5890000-memory.dmp
                                                                          Download

                                                                          memory/4892-1703-0x00007FFCC5710000-0x00007FFCC5720000-memory.dmp
                                                                          Download

                                                                          memory/4892-1702-0x00007FFCC5710000-0x00007FFCC5720000-memory.dmp
                                                                          Download

                                                                          memory/4892-1700-0x00007FFCC6170000-0x00007FFCC6190000-memory.dmp
                                                                          Download

                                                                          memory/4892-1699-0x00007FFCC6170000-0x00007FFCC6190000-memory.dmp
                                                                          Download

                                                                          memory/4892-1698-0x00007FFCC6170000-0x00007FFCC6190000-memory.dmp
                                                                          Download

                                                                          memory/4892-1697-0x00007FFCC6170000-0x00007FFCC6190000-memory.dmp
                                                                          Download

                                                                          memory/4892-1696-0x00007FFCC6170000-0x00007FFCC6190000-memory.dmp
                                                                          Download

                                                                          memory/4892-1695-0x00007FFCC6150000-0x00007FFCC6160000-memory.dmp
                                                                          Download

                                                                          memory/4892-1694-0x00007FFCC6150000-0x00007FFCC6160000-memory.dmp
                                                                          Download

                                                                          memory/4892-1693-0x00007FFCC60C0000-0x00007FFCC60D0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1692-0x00007FFCC60C0000-0x00007FFCC60D0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1689-0x00007FFCC8390000-0x00007FFCC83C0000-memory.dmp
                                                                          Download

                                                                          memory/4892-1683-0x00007FFCC8220000-0x00007FFCC8230000-memory.dmp
                                                                          Download