hxxps://mega[.]nz/file/wDdCRTwL#Yqgj6bVgENy7NY9NW6tsIk3xr_4beXObBJB-3n_E6AY

Analysis

max time kernel
445s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/wDdCRTwL#Yqgj6bVgENy7NY9NW6tsIk3xr_4beXObBJB-3n_E6AY

Score

8^/10

discovery evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
3428	SynapseXRemake.exe
3964	RobloxPlayerInstaller.exe
5588	RobloxPlayerInstaller.exe
5888	RobloxPlayerInstaller.exe
2764	RobloxPlayerInstaller.exe
4260	MicrosoftEdgeWebview2Setup.exe
2156	MicrosoftEdgeUpdate.exe
2648	MicrosoftEdgeUpdate.exe
4244	MicrosoftEdgeUpdate.exe
5760	MicrosoftEdgeUpdateComRegisterShell64.exe
5636	MicrosoftEdgeUpdateComRegisterShell64.exe
5932	MicrosoftEdgeUpdateComRegisterShell64.exe
5180	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5924	MicrosoftEdgeUpdate.exe
3824	MicrosoftEdgeUpdate.exe
868	MicrosoftEdge_X64_130.0.2849.46.exe
2668	setup.exe
5132	setup.exe
4816	MicrosoftEdgeUpdate.exe
5544	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe

Loads dropped DLL 22 IoCs

pid	Process
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
2156	MicrosoftEdgeUpdate.exe
2648	MicrosoftEdgeUpdate.exe
4244	MicrosoftEdgeUpdate.exe
5760	MicrosoftEdgeUpdateComRegisterShell64.exe
4244	MicrosoftEdgeUpdate.exe
5636	MicrosoftEdgeUpdateComRegisterShell64.exe
4244	MicrosoftEdgeUpdate.exe
5932	MicrosoftEdgeUpdateComRegisterShell64.exe
4244	MicrosoftEdgeUpdate.exe
5180	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5924	MicrosoftEdgeUpdate.exe
5924	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
3824	MicrosoftEdgeUpdate.exe
4816	MicrosoftEdgeUpdate.exe
5544	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5544	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
5544	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\avatar\defaultDynamicHeadV2.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\MaterialManager\Gradient_Hover_DT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\show_third_party_software_licenses.bat	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\AnimationEditor\image_keyframe_cubic_unselected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaApp\graphic\itemcardbkg_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\LayeredClothingEditor\AddMore_Big_50X50_Light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\command.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\PlatformContent\pc\textures\water\normal_02.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChatV2\ic-add-friends.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\PluginManagement\back.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\RoactStudioWidgets\button_radiobutton_default.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\DesignSystem\ButtonControls.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\VR\recenterFrame.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.46\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\AnchorCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\localizationExport.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\MaterialManager\Texture_None_Light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\Trust Protection Lists\Sigma\Social	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\AnimationEditor\button_zoom_default_right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\PlayerList\SelectOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\configs\DateTimeLocaleConfigs\ja-jp.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\DefaultController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\UnlockCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.46\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.46\Locales\fa.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\R15Migrator\Icon_AnimationConversionTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\Trust Protection Lists\Mu\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.46\Locales\af.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\CompositorDebugger\clip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\R15Migrator\Icon_AdapterPaneTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\PlayStationController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\LegacyRbxGui\brickSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\fonts\NotoSansSinhalaUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\AvatarEditorImages\AvatarEditor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\fonts\Arimo-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\content\textures\ui\Settings\Radial\TopRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_3x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\ExtraContent\textures\ui\LuaApp\graphic\player-tile-background-light.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1408	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5180	MicrosoftEdgeUpdate.exe
3824	MicrosoftEdgeUpdate.exe
4816	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9dbf9780562444e1\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9dbf9780562444e1\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 216548.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3440	msedge.exe
3440	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe
3428	SynapseXRemake.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	4208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4208	AUDIODG.EXE
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	3428	SynapseXRemake.exe
Token: SeDebugPrivilege	2156	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2156	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3428	SynapseXRemake.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5544	RobloxPlayerBeta.exe
2056	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2880	3440	msedge.exe	84
PID 3440 wrote to memory of 2880	3440	msedge.exe	84
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 208	3440	msedge.exe	86
PID 3440 wrote to memory of 3600	3440	msedge.exe	87
PID 3440 wrote to memory of 3600	3440	msedge.exe	87
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88
PID 3440 wrote to memory of 3504	3440	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/wDdCRTwL#Yqgj6bVgENy7NY9NW6tsIk3xr_4beXObBJB-3n_E6AY
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90b9346f8,0x7ff90b934708,0x7ff90b934718
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6468 /prefetch:2
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2084
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3964
- - C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4260
  - - C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2156
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2648
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4244
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5760
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5636
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjgwOTlBRjAtQjUzRi00NjhFLUEzNjAtNEZCQjk3RDEzMjg5fSIgdXNlcmlkPSJ7MzI0NUFENDYtQ0FGMS00QTZDLTlGMEEtM0Q1NkYwMzg4NEE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGNUExOUI4NS01NzJBLTRFMEEtQUNENy0zQTZDQUMyOUFCNzR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MDE5NzgxMTM3IiBpbnN0YWxsX3RpbWVfbXM9IjUyNSIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{68099AF0-B53F-468E-A360-4FBB97D13289}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2512
- - C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3964
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of UnmapMainImage
    PID:5544
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:5588
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:5888
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1172 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13627377858065330268,10767475806624057746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:8AGB7_fM5aR_zDCMOMPwwX9D6gelTgMWODZTXPSwXRSswSDdYzt6vIdkLDJ40fWaWgiVjOw2U6UjRFQBL6OSoiRiExhirAW1UEcxBogLjZhKFPR8djf63O7vv_p1RPZB5bb_l3uBzp3IUIsJK2bq62-_j5DlXa7G5qN3a9o7aCdHeT2QTWH-wSOh0PKD4aKA0aMSLhY1pSKB6OqJNW4o9beKjzlBrhR9Ng9MSlnjeOA+launchtime:1729244428792+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1729244136958006%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D1929e28e-6ee8-4da5-8322-f5f7370e7a04%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1729244136958006+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5592

C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynapseBootstrapper.exe
"C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynapseBootstrapper.exe"
1⤵
PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "Expand-Archive -Path 'C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake.zip' -DestinationPath 'C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap'"
  2⤵
  PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Expand-Archive -Path 'C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake.zip' -DestinationPath 'C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe
  2⤵
  PID:5336
- - C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe
    C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5172

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5924
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjgwOTlBRjAtQjUzRi00NjhFLUEzNjAtNEZCQjk3RDEzMjg5fSIgdXNlcmlkPSJ7MzI0NUFENDYtQ0FGMS00QTZDLTlGMEEtM0Q1NkYwMzg4NEE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMzM3NjIxQi1CRkQ1LTQzQUQtOUVBRi0yRkU5MjkwRDEwRDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMjQ5ODExNjQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3824
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\MicrosoftEdge_X64_130.0.2849.46.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\MicrosoftEdge_X64_130.0.2849.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\EDGEMITMP_1F9F1.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\EDGEMITMP_1F9F1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\MicrosoftEdge_X64_130.0.2849.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2668
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\EDGEMITMP_1F9F1.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\EDGEMITMP_1F9F1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.59 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F376FA9F-0C6B-4407-967B-C0D9CB5D8730}\EDGEMITMP_1F9F1.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.46 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff692801730,0x7ff69280173c,0x7ff692801748
      4⤵
      Executes dropped EXE
      PID:5132
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjgwOTlBRjAtQjUzRi00NjhFLUEzNjAtNEZCQjk3RDEzMjg5fSIgdXNlcmlkPSJ7MzI0NUFENDYtQ0FGMS00QTZDLTlGMEEtM0Q1NkYwMzg4NEE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRTNFRjA1Ni05MkRDLTRBRDYtOUJBMi02MENBQTZBMTgyRTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS40NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzAzOTk5MTIzOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwNDAwNTEyNjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTA5MTYxMjQwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZDUyNDFkOS03Mzg5LTRlNzQtOWE4MS0yZmRhNDMwMzk4MzA_UDE9MTcyOTg0OTA1NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1ZR2xKRTNQdmJhYUp1cTFscmRPemNVaXhrT0hJZkVVZzNTaUk1Q2NGS0xab01Rc1g4VnFmQm9xUTdpZHg2ODVzJTJiMlk1aCUyZmNBaUcxU3FiQkdTbXVZZGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzQ5MTU2ODAiIHRvdGFsPSIxNzQ5MTU2ODAiIGRvd25sb2FkX3RpbWVfbXM9IjQwNTM5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzUwOTI4MTA3MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1MjM1NTExODciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMjkzMTExMjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5MjIiIGRvd25sb2FkX3RpbWVfbXM9IjQ2OTE3IiBkb3dubG9hZGVkPSIxNzQ5MTU2ODAiIHRvdGFsPSIxNzQ5MTU2ODAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYwNTcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.46\Installer\setup.exe

Filesize
6.5MB

MD5
91488751e841910230eb9356f0387873

SHA1
1dac11a9f9cc5ed091211c724e5084e2244b423d

SHA256
ec095ca709a06e6eed6e0a34f25719b51dcac330a9e9c7f65a53807fcd8d2085

SHA512
dec7afb1600a2853507660b3a384b978de210985deae68f45dd39db0b0a1e5aa626981684983d6d4922bb72bf98fcbbafdec0eb3c2bcef0312f1575c15081a84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU339.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.6MB

MD5
f4029e390cc5528de04a2e50a51f89e6

SHA1
285a0745f253e28b225bef5c5d6fb84cd2fc5ea4

SHA256
2522230c65dcd6247bd5f442113204f5595c340dfb9ac50be5c9356e805c3464

SHA512
688a939e175ab9d67744d16386b671da771b26bded32479db048e8ff9c1b9e20faf90563158a942c420ee36bb3b3f9a3314e7a2c97c8de502597d4c17febdd0c

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-9dbf9780562444e1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
5f2659b79807ec7a62da5ac3fa92eb41

SHA1
9391bed198e67325cc077ce1fb85afbdcc701184

SHA256
3c46e79439cba32d14bc0934ee751060c8e7745436e35988a76c254c143d20e5

SHA512
a0c6fb3f5842a73a97e757b76683ed14c1e524e882e3d87ad06bd5e13b3c8bc66577a4f49fea0b137bf58c51e7b6c8b2ad333972425ca7fdeec27cf675a80849

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
95KB

MD5
36f8216033fc1a3f6d0d11227f820d07

SHA1
d0a99eda6a36de5a3001924298b2c37993b110ff

SHA256
ea49bac16130dff669fedf41c26375f60d86839edf932f3a6ad42cab9ee7a31a

SHA512
2093ed465c9f87672b8c9ba1885ea47865d062b9c73c577232798464d125553ba7e7cdbfbae2ffe0aa380dfd81ef147cb1b5eb57e931588623e59e58280fc8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
101KB

MD5
010b9ce4d231fe432529c595a3b7e9f5

SHA1
979dcf6ef33eba9740c57f6fb2a0d9e5c4788c9d

SHA256
2a244edb8fee8f56395c727a4147de75751c5d07a6b214e0787089187a8dba21

SHA512
260c44d9d64b14a1cd7f243090fc73b2a7d3dd30dc0daadb44f847903b44f2cad59be0279e4663463277b908933a33969eb47f4cfc55d696f20ebc79a12dcaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000122

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
53fe6b209ad719282e124b971c86cbff

SHA1
98f37b255b66cd76e68db963e566576683631f99

SHA256
5b491786824a9793ecce4bd5380c9a75cf285d8aaba6daaf531116d1cb177a77

SHA512
94d23b5df9c1e00951dddc69375a0c4ff63a00e7dd3924cbbbb3691032032989398029b9d18626618aee5f685674bb3b1227677ffefec297718ae87e6198d745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
03073deb3108abe893b3d6d1b88fcee4

SHA1
180f7c9ec7c5f15ec65e2ebf214a009d0d6b3ac3

SHA256
247b902818b3b85f332a7ae0bc5915804e95b1db4ebf04b7f7490ad75e6fbcd8

SHA512
9ca37eaadecf6f2438a59dfad45add6adf3d429082396d341722886573dc47af8ab236eef8685573788e09aefb239a002acf64f469e9dd6542cc0283097ca700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
4e07129a993db9702ef33d0b4e4fbf1b

SHA1
5190a53fa4ac292769605128e8acff6421ae7b52

SHA256
0b666d6747b93e5612c68278117c4c4e26b8989726db2d5c8a62ccbd062a2e28

SHA512
cf6bc12c891d7d16f60ae9f04fb367e6929e2364f200e0056205cb9134d9fdeaaa6c89fc03c1ddfde2d6bcaa4b6be8b83a91bb35bc8d520beebcf712c4b3cae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9b46c4435444158d1f2c86c22c60d476

SHA1
51f66c7540b669525f8abca352c32915e1dfbef6

SHA256
728dc2a2c8da41ffec085bcc178dd53da3b4038cd119f76a97150612cb608f9b

SHA512
579f661178a9acb6643c8e3466aa9c88536d2034faa47643125143f03d653eb91d19392df3491be27e0efadc2d766e32a80942b8422a85de6771a159af1aa9c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
2070b474abd0c6d043fc225a6da3b5c7

SHA1
e809f401d9904497c8d7061a8c513af74a02f3fb

SHA256
0799f49f953c43986d0e4b58b08f401a018d584a977a9356e5df50d104aedf27

SHA512
bad447b8099f507fc788f71f6a9235aae6efc51aa6d00a7745fe8bc306a8f49d7513edca481e9f8f98564c10eb1d3567ea0a955176a75cf7348ccde1837a28b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
cbd4452d0891ae0929d8e4078c21fe64

SHA1
14bc16c9fd64a9d86e67ead1fe1d671180fdb812

SHA256
c77d9a9c7bd1c8b5a5f8448736789c2b44370815e45a0255ce718df22f5f861b

SHA512
fca5def42a9aa8a3ee31e8fd4e48d06abb7c0c2e691d39ea7a7da14a9b271df97b473914bbbb17f81b3a17791de530c34e65f9ef74e7cbc85cb1f64a0acde3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
e99a9a35fb06ba58c501936f3258342f

SHA1
89ab8ff4b515b621295bd0ee99ff1f49b94d4d54

SHA256
eae3347ed1fdcfbb56892ba85a2e442a9015b468223b369b9cbf27b1fac5ea0c

SHA512
5d9d0fab09509c37369f935bca7fae9f2d58583ed133f3b2d07c14199d1164b11c17a2aafe342beb491df36a3726f518c4237d15be7cdb1cadb21401575d445e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
e32e55227e85e4d571fbe62df4b7c057

SHA1
d7b01a0f5f13befedb2c0beef9b09110f004740a

SHA256
83183b0fbe58f1be4181510b3a773813ebd7ef3a992019480664a89aab45778a

SHA512
5d420bcd4cf7c5e0640ac26a0e6c5cac781e41453e7ba4498383a6822643a6dedba66f7851a0a138209905504884aabca48f4edf1d5a5f8cac9f678894cd9f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
705656cfc0ab38055b86f362c39ead82

SHA1
b93f8408be536a9b456061f58eec97ffe5ea154a

SHA256
f24a4a22f44348c889a97e6dc4c7eadbbd5a1976d1d140063a8965c25e065626

SHA512
2764869ab0985885fa14e86f219c263d21f4c4b82138128541ffd7cddf99f0710de8ccff136ab8a53d11375fe9c8707d4dc0186721748ec013dad08b61e5b7f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a3b93.TMP

Filesize
673B

MD5
3db2443f52581e4171180f9243db0c6d

SHA1
c1e558a5dec5f9633b486c165052fdb010c35d39

SHA256
d48264ccad6489a8088195d40c7a4e8d3e19fce0b0995358ccc78390c9ae03c0

SHA512
3ada7c51e6f23d92722ab54c20f77af05c0fab18ea661f7e3dd79468ef5eb8224bb3f18503db3ec71030f9bec569f000a9636097f88dafc9964fc3ab4f49d048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
74f752ced0b902d52b72134b3450cbcb

SHA1
860ac667267a263c07a98b84de2627eba371ebef

SHA256
05478ce604907f1243fae143c11ee499ba8fd6e643f88b15b5f1f9d240ad08eb

SHA512
b16041aa044b32ac0b5658c8b740e0ca030f2b7041562473cc4770bb342399d8b6c2d64342d1b72aa78f6ca76a9586840a8274e98abed75a52bab4ab802e7661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe3590c173ce50416ecbb45940178831

SHA1
3701ce11feb9e5ad707a575337ec9456b8003099

SHA256
30ce1b5e778af94b7d0d1317ce2945b7b698556c2981ab60d61d8e224dcb6a61

SHA512
ebdde6e880999fcca8b11967f97c6a854e184e5abf6d19536b608576ee5dc539b656a3ef72f53a501d8d9920d6d2404f212dc1568bfa495cc3882be02c135423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eecab235404de9512c56d71c2ec52ed3

SHA1
81b4e25ec0ddb1ab0017ab641a22d7dd6b2085ac

SHA256
fdd9da10428dc095aa8390dcb6b555d44900d62f77bd28cf1535632b7f476c9a

SHA512
7b426e4d3e9d3e1f4fdc0b4417e042109e036e3af0e28e363e6324a367cb1c6a0d8a628beab48b9bf5a1d0795245e6ce088c71f45c666ef41f4be06aadaa1472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e0719530732b8ea38a9e120fc5259297

SHA1
aa002583b58b3e4e6a92a58350a8524276c8544f

SHA256
83e41cae83ea34aca8c2c0a40b596df4a7659c1689e3283606a63b8a14d937fb

SHA512
4687496789a45e7f644aaa6176583c3b5588c393de53971a5161258b99d21e552ad60e036ab8b102c9bc8ff124ac25621182abe231e816196737169490ca88e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da14845818494e64c19ad5832c62fcdf

SHA1
d9dfbe3210ef3e3cd317b3611db909599daf122e

SHA256
e5c659d9594bf40ab4c327636a162fe60c3825d30cf678c0fa89deada6090be7

SHA512
d6197b15ea0b9e73e1ef16328b35534dfbcc9c36812abc47d7db4afdb374174fa9b6d85489c101fbbbc6166abeb2d7ad74494cd0c9601339d87f42aca857df53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b7668bc205a9784ae6cf0762a7b7fa0c

SHA1
5f7d59d9a7d262ed5eaf10818f47665c590981fd

SHA256
c64631ec4cf4b69b25629ce24c06f395f9327974393f41718189a76760f5dac3

SHA512
cc6ac6f756541204e6b557efed6486acb76d68f5417c943bbc027791587c0f516e9d10e561bea95b6c31f756b251e127d8be476232577421f0d14cadcfbc6b8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dffe9824b25dbbd850129b60401b3201

SHA1
02cf13f25edcdabb41faf9122fa7937ba47aae2d

SHA256
e35f5ad735f48b59ce33e7ea36d7f7c5f6d25e88c98012047061828f5ea7831d

SHA512
319283d48721c08b92e582a86b4f3a36df906be27dc6d979efc23bb57f0363067411c6119102e6b83296baef828c6366e37e161f592a25a5e9b34c193bb76cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
92d938a4a530cf2b91e51661b761ff7b

SHA1
1fd4cd5813fc4c4e879addcf18be06346a09daad

SHA256
3a239363720c6e1f1637215df288935a3feb41e48f8723ad366f2e6c57a93c1f

SHA512
4eb613a93a3077c6195b8a5d1eada11d4a41fc887074b90c1373a004c38fe6a096789f7c36e220b8dff8376bdedc2d2a6d5abfb2087c344c821ef5cb9a9582ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6756cf70548911bb4eceed4a237868e9

SHA1
fdbbe041ee56994b4328183f790beb79c7f88961

SHA256
419ea1e794cdf420527529c3311adc8070cbea60a065bd77b9109d8d06678664

SHA512
107666b03d22293d94444015aa67daf4cbc2025c647e6a082e650356364c172b1b2408102ba42f153755e265a3a075f470156b2b5c24d0306c913511a3c8ed9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4064e00d16777e8780e10e8e948e687b

SHA1
ca8a1eac5c1394792dd736cfffac0304b9c2622d

SHA256
3a6d9a11e320085a93cc34a918ef60a940ddc941660651a0d9062bfefc89194f

SHA512
fef27d4c2025135e3742ff76b330f5021d45e362c4f4096e70be5fb8b605400a5a4e2bdcf850cecb18a7081d5354e29a6687f5216b145046c6534434388dbb0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
511e0f90adfdcdd5d03054f93946fc5b

SHA1
cc2c7a23c868761e74687dcf86f34c3b814ea50f

SHA256
a3fb1f2f8f1fd8437c2abffca4ca9e9c3273a25166b39e102ee5582dc1e5d100

SHA512
50b6a303953626ea1e74b17268b8d730f0c6e9a646152bf962c92ce51e32c1a4944d4e9d2eb93d7fd51aa30a6f83c94dec5e3cf6e93ec76c03cfaba0ede030f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bc6cad4074ffec9b47943336338bb1d

SHA1
4d4908749481bdd35501d431c40ca069ef6d8626

SHA256
6e73d5b578ab7dfbca6b4c97aac73c7aad2b23fcf0ef06543cae44fdb74c90e6

SHA512
b8059870f45e4d23377f3b1d72b7810986d508b0412a6153108e4847c90150dae7bddbc76e984181257d4a4f8da6db29f55e49d6a04fc47c92236aa8bde3dd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33a5dc62926073253db2f46b160469e6

SHA1
c624a38cfb4355e0a83c44bc02977976bc552664

SHA256
4c01975bbad64bb2c250a09c5887e92e7734efd51c1fd4a9ce86185215c96209

SHA512
7063975c25da0cb8caf07998304cefe2a19a215786bbb9127c059e5a0e9dc5ebd9aa2635a5051bd649a81d41561b12df42546e825c6c0b389b16a6ecf4b035cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76594494f7d378190095d8f00ca31e75

SHA1
2492b3f13966ccfb09b30e0c9cbaee43fecfff93

SHA256
969a2385e1f5f10b90e2b9e14c6836f4df66621170c9f8d0de4b587a20aefee3

SHA512
2abcce55a283245aabf94c9bfb3a022b936aa27d3014ec89cdccf98ee694c077e5b1d40f95523475916d8f42e2ed9f5b723848ac9eee1e90b5db5334ede6c54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5374bc3fe74d71c03280522288294e21

SHA1
74db067ecad75c95e90e4dddb8afd7cd5a4bc9cd

SHA256
1c68ecb372a59d161b8aa9b9f166c49d714ff48a789c23e72b36f6f377e16c98

SHA512
ed422ca5cc2922bb26ce6955eb82c83f1c18eb8e2de8e7f52a879080dcc8336032c6b43b0aae39d9b27fda2fb0a55175c3fa8bd0b04d1b6a86f9138c70ccd8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ed0f.TMP

Filesize
48B

MD5
c3c33a0e0442858822084a3f87a57244

SHA1
5dda1a0dfd00dcb39a67b8ac03f03f30104bdea0

SHA256
a3f457386c91918880a93403556d217eec1ac4b68d9d00f55b2b664bdbfd2344

SHA512
fe268ed0da787da7240a02dbb877dff95a10494d0b84e76f1d1dfdd48be148dd43188f8f23abb3255c123930d3a08c7a99ba2278aa25aaceaf5c3002935c9bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a86df44263e185590c98adeec990c501

SHA1
7553777c1ce4298a488eb347599c7f77b291b134

SHA256
16e94b57be30d0e1b4901fb455d9300928e1a752f4e44d2af428c06d129d2ada

SHA512
a592e2dadb45e60d26c5495b877d302a6d4df062bd03c49f837d4c99657403fa627460f7a115199104e7755adcabc412155c54c4d15453bb332a6db9a6538be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d2147b5f222eff448ef8425034fb5aa0

SHA1
50a46d4c2f20ede5a59668f5031a596da5dfc3b4

SHA256
85a1a5813baf765fa57e806630776922fe76c3a91d5428262083be0623621c96

SHA512
92325b20f751d905e8188e83b1d8f20de8f6c6459df298c8f73733dfd5f2a68a54037ba6fd99b6a8c1f41fc7644f9e864766692984537e705e45771db78eda4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
df76fa475ab40068bd56ffd49566dd82

SHA1
9b862fe806c0ab6a7ee1b913ef69f405c2099e13

SHA256
8849f51d4476ec908e626259b2fd740655f90205a9f3186f9352144cfe389621

SHA512
d8e98f798cc7b9f6f502df1d8b400e643ecc240a2feca3deb748e22b591178d81c5cab21d676a211b5eb4e8eef3c4d33e835a490f527e9b36472ad60eaa07ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c3cd8ec50147d756f284ea2fc20309ef

SHA1
b26d426a05d7d6c0e8ef13514a6d77b5efeef890

SHA256
6b87f1a7a4af83d5e6e2b9a25ad39be8767e72acd4b13a2a61c17d6bbd921da4

SHA512
3d858c701bcf2c2d772c15bc9dca190a920e4b956f80474f4474d37fa94fcd96394c2adf58bb7ae168ea173faa9ece6c711dc7043d1a38cd342c48ba43d37675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c290e1a93ad703463e6ff0fe1e91e4f9

SHA1
d7808e7cfe0953d9d7f723524e09b914c4281f06

SHA256
7060ac872e20bc629dd0b6ce4a7286610f2aae9730e5d82240c29d89fbc89509

SHA512
5d32a4c4c2c234c70d5b114c8e8604102ef083e7b3d6ad0f9d48c0c84118d44dbe2a05b72394e74f10e13a7be27e07b1e29f2104eebd78d8766537eb3f793a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
98ac3ade72799dfac89ba4932697b563

SHA1
6857c028205ca9f9b37ca7b03c8455ca292820f6

SHA256
a9bc5d2571a96a5031f5edb88f3cbd4a3d6a8bc6a39d0db21549571f53baff1f

SHA512
32a0a44e683231bdbd93f414217681180023e7f2718e49b97d5b3c0bbe01e7136f9523553e2427d1b99f85b709723fbd605f97c6b219acacd9f9e91e2da47be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ea6ca4c0770658445bb4c9e1bf71af19

SHA1
d7513b012124dd477ca20eb8bb77e593f7d66ad7

SHA256
2c447afd60ffa703992981acd1185ce1aba0d8f0332dbe07804ac609e49f9748

SHA512
8cd80833a4a6d38268284d09db2cedfcc69d6f72bef2e3002ac20e92e42a0f55378fc4e3cd9f23d22f57caecb074df35810fc28a34f49d2781e982729d68d0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ce00fa7c366287626004da45721fc010

SHA1
c509c489844b7e4378a0a7190570d772b7c27036

SHA256
3057ca724e6b99ce305de38a2abf0e6fafca9fcc1f4e2c689ef281da21fb2545

SHA512
bb028aa6da1d2dfed15f0ba93a465813fce4f7f499373a17144ad4780c7a60dc09197d62c86b0f1803b1343cda71afd5336b3143c5108c8ab964f8937050fc80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
df3150484349cf3af1a2d5a06498aa25

SHA1
4660eb75c7139f30779cfc534c484742092867a2

SHA256
81093ccb4abbda451f9c59cd50e1ce1d953d7e6a39248d28154f65391d0d12ca

SHA512
7f1df15a303c2ff4cb17356e5329ea99b1a9bfd8349dc4d0deb582d50971bd14d6c75355f4f269e228ad19688e4887d6d6f96d7177931c70cd3744d8930aaf88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
adb0ecc304d25ac76faf08dfeda6dc1d

SHA1
2201b0357ad29238d046d93d5cfa7c6115b0a26b

SHA256
fb0ef7de83df6c1411c0b1aaa781fdd7de0135d789946c8eb83ee6446f506438

SHA512
651cbad475398a754bf48c7e56e8da83215d1f5771594813316786779472001be45c7c80b324d0f4e7c767137a132d2577d0872d13cfb3cf204c1d92f082d0cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7aacf8184a360a1ace821977d9bff35e

SHA1
07ebeb38bb21e2aed3d43f177367d0199219454a

SHA256
16f12260d54e2bf1e9d0a81ed914d5e1c537de65058a1e3fd7e118bd2d967f75

SHA512
be8486787ada5267b5baeff8b129624434e95281ef5eb7d2a9ba2354b24eb861195cc084415b4b31f1e05a6e66d885f529a543cca41b1c4d4d19e04772835467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5de01b4e82f9cd1414298e532846255f

SHA1
7412ca3f05a1f4b411360d1588429df2f0d5521a

SHA256
9ae11aa46779395476931e396a3b871d1c0767e22e8c1145de57da3bfe788593

SHA512
f5691301f2eedbca63eeb79bd8347112a0cf0061e39b775a8d57be04c62ed70ac5f158b5dc9387df21af587d771963b0756908328b725081aa61a8daf757a70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
70043654d95b863cc711490d7089f658

SHA1
8b29debad78dfdb8ab5fd700624f10889d316219

SHA256
418e08b5e1aeb2550a5ffea5d5805844f934940035db83a06a6c078e0a6a0f87

SHA512
65ca5fd868afd591d87d0a9e8ea289add85022721a72339b5e4911d28533e89ad8981d8fb6ff79418e1a603874f744ae61720abe34a0d2a8cd49113e19a7d826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fa224f2e791c3dac0b88f471c9698079

SHA1
ccc3c18c4184810620dc4dc5514296b24d69b1a1

SHA256
fdc1be5635a6fb24bd4cab07503d4f47c4a56d65373c00052c48371626584dbb

SHA512
b83c9f7a9ed611cc55815ffa73104a900927f3cd9c9cda4481a79a6118faedbf87cdcedefa74d5ed08a1db71a4e63dee1f2eadcef5433981efdb1e4bd4115541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b52fca10086bd032b9a8d579d9bd4c33

SHA1
d45c627615bab8a010e9a7fdf8994f599cd71795

SHA256
1970e50e80685882ad07c683bee41543710b2d4c083aa3ef9480b43459811d67

SHA512
a71bd0ae3cd54806f7114a814b01846d6aa948df254e3964101be2ece67a1c9e3e03e0f94347666f0f2d91494d70adf435c9d3d0bb4bf08450a7425d75e9186d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c91bb684a59c646dfa94d9b41751617e

SHA1
197a3ada0be539d0e9ec4d4dbf0009fa43e61394

SHA256
0a7806931e493d4bf76d35bee053ea1ec6d1a9c43f9c57605326bee475230e48

SHA512
f2e10c16e5cbc438fa8ce71e4dca193995bdacb6d25ec6f07b55e726d7aec34efb0ffe370207446521b87526e647294e282443c73aa63e44b8aeac967e8feabe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4df56c6bb04eb22f31e1af2ea24ad141

SHA1
eddb5af1dfcbb5d9172731df848ab7456cb769eb

SHA256
ea72f2dece5addd74b9b9f7b9accf6e7dd18a6b1368b39848efd1628a0c1224c

SHA512
9964d3bc365a3d1572a6118eb6992acd33ab48ab046ee0af0d5a6be9d016c1e7b2b4c714816b32ad50c0d632c8d1d63fa0823ea93361f0798c95a666d1455f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7a994f41e50c03098d69d1d7ed84cb30

SHA1
c07a88ad37d2b664d6605dd6503f7d18d2f363db

SHA256
261fb6301fcac772450e47a8dace0b9da333f469b963a716c60e2ac7c5c06f4a

SHA512
36ecde7904f6bd793066068aa13a4560dd9b55364bd66c938e6c976668211ec3e61941e2c90d09e768224f8dc30db8f76cb73c6d564501007215810ba13cc1ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
84280f2e444f0f92993b4c2ed8504797

SHA1
c97a5ea0ea732b25cb9dcaec40fb2ea72e8481d6

SHA256
f543a3a673030a0714d98b0f3a75bcfd67db1f94c7bef151eac9fe0d0ac2a998

SHA512
4f33c3ce3de475b6c335d241faa792df1151b62583c4d57a8519d556f93a45515f2b6a44df4a9640534760c227c8b0744ff76da6b64d7a0f8a667e78bed8a3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a5eb5839a464305a46ad32701489ff5f

SHA1
4dcddc94fc631669d7ef7ae6fa4e865e5b8312bc

SHA256
9ebbbaca120356c9023ffb99f458e0854cad1535183687608dd789c8f4d4c411

SHA512
90a4cb74a9e902d2bf46efd09b31b970639b99a489f62803cbf517cf0a4740c2b1d584363edc3331d96693bee248bb8b7aa4f02a8787303cced7f9e299ac2805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5b912ae8d454b5fd4204de21896a7226

SHA1
b7caf5d806a5724bd68ff20eb17a53e49669a64a

SHA256
2522013ec2ef1eb02cdc837ed8e560837afd5f8f389ced49d5d5acf6281004ea

SHA512
53a7ae514b06c2fd0c2b2b6855d512e7cd5e0a733a76b27322c5e58d68c27aca4a3a0a9aa4b36347e123a038a0f3381cebf5f3010b8d995fdf4ea4d3d03e6bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
54dcee1dbfb105ad0090ff2fd1723f08

SHA1
75f25fba03481819aa9b017563ce857ca921dd8b

SHA256
ca107cd0161526a8a9189559476bd13ff5e25f5068423d049801c309ebfd17f4

SHA512
478635fe4b91a1319ae08b1fc20c7f8464eb44b1d9a8a3b9c99bc161397c022b8e662b4f377c19ff4b07e6da29b1e1c5b5c8ead4a427171dd12bbbc08345c728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fd05b04992255b7cd76c65bcffce4d97

SHA1
682059f2bd714b37e81a4fc44969e836d9fd2c8c

SHA256
311015c5925a9092355607c96a8a9308ef1d6eb6d94b39a7f32725d6b6c0f12b

SHA512
1a27c1abb699473911510d4517c2b9db014e01b3cf62c1e4ef1c6b70bb1dbe17feedee7e85bbfd7e96d06970904a9ebb3cefa69eed89f922dc4149937dc31cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
10a0ce619f0e5981ec9084ab88746112

SHA1
9d6da04535a602b3c314a1758de2b0ae4119aff4

SHA256
45c02142ce29ad52001de9cfe55ea803475c7a46d2552c714b4123711367342f

SHA512
df7956f280042769a9fb879a15b0fc75e29533c9dfadee67f39f527ab1b0dd2238c86cafcfca1b52b8593c3278e5489db3acaa200be28f068c723cb70f7de21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1e01fc729cd04d831c70dcce80e6ed7f

SHA1
fc575082b261d119bebf45bf0d4cf8ceee4bdcc6

SHA256
b9e0298c7a71087faf6522651f3e799c52fca5870317263eaf07cea38a22a4f0

SHA512
f6a5f6fa27b4f1b1dc53988c611a1f7b209654215539a08eccd4364ddcbc448952afaa27f747f8791aff3cbfa27db7d50e619b22c9cb0b7fe1fc034be9b7733d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
45ecde4eefbe882dbe01abfcea0505b5

SHA1
25a4c2771bf5ee1f6437bc3373074cc0a584f387

SHA256
e5f6624d1924e043c0879fcf79df0ecc5387042a4ea80b12a0347b0332fb6540

SHA512
83631206f4dfd16dc316d163f337f53998ecdf8592ec869973b3c9c98c36002103610b8684045852c4113359cb3bbfbbc4ea12bbc6d8e4a94746a794b32a0fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fc5ff30dd6d2e47c6c6f39bfc3c65a3f

SHA1
c826b9dc810d9690110819c82aea25a649b9a7ce

SHA256
c4afbdab97778fed89aaf0ed838fecfe6f48d06daee9eb2d68fa838d1b0fd50d

SHA512
8b4a7421e2da17cbc59b535994d8a314c3f0304c880085e97c58533dfb1ec671e18ccf5b436ab8024c80474052202d57e563f26c2001a76809ee7dd0a7b294c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
71510190fb2ddda7ca8356ae0316cd58

SHA1
3eeaafdc153c98abd30837adffa97c3e2c59d9f3

SHA256
9f6f5306aee95d9a2ffd28c133bb2ec6772eef72f6c602f6c1961ddba9a4ff88

SHA512
41b6286bf563cfc64f16331751f4cc3becbb8c37b41ecc4646a46b6ae935c9ae4abcba57697a3ac7a7350c9d80353dfed428647fd97e853e3ff664362399a43e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b13c500a4218b273a70148b67097b723

SHA1
b1ed5c29da90017f6742eaf7fda598f29520c5db

SHA256
4823209c9d33c0ff801b94475dca3f6fd9df7ef7f7094848853831de33804306

SHA512
090bbb0553c72339b766c8b127db15ea5c073c02784ca864f8d319dbaef2bffa614e10b25802bc4128ab5a62b30051b37c4178286e99d7dd76f7ab8caa7dfb93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595838.TMP

Filesize
203B

MD5
565cde78b5c6a8aa620da6d89e3f72c9

SHA1
ae5f30ab406230f236a8cb150a5dabb421fe1186

SHA256
e4bd7f7d644d2ae4e2fea43b9aa037b3b2688fff639273b14a15483066df30df

SHA512
e52a42dd0c3441e2e5d2457e6173bd2419f4174b2fe456742ed880c3359a7484754734f011c1d6c936d206e5b1d7c1c6c14e6c6620c92611348ff0af7fb38e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4642c313147e9159d30a66c7c1cf53c2

SHA1
c43e8067bd0a84033321997030de1132e8971dc8

SHA256
db106370db7ec469511e8b4079a25ee83711bd4da15eb5c889bfa64c1f20bf17

SHA512
72de30ae7c7f844bd5683736d55b3420c2efe210acf730739187c56e6acd4da8f8db21d3d5b011c764177b16469d97a0c5e86d16f344f56036d962f39c497b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eeb2d988c51469a736439206a1f21350

SHA1
db19b47177dc1ceb2b02e77f4b6de66053e5df3e

SHA256
4838ff596965df0cea146163ad2df74eca31563f82d5a4588b22077fbe4405f0

SHA512
3270e4435c58783c7fa019089c32567d31483f5cb53a6792c83c350baabebf1d4135bbe424e6746278677c6d5a620bd687ed9e9edf399f5d277130c7ed198a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2f6ed3f228a67313f663fca5d0096304

SHA1
a0eb983768f1d2ea159db2c2556dc85dac67e310

SHA256
532ffa4c8bb7386d7ecc8ff90c096c364cbeed05f500e5038213b24d12f35691

SHA512
277ba523af685eda37ba9c744dabf603eff4e4cea64d3b598664dd0486b8d7714839af0f09ee348dce8a6371dde3caf1ecea66293013a193a4569871d67eb2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dbd1c93511ccfb61b43ca0f83573465c

SHA1
ca8f3bfba6a8526d96d4c1366c1a6b0b5907ce49

SHA256
c7533dc1789fafaff50c0ac0537b89b2a65d772f9edba8fd4e4dbff47245d81a

SHA512
e9a277766b04b5963e23b5111ebc52a8bf61f807c0db947a83888eda90a2ec9ffd830c54e5eef28ef178f5fce9f8918e2244cce57611e22b232599fac18d0846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2bbec22e2e03cbc862819311d3ed6eaa

SHA1
51f130dd78b360558bb95b437ced7f3561e094de

SHA256
a564951f4dcb36384ca0692564ea498e93a7c5dda378bb2fa4f69a77c5c51897

SHA512
7e369792bd9c44f78cd8d0a5e8c109a4370c1186153e77f97ab00245345f0552e1d6852b5f23a197180eba8bc262d3f24f473f1a13bfc693ae50693332493a9a

Download Submit
C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem

Filesize
232KB

MD5
3548d8825b94ecf3cb6fc617e32e8989

SHA1
54edbb080d5505f03dff5bbf71efa31794d0e064

SHA256
5a03d0cf132b66659edcf43c087c4cb1b3647f341ace02dd84c693c804a0a5dd

SHA512
fc5a5d81a9d052701ddcbf62437a7c64813d22a842468fbaa530ff3a5541cbbf2270b885974627c468d6af217806e39ea20802e7a3b79ee76e9700fef56fa024

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zli0a410.bgm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.6MB

MD5
5088d91c1e88554a4139566f37384d89

SHA1
e900d1005911601082896ca5bda4b033d8f87bd2

SHA256
d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015

SHA512
61bdf2070ba5dae8a8b0cd43f8e3e8aa7559bbd60797e27cc1b9ce4d99e260806b81e1e3c56159eacf4865c0af42a98b53dc9c4ce498f06af62ae9e97396a314

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap.zip

Filesize
13KB

MD5
94818b5dd6fd533052a0a9f68f23b86e

SHA1
ae34ccf4df49553d6fab6eb4d32a0be7854abe97

SHA256
6e4f0f71b55576352534d4595a58e564cde2f4e338541661c1569af8a8fbd463

SHA512
e6d64bc0a535e2a500985022beea1096aea95f2999ac36793e25c88ba6ff1ebe551e7841d26be1db8520715b6bc7caf76dee432376e1099ab06b0cc2023fc19f

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake.zip

Filesize
45.0MB

MD5
d46a97c3d8c1196a44cd7586cf5ef69d

SHA1
855f249b62ccd401ccc836cf7ecc4699c4e17b72

SHA256
d3d112aa3c6595484d65c5bfbfe8f39f9349e698c4a0653fcad2933600cbc730

SHA512
5861a8cbb71db13ab88ab342f5c1d4d0b4529237857ba04ddefa970d1e401944fbf1a87fe4d9886f4ea8e9a12625910840470e37c73b13bca315c53251dbf6e1

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\mode-csound_score.js

Filesize
14KB

MD5
67d3027a53dc9dea93e8badadac2c08c

SHA1
e7b8064b0c9aafbcfc27b39ed66f96eeae054e63

SHA256
dfd544612c4b4c146234c397c610062ef0a64d84ca61bb146a3d74017b93bb40

SHA512
091fab4c78f777f27afe3f10c7ff4777babbdcaef75ed99cb12b7dfd831f7ee9837d418f9932eccac3691abd508a8bf64753f1ac7e4bdda85b9792876400c7ea

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\mode-django.js

Filesize
101KB

MD5
f35de187177b0165615f713868e14448

SHA1
918a10274d31f09a0fc96b1b5d0dd35d6c0f136a

SHA256
624dcb5438d0d5bf3c630e938da5f0bd2d8bd904fe4316afea82ce8b7f25d56d

SHA512
fec3ec6a120729367801800ed585971ece19c032ff03bad38074d2ff0f4310ea872a48dadd80c9d9be7fcde07fbacf8b67ccc4052dddabcb4f38a1398fbb84a5

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\mode-ftl.js

Filesize
50KB

MD5
71451c50ed393d0071d352ddb2e56330

SHA1
cbfc8767bb4baceab37805257997c84f4264bbea

SHA256
2437cbce03f95681d4d31f50d2c5079ed35289bba9f13b1f62da20c73c3f06e2

SHA512
219f6d3deee708706ac4e8fdf4f7161a3cf4b6b719763680783e385d9525c0553fe4bba46157a5610e434c8fb40d88e46e54688705925710c4be782f80986fb4

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\mode-glsl.js

Filesize
21KB

MD5
8ca9be0b4f85aa607d8af3c05c15b20d

SHA1
11f4bcb7b70f1a5bc6eda16825a8c40d81f4b616

SHA256
69343926d5bf317dff9a42193db72989f8464518508a83f642f027745b44e217

SHA512
c279c05f3d04ab75275b4fd61999d4d8b005e956b5d0a1447d00030f15b061621c680cf7ec462cda3c0b669e1b957e9edd2aca64debf6258c8e123ed3f0c9712

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\mode-sh.js

Filesize
14KB

MD5
37f7cf0e0a639840d67e81e0a3d257dc

SHA1
4e59399b4b5dd9275ba58fc5c7640822af8891c2

SHA256
61f9a37f096997d0f8a4de024358c443943e8eecb2a8d023dba992212e3d1534

SHA512
f4940712bd359338eef2498b5658938a1e3cdbc967e1b17bdd13b6136e6661785abad4537daa2136274b8628cc622035e7447c0fa986f0db77f58f7d1ea56588

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Ace\ace\worker-css.js

Filesize
269KB

MD5
efb7f98bfc7e9c92c7a5eacd72ece9e6

SHA1
0b6c2de65deb556163893762146c88e7451a3945

SHA256
53468a5a21fda1bdc6838d73255f0f0b3d7030c745077d09d4cdc41b20796f5a

SHA512
2ca94b561e2d13ea7f91ea3087c2c4a19ae3862b48ebfcd934f9f3c95eae3e49f8d6cdd69d8254a88985e3c57ffc3935581ad615dc8fb473720cc64dce9e50cf

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\ForlornApi.dll

Filesize
9KB

MD5
c7c0b40da6d8feec5af03272c5459ffc

SHA1
b64d8bc09a7002d4c61a3707148d70b4d13bb602

SHA256
c7347f4c9a8089c21a86737e254019db202e17a96dc8616d4ad00f6b1cf9efa8

SHA512
9abae8bf133d707d4648395ee800d3336f372ce7ea1f0b129b069f1864586b8d8692e94dc76511884fbd24a0f9921d81539e0bd8ab2a16b8c17cb2ad613abef2

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Microsoft.Web.WebView2.Core.dll

Filesize
575KB

MD5
ae3a2648bf76a4dfc83d5e0dcb68f3d4

SHA1
9c33e130e4f071f700321312317d0d66b2b3d8a4

SHA256
8ce541fab9d6334a97b6981e2ff1a72aa7979df913e93cb5be1536de0667cc5d

SHA512
8bb3dbb95386ccc5450fe0fd0853382092af8660009112646dca13f934e766b503fa7d9c1c91322326e0c9bae0df9643cbb2f101f256615a3b66e89d93e92aa5

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\Microsoft.Web.WebView2.Wpf.dll

Filesize
80KB

MD5
4349017614d4ae7f3b179b3c712e2c63

SHA1
45b9e20379951b8c42ce466ccc1d1e9f52739893

SHA256
9a76259ad28264645e36852861ffef803b72ea51f538d3ed678f0586389958f6

SHA512
83efe2ebd75fe6cbaea92ce728daab7c0f31b4b7eb5ee8e199aaa35df0d9957fade45684e5ccffa740d12d4fe5e330dbabc542266dfb0d8a3f8173a9e7713112

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe

Filesize
1.4MB

MD5
a9c04f5705d63cd57a28cbb2b34103a7

SHA1
3dedce434535d9f2f6a37ee0195489f82c65c111

SHA256
327ea0c4e22c70993c0f600ff1a6b10c2fb2b7c2d30194f160cc04ce67c83383

SHA512
1d8048633d504bd5a2ab6d9ef5b1c02502e9697ded4f027a95247767ab4d828bc903ba912221f2acae24fad134b3454abc711cb37caaee0967556f3145e6b3f4

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\IndexedDB\devtools_devtools_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
075666199150c758fb9319ce49b87a3b

SHA1
52ac35a0ed372594703271f34febf372d6cff4c3

SHA256
3c33efcb6541211bcea4d8ea0deda03a9d6c995053936bb43b8dc5db30966035

SHA512
77f0b030436eec339a196274a7a7236b0f803dae43104b0e73c9ee4e05d8e76e38cdefb15fefa087e3f5b3e8683c43ef2dbc0ac0d09d7d28ed01db380a5ddf46

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\SynapseXRemake.exe.config

Filesize
1KB

MD5
a08a28787cfaa30a9e6bc765cef2521d

SHA1
5376179bcb216dbb944421c295e4859fb4ad5844

SHA256
84d79735ed7e032b957dec6c47093961ebc294ecf158ddb4b40f1d8683d3ce4b

SHA512
6aaf1d7de6a560c6004086fb59bcb37a27bbe496823b3f488922faba3123cd066ec706e590f6b0f859bc3a476c077d320286d015e7ee39fc50f67d76d76f3cb1

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\bin\ForlornInject.dll

Filesize
927KB

MD5
9973854138225a623866d1ecc5be362f

SHA1
90d6fa2751939e5ad2d29bbcd2f30aad4fa3994c

SHA256
4ca01e3d067ef640d076a539c977b3586f6ad8d4ab6f995e175cf03cc7b0470a

SHA512
34e88aa980dac1142950ac0f08cfbb6612fe1c5d63afcfdc84d40acfcfe432fa3da74955c352667671b87a68bd8cb554caae17873c6878f0f85c54a8f4b4f9b7

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\bin\Version.txt

Filesize
5B

MD5
7d30aa8b30a57b85d658fcd54426884a

SHA1
f243f3446bb1226eacba3cdb8b904ef729d6ec9d

SHA256
d76f71bf62983625bbd95fca40197cda9a03c5e25b32bac39b49ec758a7bb362

SHA512
a01dec49097a6e5ed6704f78ec33126e6207f4ae3acbdb6dad87e775b7661821be3cab24017836e174093fd0e3c76023579c65bbe2ab2fb75c3d407f30b43903

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\runtimes\win-x64\native\WebView2Loader.dll

Filesize
161KB

MD5
3fac859547077abafe806ff1e4709f47

SHA1
0366df220c5d224ee64a42c929574407d2e6d2c9

SHA256
f4d811cda483adb33220c5a856c5ec8dca3a095fde54b44f08e1279a6a5efd33

SHA512
9b7b7aabf6bdc11dfd74430336e02d7d2b96b6bbf352f1e2d158a4900bead364900820af56cf9af25366ff5704e2ffcc2458d45dc3efe00ebd0843d127ab7435

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\workspace\.tests\isfile.txt

Filesize
7B

MD5
260ca9dd8a4577fc00b7bd5810298076

SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6

SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

Download Submit
C:\Users\Admin\Downloads\SyxReBootstrap\SyxReBootstrap\SynXRemake\workspace\OrionTest\6035872082.txt

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
memory/1408-230-0x0000029325370000-0x0000029325382000-memory.dmp

Filesize
72KB

Download
memory/1408-231-0x00000293250D0000-0x00000293250DA000-memory.dmp

Filesize
40KB

Download
memory/1408-229-0x0000029325100000-0x0000029325122000-memory.dmp

Filesize
136KB

Download
memory/2156-3258-0x00000000736B0000-0x00000000738C0000-memory.dmp

Filesize
2.1MB

Download
memory/2156-3648-0x0000000000F30000-0x0000000000F65000-memory.dmp

Filesize
212KB

Download
memory/2156-3257-0x0000000000F30000-0x0000000000F65000-memory.dmp

Filesize
212KB

Download
memory/2156-3298-0x00000000736B0000-0x00000000738C0000-memory.dmp

Filesize
2.1MB

Download
memory/3428-1686-0x0000014C339A0000-0x0000014C339D8000-memory.dmp

Filesize
224KB

Download
memory/3428-1695-0x0000014C33970000-0x0000014C33976000-memory.dmp

Filesize
24KB

Download
memory/3428-1680-0x0000014C18E40000-0x0000014C18FAA000-memory.dmp

Filesize
1.4MB

Download
memory/3428-1681-0x0000014C334C0000-0x0000014C33600000-memory.dmp

Filesize
1.2MB

Download
memory/3428-1684-0x0000014C33940000-0x0000014C33958000-memory.dmp

Filesize
96KB

Download
memory/3428-1685-0x0000014C1ACA0000-0x0000014C1ACA8000-memory.dmp

Filesize
32KB

Download
memory/3428-1687-0x0000014C1ACB0000-0x0000014C1ACBE000-memory.dmp

Filesize
56KB

Download
memory/3428-1689-0x0000014C33A80000-0x0000014C33B14000-memory.dmp

Filesize
592KB

Download
memory/5544-3686-0x00007FF91F9B0000-0x00007FF91F9BE000-memory.dmp

Filesize
56KB

Download
memory/5544-3682-0x00007FF91F900000-0x00007FF91F910000-memory.dmp

Filesize
64KB

Download
memory/5544-3663-0x00007FF91F330000-0x00007FF91F340000-memory.dmp

Filesize
64KB

Download
memory/5544-3656-0x00007FF91FC60000-0x00007FF91FC70000-memory.dmp

Filesize
64KB

Download
memory/5544-3655-0x00007FF91FC60000-0x00007FF91FC70000-memory.dmp

Filesize
64KB

Download
memory/5544-3654-0x00007FF91FB50000-0x00007FF91FB60000-memory.dmp

Filesize
64KB

Download
memory/5544-3676-0x00007FF91D7B0000-0x00007FF91D7E0000-memory.dmp

Filesize
192KB

Download
memory/5544-3680-0x00007FF91D7B0000-0x00007FF91D7E0000-memory.dmp

Filesize
192KB

Download
memory/5544-3679-0x00007FF91D7B0000-0x00007FF91D7E0000-memory.dmp

Filesize
192KB

Download
memory/5544-3678-0x00007FF91D7B0000-0x00007FF91D7E0000-memory.dmp

Filesize
192KB

Download
memory/5544-3693-0x00007FF91F630000-0x00007FF91F63B000-memory.dmp

Filesize
44KB

Download
memory/5544-3692-0x00007FF91F630000-0x00007FF91F63B000-memory.dmp

Filesize
44KB

Download
memory/5544-3691-0x00007FF91F630000-0x00007FF91F63B000-memory.dmp

Filesize
44KB

Download
memory/5544-3690-0x00007FF91F630000-0x00007FF91F63B000-memory.dmp

Filesize
44KB

Download
memory/5544-3689-0x00007FF91F610000-0x00007FF91F620000-memory.dmp

Filesize
64KB

Download
memory/5544-3688-0x00007FF91F610000-0x00007FF91F620000-memory.dmp

Filesize
64KB

Download
memory/5544-3687-0x00007FF91F9B0000-0x00007FF91F9BE000-memory.dmp

Filesize
56KB

Download
memory/5544-3671-0x00007FF91F3E0000-0x00007FF91F3F0000-memory.dmp

Filesize
64KB

Download
memory/5544-3685-0x00007FF91F9B0000-0x00007FF91F9BE000-memory.dmp

Filesize
56KB

Download
memory/5544-3684-0x00007FF91F9B0000-0x00007FF91F9BE000-memory.dmp

Filesize
56KB

Download
memory/5544-3683-0x00007FF91F9B0000-0x00007FF91F9BE000-memory.dmp

Filesize
56KB

Download
memory/5544-3662-0x00007FF91FD40000-0x00007FF91FD45000-memory.dmp

Filesize
20KB

Download
memory/5544-3681-0x00007FF91F900000-0x00007FF91F910000-memory.dmp

Filesize
64KB

Download
memory/5544-3675-0x00007FF91D640000-0x00007FF91D650000-memory.dmp

Filesize
64KB

Download
memory/5544-3674-0x00007FF91D640000-0x00007FF91D650000-memory.dmp

Filesize
64KB

Download
memory/5544-3673-0x00007FF91D530000-0x00007FF91D540000-memory.dmp

Filesize
64KB

Download
memory/5544-3677-0x00007FF91D7B0000-0x00007FF91D7E0000-memory.dmp

Filesize
192KB

Download
memory/5544-3672-0x00007FF91D530000-0x00007FF91D540000-memory.dmp

Filesize
64KB

Download
memory/5544-3657-0x00007FF91FCB0000-0x00007FF91FCE0000-memory.dmp

Filesize
192KB

Download
memory/5544-3660-0x00007FF91FCB0000-0x00007FF91FCE0000-memory.dmp

Filesize
192KB

Download
memory/5544-3659-0x00007FF91FCB0000-0x00007FF91FCE0000-memory.dmp

Filesize
192KB

Download
memory/5544-3661-0x00007FF91FCB0000-0x00007FF91FCE0000-memory.dmp

Filesize
192KB

Download
memory/5544-3658-0x00007FF91FCB0000-0x00007FF91FCE0000-memory.dmp

Filesize
192KB

Download
memory/5544-3653-0x00007FF91FB50000-0x00007FF91FB60000-memory.dmp

Filesize
64KB

Download
memory/5544-3664-0x00007FF91F330000-0x00007FF91F340000-memory.dmp

Filesize
64KB

Download
memory/5544-3665-0x00007FF91F3C0000-0x00007FF91F3D0000-memory.dmp

Filesize
64KB

Download
memory/5544-3666-0x00007FF91F3C0000-0x00007FF91F3D0000-memory.dmp

Filesize
64KB

Download
memory/5544-3667-0x00007FF91F3E0000-0x00007FF91F3F0000-memory.dmp

Filesize
64KB

Download
memory/5544-3668-0x00007FF91F3E0000-0x00007FF91F3F0000-memory.dmp

Filesize
64KB

Download
memory/5544-3669-0x00007FF91F3E0000-0x00007FF91F3F0000-memory.dmp

Filesize
64KB

Download
memory/5544-3670-0x00007FF91F3E0000-0x00007FF91F3F0000-memory.dmp

Filesize
64KB

Download