8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
538s
max time network
540s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 19 IoCs

pid	Process
5092	RobloxPlayerInstaller.exe
452	MicrosoftEdgeWebview2Setup.exe
2336	MicrosoftEdgeUpdate.exe
4116	MicrosoftEdgeUpdate.exe
4568	MicrosoftEdgeUpdate.exe
2364	MicrosoftEdgeUpdateComRegisterShell64.exe
2352	MicrosoftEdgeUpdateComRegisterShell64.exe
4704	MicrosoftEdgeUpdateComRegisterShell64.exe
4416	MicrosoftEdgeUpdate.exe
1576	MicrosoftEdgeUpdate.exe
884	MicrosoftEdgeUpdate.exe
2576	MicrosoftEdgeUpdate.exe
3488	MicrosoftEdge_X64_131.0.2903.86.exe
3252	setup.exe
2200	setup.exe
2384	MicrosoftEdgeUpdate.exe
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe

Loads dropped DLL 19 IoCs

pid	Process
2336	MicrosoftEdgeUpdate.exe
4116	MicrosoftEdgeUpdate.exe
4568	MicrosoftEdgeUpdate.exe
2364	MicrosoftEdgeUpdateComRegisterShell64.exe
4568	MicrosoftEdgeUpdate.exe
2352	MicrosoftEdgeUpdateComRegisterShell64.exe
4568	MicrosoftEdgeUpdate.exe
4704	MicrosoftEdgeUpdateComRegisterShell64.exe
4568	MicrosoftEdgeUpdate.exe
4416	MicrosoftEdgeUpdate.exe
1576	MicrosoftEdgeUpdate.exe
884	MicrosoftEdgeUpdate.exe
884	MicrosoftEdgeUpdate.exe
1576	MicrosoftEdgeUpdate.exe
2576	MicrosoftEdgeUpdate.exe
2384	MicrosoftEdgeUpdate.exe
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
428	api.ipify.org
431	api.ipify.org
432	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 54 IoCs

pid	Process
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\DefaultController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ViewSelector\bottom_hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\graphic\rocket_icon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-36x36.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\return.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\fonts\families\Balthazar.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\DeveloperFramework\AssetPreview\package.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\TextureViewer\select.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\api-ms-win-core-string-l1-1-0.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\icons\ic-createchat1-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\GameSettings\ScrollBarTop_Wide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\api-ms-win-core-timezone-l1-1-0.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Lobby\Buttons\scroll_up.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\VoiceChat\SpeakerDark\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\MaterialManager\List_LT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioSharedUI\pending-light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\EndorsedBadge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\chatBubble_red_notify_bkg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\te.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\advClosed-hand-weld.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\MaterialManager\Fill-lighttheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\icons\ic-more.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\mk.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\MaterialManager\chevrons-right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\AssetPreview\magnifier_ph.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\9SliceEditor\Dragger2OutlinedTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\VoiceChat\SpeakerDark\Muted.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\meshPartFallback.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\AnimationEditor\btn_manage.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\package_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\MaterialGenerator\Materials\Cobblestone.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\AssetConfig\creations.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\VoiceChat\MicLight\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Camera\CameraToastIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Settings\MenuBarAssets\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ViewSelector\back.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\localizationUIScrapingOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\AnimationEditor\Pin.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ControlsEmulator\XBox_Dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2384	MicrosoftEdgeUpdate.exe
4416	MicrosoftEdgeUpdate.exe
2576	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4564	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 890324.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3292	Bootstrapper.exe
3292	Bootstrapper.exe
1412	msedge.exe
1412	msedge.exe
4372	msedge.exe
4372	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
404	msedge.exe
812	msedge.exe
812	msedge.exe
1824	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
3956	msedge.exe
1184	msedge.exe
1184	msedge.exe
5092	RobloxPlayerInstaller.exe
5092	RobloxPlayerInstaller.exe
2336	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	848	WMIC.exe
Token: SeSecurityPrivilege	848	WMIC.exe
Token: SeTakeOwnershipPrivilege	848	WMIC.exe
Token: SeLoadDriverPrivilege	848	WMIC.exe
Token: SeSystemProfilePrivilege	848	WMIC.exe
Token: SeSystemtimePrivilege	848	WMIC.exe
Token: SeProfSingleProcessPrivilege	848	WMIC.exe
Token: SeIncBasePriorityPrivilege	848	WMIC.exe
Token: SeCreatePagefilePrivilege	848	WMIC.exe
Token: SeBackupPrivilege	848	WMIC.exe
Token: SeRestorePrivilege	848	WMIC.exe
Token: SeShutdownPrivilege	848	WMIC.exe
Token: SeDebugPrivilege	848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	848	WMIC.exe
Token: SeRemoteShutdownPrivilege	848	WMIC.exe
Token: SeUndockPrivilege	848	WMIC.exe
Token: SeManageVolumePrivilege	848	WMIC.exe
Token: 33	848	WMIC.exe
Token: 34	848	WMIC.exe
Token: 35	848	WMIC.exe
Token: 36	848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	848	WMIC.exe
Token: SeSecurityPrivilege	848	WMIC.exe
Token: SeTakeOwnershipPrivilege	848	WMIC.exe
Token: SeLoadDriverPrivilege	848	WMIC.exe
Token: SeSystemProfilePrivilege	848	WMIC.exe
Token: SeSystemtimePrivilege	848	WMIC.exe
Token: SeProfSingleProcessPrivilege	848	WMIC.exe
Token: SeIncBasePriorityPrivilege	848	WMIC.exe
Token: SeCreatePagefilePrivilege	848	WMIC.exe
Token: SeBackupPrivilege	848	WMIC.exe
Token: SeRestorePrivilege	848	WMIC.exe
Token: SeShutdownPrivilege	848	WMIC.exe
Token: SeDebugPrivilege	848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	848	WMIC.exe
Token: SeRemoteShutdownPrivilege	848	WMIC.exe
Token: SeUndockPrivilege	848	WMIC.exe
Token: SeManageVolumePrivilege	848	WMIC.exe
Token: 33	848	WMIC.exe
Token: 34	848	WMIC.exe
Token: 35	848	WMIC.exe
Token: 36	848	WMIC.exe
Token: SeDebugPrivilege	3292	Bootstrapper.exe
Token: SeDebugPrivilege	2336	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2336	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2884	taskmgr.exe
Token: SeSystemProfilePrivilege	2884	taskmgr.exe
Token: SeCreateGlobalPrivilege	2884	taskmgr.exe
Token: 33	2884	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2884	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe
2884	taskmgr.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
2104	RobloxPlayerBeta.exe
2412	RobloxPlayerBeta.exe
916	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4840	3292	Bootstrapper.exe	84
PID 3292 wrote to memory of 4840	3292	Bootstrapper.exe	84
PID 4840 wrote to memory of 4564	4840	cmd.exe	86
PID 4840 wrote to memory of 4564	4840	cmd.exe	86
PID 3292 wrote to memory of 4396	3292	Bootstrapper.exe	88
PID 3292 wrote to memory of 4396	3292	Bootstrapper.exe	88
PID 4396 wrote to memory of 848	4396	cmd.exe	90
PID 4396 wrote to memory of 848	4396	cmd.exe	90
PID 4372 wrote to memory of 3572	4372	msedge.exe	100
PID 4372 wrote to memory of 3572	4372	msedge.exe	100
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1464	4372	msedge.exe	101
PID 4372 wrote to memory of 1412	4372	msedge.exe	102
PID 4372 wrote to memory of 1412	4372	msedge.exe	102
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103
PID 4372 wrote to memory of 2216	4372	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff840f046f8,0x7ff840f04708,0x7ff840f04718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- - C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:452
  - - C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2336
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4568
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2364
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2352
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDNBOUI2OTgtQzE5MS00NEU4LThFQzgtM0E4RTRGNjcxMzE4fSIgdXNlcmlkPSJ7N0FDQjUzMEEtOUQ5My00NDBFLTkzRDItMDhDM0I4Q0I0Q0VGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2NDgzMUNDNS0zQzUzLTQ4MTktQkU1My03NTlEMzQ2M0MwQjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODQ0MzUwNDk5IiBpbnN0YWxsX3RpbWVfbXM9Ijc2NCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{D3A9B698-C191-44E8-8EC8-3A8E4F671318}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1576
- - C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5092
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:aV8-iqzgrYWx1JyMGejWP1DGnq1OobgKjcxigr07zyEqbMAYpJLeUTiEktyg0D1E4NLtAgq8m9P9NRGLKpdLh1PFhLzjy2TTs8Mel6_PoWGWuSvAGK-bWJUHULGbQFTY5NoD9lrSuxPbGh8BGY5Kk7XEI1cY_O6Dc0UgsCXNzaq3DWAgsEZSmD6gv9NsO6FWrlgH3O0zDqHpjfzsF_cE3tn2E7_vJL9pLfMmPPvGDl0+launchtime:1733601888550+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1733601507415002%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dbd3ee709-cc95-48b4-891b-0ce1f7177872%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1733601507415002+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1480 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11268504105455365100,3561871352103486234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:hLJMvd7kZUkss2ezePUJm_bPHDj5UH8rpSOdAbggvynZLogWyUfT1NTIcQsDg88w7GJvH50t6SjpkWoBio3kmFA4Vbp4o_XSM7f26CFpWgEWmrzAMPXUxZ_N4QY6N-9IpbI4dczM_kD913XEhXyurMrZVwi1T0uWxPxBv0dLPkiOVPjUhYLks2535uO3OzySS5jUeUYCOPh4X84k37C5hYLlw3I9R-MTpYHOGLkHb7Y+launchtime:1733602003400+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1733601507415002%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dac4e0a98-b011-4a66-bc43-d4f12d515bc8%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1733601507415002+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:884
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDNBOUI2OTgtQzE5MS00NEU4LThFQzgtM0E4RTRGNjcxMzE4fSIgdXNlcmlkPSJ7N0FDQjUzMEEtOUQ5My00NDBFLTkzRDItMDhDM0I4Q0I0Q0VGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MjRBRERCQy03MENCLTRDMDEtQkU5Ni0zNDBBMzZCRTQ0Qjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NDkxMDA3MTgiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2576
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\MicrosoftEdge_X64_131.0.2903.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3488
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\EDGEMITMP_6C736.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\EDGEMITMP_6C736.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3252
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\EDGEMITMP_6C736.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\EDGEMITMP_6C736.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.109 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0B71FFE-014B-440F-BE08-ED04A4B9AEBA}\EDGEMITMP_6C736.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.86 --initial-client-data=0x21c,0x220,0x224,0xd4,0x228,0x7ff6e51f2918,0x7ff6e51f2924,0x7ff6e51f2930
      4⤵
      Executes dropped EXE
      PID:2200
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDNBOUI2OTgtQzE5MS00NEU4LThFQzgtM0E4RTRGNjcxMzE4fSIgdXNlcmlkPSJ7N0FDQjUzMEEtOUQ5My00NDBFLTkzRDItMDhDM0I4Q0I0Q0VGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NzE2NTI2NS1CRENCLTQ0QzItQjhFNS1FQzU3NUJEQjlFQ0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy44NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg1ODcyMDQ4NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NTg4MTA2MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTIzOTgwNDIyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOTcwNWViMi0xY2Y0LTQ2YmYtYmQxMi04MTA5YjMwYzMyMjc_UDE9MTczNDIwNjU3NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Vc25kQTRWUGNqM1JOZ3NXdkVRbXJMZUZSWnBxekdaS1R4T241NEFzJTJmY2ZWZEtmT0Nha2htaGxOc29kd3RROG5oRWNKeWtqTjNRS3M5T0Vsb1lGY0lRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2Njc2NDA4IiB0b3RhbD0iMTc2Njc2NDA4IiBkb3dubG9hZF90aW1lX21zPSIxOTM3MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMjQxNDA2NjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTM5NTQwNjAwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NzY0NzcwNTU2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjk0IiBkb3dubG9hZF90aW1lX21zPSIyNjUyNiIgZG93bmxvYWRlZD0iMTc2Njc2NDA4IiB0b3RhbD0iMTc2Njc2NDA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjUxNCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4724

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Installer\setup.exe

Filesize
6.6MB

MD5
69221ee7ef83d7eb340857b5833eea14

SHA1
d7f27c64b62eefe2c204a323cc812fa56f58ce1e

SHA256
ad14d7268ee8a9c3c89e7cf62a8a9b713c9f37069fe85b3f8fe525dcda8cdfc9

SHA512
8df73f03d7438082b9e8793f5346a7385c91139d879703dd8c32acfdacb200c18231a5a9cedd7836c892ebb7a8888857c68653728b9027ca1f483a1751fbe2e3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU44C1.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
f9646357cf6ce93d7ba9cfb3fa362928

SHA1
a072cc350ea8ea6d8a01af335691057132b04025

SHA256
838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

SHA512
654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.1MB

MD5
e577d441afe20df31cc18ff84f607ee6

SHA1
68bce38c9f919f5a5b0e8de87c70cc0e377032bb

SHA256
adeda7d3636b45f5f4e5012fe8a43cf323de8a3f119961d3367e6a426916b45c

SHA512
f0debbe13fd22f2131f852f2156425f2b50e052be8b221059bd236fdd91e922fb908939d56c03e538a73b71a94628421827ef53d5bdcc06e71a8959f41222a8d

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
b30684f8bee815944fbc642df7869066

SHA1
efe8b8a5340991b5106d2857444585e305d186dd

SHA256
90825531aa789718c70535f13c58f2f48e9c19d15c507ae80288e4fbff1d2bcb

SHA512
bca233f771fd676285f87fddd1b3f1419926f1be113ac374154cb4a03569d48f54d74ffe9ecc8979a50f871a0966f28cd019fd38b709aad50007bbdf51bd062c

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
79KB

MD5
88e7938c83d8bc08a56fdc17b7460550

SHA1
0f4dc3cfc5ab2ea6eacea69f90c9d6c6e086a9ff

SHA256
4f73b8895547b03b01d2ee834cf61270bc5323894bb017d46d6dd2343feda132

SHA512
12dc5010903b69e6891d00f355b5d50cd308f64392dda36452ba1d3bfa35b1196413b797fa099ea32da9827d8428311315ebff2572d402245492d5208830ac9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19e06055-29cb-4cd4-a2ed-70822e6263e7.tmp

Filesize
4KB

MD5
c329c3cf6e812a129c15f960d060b490

SHA1
6953eca34d30c0541f7c7a5ff1a66acce9c9444c

SHA256
416d6ac014e77947d8f1ae48ea6de694b697fd8b638dfccd4f54e042d45215a0

SHA512
246424ebc1d10fd0a6e7d1ac88a5fb39d6a3dd4e46f58b710c93c8c0e06c0e59070caae44ebdb4cd749d495bd045dff0744f4372f010fe959fda99f525cb8c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52c4a532-659c-49c4-9895-6da6e7911840.tmp

Filesize
4KB

MD5
98ef9b0198c4525cbbdf3e2a46a51fc8

SHA1
01611a1842c3fe1f03a0644eb77a922d6f309f66

SHA256
90a21f5b8d3a436009f3c68a30822f5dc83d0d2887f91bea5befba10f595e1d6

SHA512
43836276406e2ef2481f079bc7c3dea40f1b1edb20f32aaed6b46fe1813b54c84da234216a39cffd536accfde96e43be4d947e373f0de4906237e7a8922269fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
94KB

MD5
0c02da87548120b1f3aacd610dae729e

SHA1
31b1ed762b21376d858446e20bb49ea76fc472f5

SHA256
bdd11bfa6e279049c56fbbedf2f34cc8038c8c2edb060643e1d89204dadc7746

SHA512
794580ab171b8d88f8f5e7d76db683aedbd648fe158d473944bc46602ca1e9456b3bdf146a00974389b6a9817abfb6bb7cc03a9107d166c8b3e581892391a497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
44KB

MD5
0654d3fada1f1d0473eec1b0307cd5d5

SHA1
c10547a29c8ae5be2d442f48f46e9759ee256210

SHA256
24f7937ef51d5d77301ac1b1199050c47680b2743467eb57ab50dab265399d2e

SHA512
35550185bb28374b0c19a0c638b02bc1f262c965b0c2943807f20c0114b35ecc57bf7e6be3fdec7eee66f310424e9283998ce44135ff1d13876d069efa7d4298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
22KB

MD5
70f656be37c554622d30900e7f247412

SHA1
9e65ccb6531580871786738640ff81648252771e

SHA256
1fc693b8906f7d327f2eb0dfa913b17ca4c84ed75a77d26f6eb376cf6404d9f3

SHA512
bdb690e9eecb7f00db8f1eff97b28f9a67401cc3850e3e14786967f569e841382362d1ca25801c5472af0700ddd4d3e266e9491f258c8ee6241d37bcc815d7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000f4

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f7ec3fb192cc5de4a1bf16ea5fd4b45c

SHA1
23f0529c43e387e038c4a56a08db039346fc63e9

SHA256
dcb1e56968a9df4a840ca6206998c3496eb0ac3e63491ede1a11b2b5f75aeced

SHA512
934293cda1147d269c257e2bf3071dea5f54e6b03999ddebd795ec052ab9b4fbd13de3c73cde6477830f916d21691fb82490231e05def7dbedd4167132135cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b6891f2bbeb57bda7ae91c54f0bc9028

SHA1
96bfe80f52479517f6a36254b492e78b31c8a968

SHA256
a666a97ea15d7370e3ef6a77168e851eae649f466086124a564397f8390f9596

SHA512
d3cec832c051e051f2257ba7b485fd95eaaaf8f4fbdedb2a1983f29d6ffdf41d7dacd0766967b00b29fa50cee2216c759ded97f07b5a7039bf015d77af3bacaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
56224b2af4622101a7c17cca2684001c

SHA1
ca2ce24360f7b13f768fe7b306134fa5a9335354

SHA256
f04102cccf32a9b5069613d59536a838cf0b2e224ece5da194a3cc10dba845d3

SHA512
d65869201041cd0c8868adc52fea914276f948286581a334f070a2266dbadc07f25720050d1346ebcde725a7ab0c061098a032f10523adb429e6976089af467c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ce83a797e07c349cb441a1578361cff8

SHA1
98735fedd7a4d87cae54bac6ed27de14c94f303f

SHA256
26cbcd3de349340bde8e15d5032a2cee08bbb3a3754268afa850f36084bc5b43

SHA512
8eae1aff75ba54331ae87e123bb24027521151ad6e32d4643954f79826a0a71876b61084d309881c3105659c4c4a3ac69dcbe0cdeddf9ecc020e39914de0f880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c955d7dcef3b47e6430ca9e439616bfb

SHA1
c29fc9d2ca506a6d7b053a4c26bc69c9210a47ad

SHA256
e6485de66dd86b4145efbb98af30954d36c21a1cc1c86647ea6dac14297ddac5

SHA512
678b24ce3276852ac2ee5fec7a8717786554580c700feaa2f7b4708023805027e33edbc79ce705f4b0ba9f7461fc0c63d6bd5da4743e7099943fdc896b393740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
c0d940891f4f191e84f1b853eefa5a6d

SHA1
7236c22fcb1822b276a989db872eae590a1d02e1

SHA256
d7324013ac4fd47214763d384e0041e5fafb62cd81cb3d950eebdef13351117c

SHA512
789d0da6f9ddcd26d6463f0174c13b0751bf380df7817ef5822f24d7a0c016ab3d23e216739bafa946c74de93cc1973547b719b686c11088548a3e404fd6c6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
d3cfc65bcb1bd2c7895568555f9679b2

SHA1
a1fb55bb8c2710e14abba53ff6c11bc698bb8c72

SHA256
9768373cd92acd0c84e991170776b51c354d7688d0947d507ede4684937715c5

SHA512
58680a37fc4263edf92df6f8edb23a6433ce0d1a29db4e7966da267ddb88d192d21028e8193b2ba28e096a10dcff781a836f796390e58db9f8767a8ab5c430b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
a41f9abb18f70ec8e096c2f1dbc93416

SHA1
a12d989be287fed660d0c6e900f2f3f0e0f58ff8

SHA256
fd9530f91436551f9a4b256821196eadc073e652c680795a6ae8c3a43cac612f

SHA512
0c27cc43a7e98047343137368ab58f30769f529f5a8a39f7aa8351159dd02ca8b300ba10df34d1e023e08c4585c58d81ec0b9a5307a8b3da44bb5a0096f59fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
921a7f327604572340bf4124ff77c293

SHA1
563088b54b94494e5d7819345280cc9990f17360

SHA256
80fb0fe89362e6fc874e648e184ac313b552956a2348b8822bf79b045121cd61

SHA512
c15a315eb9bf6987e9dc83d43725f557541182a61fad77c3eb9a047501e4312c407c9e76d1498a9b7276209c8235a766e885145c74651289647db61a47484f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
fb17abad110b0ed97a2b0f38ea70d75b

SHA1
b454ceea0dbbea33278ddc7a67d199b33b9df869

SHA256
55da7067442a8d202caac892ca7a985df42607b6e8670642cceb135a3b160642

SHA512
2d6d89b0bc26fb230046a7dd9a7fc607e51863cca0bf704802a1b984ea8dcff588f7712e70e967891ade2e55fed00939aced12f40301192043e2bbb18412ffa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
e62ac7d9b1e497c9862e45e28c6077de

SHA1
12167ae92a02bc365c50e8f74cc5b0bd2a4d32d9

SHA256
0ed911fde9e1d08f4bf7da17df27bf2412f77ba248d2f6c1acdc32d257ce470f

SHA512
17f9030e3392c09fca57c176560bff4a97b8f7b3ea51e358a4c7b1123e1437ca8cda273428ef539a5c222d1e5ba34153d2780187d17d544268054919ea88a47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
7a1a816eea9f93f0c34a7c72e8572f76

SHA1
76236aa5a963a7fcb2496afd9bd5fefe0db13b34

SHA256
7a259cefcfe462bcd3eb3639c2c872bc358d49d57e734e8a541971d7c7d85d57

SHA512
dc81e89a35121b42fce8986afbc93e4e8243171711def40635ab39fa03354b1deed9ba9376389158e5f9fec8a92f3544ddd2a2d425d4781253df3bd126d70db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
8dc94e3ab0e9daeffc694236ea68cd10

SHA1
a7da468e7545b4b3d09ef6e01732b395cb678e56

SHA256
71b6dc47110f31feea84b85e5c91371005d6f4de309d74649cc117a4f214b563

SHA512
f77870e34b2cb30af7187de87cfa0a963f28f9c89b05df1a755e54c8271e104eb2c1817b6932a8c61d4349e931ab750217c90f9daee4abfa71b32bc1128560b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
0d7687b7e76d164506da41e6f5979e3a

SHA1
82cfb1d9574146e6d9f77fe292f54e1955e119ef

SHA256
79638ce4f2e21735f83cdc2a17c6641c76873ea26ab4db0cec434eaf4ad47e35

SHA512
2b5cf4dfbae249bf375301146e0acc0538fc33f5cf4d27411b9a63336a51c6ea2f3fa79f0bb662cf5679951151522b7a3c681731e013573c727549a3af2a25a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe59521e.TMP

Filesize
671B

MD5
3c1ebc19d026066c60c9341f8ebaa4a9

SHA1
945b0584c91dfa0ce38d4f8bd648c01119d995d0

SHA256
38be213b07523137efd839ff14ef3f1a0d701e4759c44fb9c30df5f5273a4c43

SHA512
52f831031dce35400ff0431dc1f27cccc9f9bd6bdb6a496efba03bfe835caa5e0726fa0d6e10a0827b33d735f69353e8b775c10442fb1cbca7982f5b02d38da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
791f2891f56d46a34299122435f8166c

SHA1
44191a3497eb2b56ad39e22c64f008c5290292d0

SHA256
da727759154d487bda0960eb8206c8dbfdc02dad38b4b98d4bd453f908a7628d

SHA512
271a6606026e51680d7ecf0b4f59e07b8e761166ac17a7dca3e00e138ce7ed1abe34c3c9e65e8af625113fa4f1eaf21d66f50af022659b76c1d0ef9a36d6e4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bed677dd8df1f9f9fe660db58fe840eb

SHA1
97c357c726068f336214ac22cb404b3b2fbcdde0

SHA256
757c83b3c20ce528139fbe05371324749e7388c1480be85f3c9e7db6f988dde0

SHA512
65a36e836bfca8b4815787a0c852fbcf0ff44bb91a0363990ca5dfded96041406193c98550d981f2d3e122e2227af339399c55add2f04ac86c0ed67855b89d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fdef9fc6f92ce78306a9391428fe86a0

SHA1
5717301a848891db64ae262869b4b0c80ee4d45e

SHA256
0e6a4d35a93efa6b6f57d65caf198642279ee6d075d0d676d151a8f4075a54e2

SHA512
65dd4c4c02714d3d846daeb51332a3255026d30c28f721b6e78069f475ca45c78516d83750395dfebc70cb65f3f3d5d99c1a7b2214b20aa689813aa12b3ffc77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
843B

MD5
be59f22584a306d96c9cf967d7b5dc1f

SHA1
cd47afaedb3fa2796532def918bf66a83a9adb4c

SHA256
6a3df19be8f37c71d5ff3bedccfb79f1b1a277759e1398f356b03ccf1bf68275

SHA512
4d454722535b4d047f4d8f1d02046bd6ce3caefad1b7969b70e1f5eeaf60a9cd283cef413561ca4a2ae03cb815eca23fe6d9a8fe8856c0086c3e2e10a647754d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
ae30cccc595c8832e4be92ea115f8e10

SHA1
4486ad10ce0bc14fc1a6c28c1cc97aecf27c41e6

SHA256
8fc0dd180e3882a170ba423dbbc1ccfcc6cbda2eee5dcf35613d2db49d55a323

SHA512
01f17b5efe2fe8647744e9439cbe29f580ae32c7e34ea726e377935af6ed2b3c962848267d9767983c33d01f760df42e3dbc269025b5f87eb5f3f6ea4738a6b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
400b40afa73d60b91656065802efd158

SHA1
b9026536295806490b68f1f4ef8b72b659df5393

SHA256
8a10bc2cb00de47a5f0b4403afdadd93838873c65b1d0b557564d40958b0600e

SHA512
ef4f7aba50b3f4a37f384a49a4379da5ab9fa746260205f6ba2171ef4d05a821ac962716325b913701cb01a0d3e0ae5d490b9489edc0adc2001018a73403b736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ba30756daf3cdd4ff013a207ee54a4f

SHA1
8433eddbcde5d8cb5e719ef97e80fb70a5f428be

SHA256
e400726b17994b1e7c0fd685d9094c28faecdd5aaaebe7a62757bcb5799441a1

SHA512
e26c978e8d0082ae168f437fdbaf1473bcb7c0d11032f896f1b2d8ceb36be9923b31430db1d4f7984ffd977a1a88bdb7b54a65ccde269b6a6c27743e520a07f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b220e83137b868a5679e78a6fff10184

SHA1
bb6cd6a0e3c2a2ad0e08f94e964d3c1dd1de22bf

SHA256
090cd445c8e8ba8b5a8b38753c5fe1e95abb408015fe43897ab158e0cdeb6142

SHA512
a34be47ddbeacf787d180c134fe3afcc811a1bfe91e76610b3f6bd41bd1cae1b71fb10195fc3c1bbe479e37df7cc970bf8fb236dc48a6fb1a53e260f2d5ad4ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
edae59befa137863e09d6958ca3b66e6

SHA1
4ae1b32f2786561754dedd51df9e37d9d46ba74e

SHA256
d0e92e54b727935c5abbd00ee9823982f2986e0e7deaa695cd321646b4032347

SHA512
c4e8e9bda0e776adde75e59a64361044b6989ddf826b77029bc7f50b77b50f18b38156c5c8ef1a31014551fcc9a1b8ec49a6e734df5cd22ed7fc23adc8b3ab62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7686804a498b31af590656372606269

SHA1
1e1054418aaf7817bc672db7ddf3b7de199956c7

SHA256
f2fde099c1e854c0d635873637a66a0ff3517592a932e3ede3170e85e32ceaa0

SHA512
d9f7259cf241c2e566155601eb24c1774d8f26f5e4e3b4f0e477213c2c04ed32acf2583f82a56d8827204a164d29b1ac8b8ce4533f2494516c6172ec3a5eff1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee5ae1c84f1099da893ff4bc4cd850f

SHA1
33864942bc8a4b968ca92c33db9aeb481c75871f

SHA256
e96c277c0435a852ace2cf8c5c0c35b5370cad2e4159b505b007db407112567b

SHA512
8f948df022d56d4474a08fdc255001d79aa07a04a9c68c550382b9af7d2c31528be8aa228953503e43adbbea07633ada8660dc832dec40ec6befe14bbe92709f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
44d53ef7d03bc64e3d1abde9bf4426c8

SHA1
f957b3b1c58035d5e2bdd74024717c50a729fb91

SHA256
431ac8fc824590cd6663487a7046111c28ad2b72767903ab6ad01b216c6df6eb

SHA512
0f4808d3aa7d1052c0f0fc1f3931b2276b8e4cce174f88bdae8e38934f36dfb9da955a2ca47eea132765aadff36876f73236064ef84c85a798013b8eaa535c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f5561158c12d6eba50fae8dd6ed8d4c

SHA1
dc3a3dba5a1ab5977de7ba9f84520c8150bde2ca

SHA256
9f9bab440257bcda316154f3ca75eb85ee4fe46718a3ee8ad0def82b408f6247

SHA512
70a5963869ce81554ac5fa2af10c431ea60bfeaeaed28b9d01b94c56dfcf22c975e9a2b15716ad5ce8a529bd2b311a0cc5959bd44d76493f7b3aa8a5bbe20e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9f79ef541c4ef7ef7cc3f93201aee094

SHA1
56b9569fe73d41f7e3d7b80b61181dc780f5e2cc

SHA256
f9f9138042abe7b474ef11b4c9cadb8efc645619b64fd5b607feded983d1000d

SHA512
6440cb29bb2f060d7b4f4f92fd09d9be2181f79a7775b29a93ff86b7110e9454cf58c9f65d44e48766e36df8e940b38b4de391f43cc1e06be3fe6a4360d18f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bac7fb957efeb68c9b7c2f7602c98768

SHA1
a7a37e904df214b92525ae3f587a0e6224c38b5f

SHA256
bddd1b77c1393aad191cccbd877b7b0eb4b23256639191a0af35cfd99f4811a3

SHA512
66ad536e78fbcb1ba82a83d38961cab3a1887c321824745d2186158b70a57b076f88a339c4323f7b3c52f4eae4b9e0cb9ec93e1396df880b107fbc1e2af3fe39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1ed3cbedc8a5941edd4f6447c53fab40

SHA1
99aaa2e0458b1e7c87b7de9d31ef8bfbfc803e72

SHA256
c8d5e91838b4b67f8b6b6ccad7bef9145ad554ff0cdee2f7e98a57e95eb05ca9

SHA512
94741d75800d20c39fe08c00d02c0f87fd5259273beab543ff5f8db99247e0a4cb7f05f7e6c30dba0e66863ff9e6f1f5f0e6626c7fe6f7b25cd901932249a455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8333e910a96fb61bffe99e96ad18f3b4

SHA1
ea70517094482612ec6bf89189497d3d9576e332

SHA256
cb0924b865a9cb8697751d94b9bca8eae7d0e87821c0b6aedb6defab68466ec6

SHA512
4d4e3ef33f180db236433bff562be76671708bcc87629fd857fc6a7cfc3e77ed48c5660178cb9e8f80096649a27c789043133a1e4a455a83ffc0529ced090403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
df43d4266dfacbe7dfab0d2e13e52fb0

SHA1
912f4cea80f128ce73fb10c7903b5cf4a71c04c5

SHA256
dbdf464ef076bf899f73a7984bfd3ffd10ec572e70f0ff22a755279c14bbb84a

SHA512
f88e258a89ffa974c39b5977751f80ee55f2562bd864d6f43b26720a06209f50aa6924c82d77d83acca62095077bfc35173a262ae7df5aedc62d3ae51474c8c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
9bff15f64a3ca0a827a7435f36840a0d

SHA1
ae9d763288e1d27ac2eb4244b926bcd3ea62156c

SHA256
709f8942a28818978cec923ec5f7f2713d2d89daba19aad2331bc3e7ad39c08e

SHA512
4d86567bfb83607688b6ad7fe4941ab147dfa373de3a6c09fbb19544045d0c6ba965e4ffa5484310435a66be47e98bbd5f1c2b79b006a1bbf9e676b309cd77bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4e0532e8313aeda4effa52735490dcc9

SHA1
97600c7113fd38594af242e50cd1ea9f5371e7dc

SHA256
c2213411c940bc55cf8ed6196edda6746e42a878bcced493c3c9d2aa9085c463

SHA512
4be40471834eac4d51bc8d1bae7498200535f788cf8bb100f10729a9b286021202d3cbf089aa561d456ad878e580c79cd17b0ef3849df85ff6ad8ffe220c81e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
854f094950199c5e29c3fe2fec18d2a1

SHA1
52b60c0faa2200e355882213a1803528e309d00d

SHA256
8b7847a96fae133fc2e349fcc5ca73471b229162e2bfbff004b670a829a445a6

SHA512
393d0b5a536381690df5454957ffb94f26d087bd6540351fe60ee2213202821484f032cfe01d5e8fbc95b7dc42701bbacd59840ad2e6766167fe3c764c441009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dfe599140cf0e69902f495a13fdc4b66

SHA1
da187599e060429893063ad624034d80621fdb6f

SHA256
0d24a95f836c6d217da1449925b3f688521363931150ad82d25bac2b7c3673d9

SHA512
8724ad85f6d9961e18d358429bde656865de28f8d68d43bf4acdd00b4300bf881db54c730b1f69bb78b12092764f47a97aed44e6e9639dc6e33a26b8ef2e8817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38997074cf5ad2440bf3c8eec26da3d0

SHA1
1805fe687ef92c1ac30a6a11e4db2bcf9490eb18

SHA256
32925db0fb4ffe0c1855145ad6990c44f1386f80988c221d2cd7c97ac38f460c

SHA512
f59b132b0efba4da332c20e09ec1d7b95df33f8bb4123d2e1410aaee15bda77cebf53385856d3dd5ebdd312f1fb4411db7c348914893914c7ca7ae58c8245bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2ae92e7080206ef781ead62f55c80b55

SHA1
9727a2278ad5122b546a4c69874d39eb5b6e3002

SHA256
d61f859973f8cc6d76589e0afafe88527c413c1c707e4e66e02ecff80b7776f9

SHA512
f6c533f422b6efcaa4baa5b45951f5d3cd999c3a6078985c269271abbe8a4c4bb2eea0576cb2682748266459dfa77eb208a83991947a3bbadb5b39b768ea1796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1cb0b48c210d7399f335674f9ef9af6

SHA1
16e8bd70546070e67d9b430dcfc94715220173ac

SHA256
dcbeac6c030f58c1f33fcb90db449ad655fb7ee018258af9af680f8fd0c72e69

SHA512
7b0c464e78e39ac8a8fbfbc44f0bcfa8398c258ab5c0632ee56c89c559c5de84635ec1092662efb98f89bbabd955f3dee811c0c160d50aa727e3d9bfe0fbeccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
df32c1f1c18b5be7de26230b31fd35b8

SHA1
83f696ab5a3c78428ba212bb9385a5354f047ed5

SHA256
f1a71f1859122b3d63f66906feaf922e450625ca1a709937cfe75b274d5825ce

SHA512
685c8a58b896cf2ff08806692e839b057edaffb32c933a942f0214868adb5d2004ed48f15552dd8c08104839cfe1660146e9169e676d1b46f17f46fe2ccb30c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6b4302dc6eff55e99186ba859e5e2dad

SHA1
511690d3b06820ab54f3fb5e004f51de38b1e0dd

SHA256
5430d7ddbf4dae8ceb6426212d2e17bf043792cb1126ca516499b44b008f51fa

SHA512
c91a4ebb8263b17875ba159c3cab3fc1df04003d8d4afd0458b125f80e670c6683b0a33ea47b6fad23a024d1d5578059b79f5fb4c3520494231838800daa70ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5717d2faf2fe164c70e6d7d3a5c853fe

SHA1
5e6506c866ba75cceb668679c6950c19b4ff7208

SHA256
7fd0bed67042523f5555c90232b5129103f488b1bcdafc94318530d7b9660a6c

SHA512
c80baf8528069793607326a301727a7f06055f1f34ed41c54c0e1e493bc19572bdb807793bf69ce822e3f994fd78119ba11b56c32030ae3c0b2b0e95f73c4172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c22c2e379d8c14514e124ef78e5d7957

SHA1
534b3885c30921fac0683ae814b599e415d40a10

SHA256
8fd55a0c9929c633fce3d604122487117b5a4d2fe6f7383d1c2808f8e86eec69

SHA512
6349caf8658c0738573125418ede2ad65050ccdabdc2dd61ab8c6d04e587a81e490e6baf4c0988ef236092f677890d5452042ea53f98f44aa7012f8dc8f5cd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5d370f17597af2d3441937ec498878da

SHA1
8099d50214d3ad208acdcf934f8647428b2f7ed0

SHA256
0516cadab802fe52fb355346cd9a4d7b81edfb9e91c85569fb98d725b047fe14

SHA512
73e2a800ec1591482b251c9aabac9dadc8c7498c59272161b38edded3b63e5ecab00a04d8db4cfd794a8f5f6725cbe1cc13ba6c8b9b88be48734aef99aecfee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
129241c52433c15634b2573e352c4c8d

SHA1
42add308c0230f7143115abac81cd87c54b251b7

SHA256
b241f3e4b200b479082a13d2200a4abbf7c09c9756540ea94972709862bd6348

SHA512
16fc7fe3767a50c69a9da3e989d2e1c90055057087b9178dd2454c14fa41fbd49a4657fe0f4ed167c4a486fcf838305e208b9118715cf32fb28eb840b959832e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1d5690c8268c3d9202d7ef4ac7d0e61b

SHA1
5059fcc0a6efd9f6d4f2bdd2bee2384dc7abb9a2

SHA256
9f937cb364975f6da274e825763157ddd6f7c4ea2b95f27e41b448820c35ffe1

SHA512
1623ab84b5b0c99115cbb7924b5ff30562906a7f0d1d05cc96c556d8529e3e93a229d40ae18f2f2c9ba12aa7adc0a7a02e67ec5839b4cad2b797496e3fd489d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6c167a5246d9fe73210e63b577e34814

SHA1
11a120a615641d481bb527eabe68e7d6848efc84

SHA256
82036f0c0dae64de813f406e3367a84ae3a9c5c782542c1ff5c274de1091597e

SHA512
9c7368edaa5679f22ae861f6c9597c900de15fa002d608820b0432cb64ead86002f12f1bfecb1f66c44318f9bf011afb7aee880d2dbfd5dfbedff006ae17df93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d3c5deba407fc38920a2e104ec32235e

SHA1
c6b47b28c9716b4c79ebb6a0339679e07b07705a

SHA256
9d619bc6585bf45e1c8908b0d5a9b42702508cf89dbd6ca8ec7c03b75bf545ee

SHA512
99762e28b89f2125c035030c7a55b4fc39189ae79801e3ec2c21558e62f9f3781784d1db6076cd3856012ec241f95912c429abe2331b2d1a598cf6b7ac0faf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b55dfc6075fc548bdcf34fdb8b22a703

SHA1
c7e85c9b848e5301068c5efc59402cc16e983940

SHA256
8c04ef856add185b5938f1b62a653a6d7053658260c2845fc2da0449df85ed84

SHA512
fc1915375b1b47e902771a02586f7505653f5b6bea8b2343ac17ea2eb9fa774b4e43ebd1f2394fe29f31b6640435d2b9a720e0b332ec368e40493390b17e7063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
12bdf811fe7a6035b4b3f7f04047d40c

SHA1
aa8c67b4f461ca214f033d260123326db1f55aa7

SHA256
a061adee92dae67b8de480691ce8fad33cfe9e7782b4b0c26a4e7e08f4a5d096

SHA512
98ef5dbe02d9b21d0fa18aa1329d82720d90fe064201516eeeb4f520c7fed6b1b1047a8bbea3283d0bbab860be751ad613fc0d49d1cf3a878f32479686a5da56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fa28cc62945472db24764ee18051f818

SHA1
8760b2b90bd9ae2c5f7af324ce1cd344cd9803c2

SHA256
c49210baa9a80c338dc88c9267eed68db610147c1171b67c819b3baaeb02042f

SHA512
6a7f8384e0b938d1383fa57a714df95e4fa2a89004f8a068ffa770d6b071318f514781e997dbcc96dbc19edf27c92bcecd526d9312019ddc4dc3d7bb73ed5523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2207d93e784c66769dab58acba4c769c

SHA1
976bce148418796169b027bbe5bcba2ac405f71f

SHA256
7738a68d7cf5339489e8b8efe87d64dd99e71744ec9fc22e769b068c6568cef4

SHA512
610d7483cbf5aa287efa5b276b3e0219bfc9d88f95d4ba5068ea103cb347f0e3b65e055a67bda838d165b85e953d73180e1d5f9893f4318355a105364f4a2e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9bb7b91b2729ccbb8f76393b173a4c5f

SHA1
acf4743c2f07d2831cb32deedaf9c9cbbe08b87e

SHA256
c4cd1d2301fc0b98b798558faa20afdf1bacba9d01c60c1acd0a100a119c1603

SHA512
fe084a8e9e69a3f02f0799680e182510fbf376c59a1febbeb8e13fbceaf4ab066336dd37865face0b2c97292caebaa33196a14f0a2c7e0ff7f2bcc8b2de5e95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5847f735b16df6de1c21cf0056bdb408

SHA1
c240bb38d6240a8d30cafac791412f94bf385315

SHA256
12b4b19dc63cb5433928f9c39d27dba401db03ea650e34d435b2690334a8c8f0

SHA512
f6bddec361ef2ce89ff4cc15d69b0bffeee843253e9c69555f46da58f35730afa5470b270f0cad7c9182c1885072e331b96f37200d3a1bcdb31a2300b7d28ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3e4550e4692771723a5c3ec1142d5642

SHA1
f26b581c3547b6e0c2b9ba8da0f4235b0fa08dfb

SHA256
a62c49f9cb205eac303f920957f999f752162df83e98e51089dbc672512e7b19

SHA512
6d489adaff5ba73db4de2f046e497c5d9aaaf6ecd119d72e3c415ec563a842542a8208bd817299c8ee21f2563dc3ed7106ead823164b73297f713fdfaec31070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
606d853710c4c3efe98840a047037981

SHA1
fad3e7b8635c8476dd7434a33cc3968a12cf3859

SHA256
636894ff31393240720101289614d763b4e3689069643f92046d00ac75898c1a

SHA512
7c9de103981e59f9483e2ab422d2495194d4d88f07f6733983b4b6f5330fdca7e9d916d741f8f9fc40695c6b4de240249def332947626252c93c2b45a42bef4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
9bde65f43005e1c6dedb4dd8f30caff1

SHA1
798bd692cb10860c0dc3349900b286de0029249b

SHA256
7619c2d469859d4b4aa11eea069dd150a0f51578d6a860d75faecf0fc716f348

SHA512
96cfe6a9df69e70b1496ce8711101d139ef23c5428e7366a88dffb0f060bcdb14d4e494cb0b4008f3b6ca24837d8df53c0ad89bb058e6245e6fa5e302cb2a26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5b73ab3cd954c890c3227cbba0c437ed

SHA1
7ac06d0b9594369b1ec0526f770d08161659d48e

SHA256
741ae13006575cb2d636cef621bc1becf9b175bd534211f2261d60a9df2dd9a5

SHA512
58f02aff44616f0c42a1f6eb0bcdb95c6a97030917373e747971fc0e35233f2ce485f7ef57a1e1bba1d127586594c30d5e8aa7d2e9c773992c15e1e9cdf02e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
af03aabd04394c134ceac84fb44f56d2

SHA1
df11b3d617ce2e80e4eb3410fd4fd4b1db277cb9

SHA256
ae8c110d45d9b03a37e9377b2309661540898b3aaab8017a5a936aa1a9cd55cc

SHA512
79a2a6d1473e9d1b08d546389387a8495ddf2af4704776983297f0a5b9f4662d1da7d4ee5f0e5e79f867374d169a28c03180230217c8973301b8e446e04be625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
40193c20a3403f66917b08d9a630bf54

SHA1
2123c26996d397a7cdd6aaabbcd86bd827a1b2c2

SHA256
0243e0c3e4e7089fb30a02ec7696d2142896769dbc391cc0fb723948d8c7488c

SHA512
8c7683f12add0bc98fcf7a67dccff9895bbd976e0738e1a0c16b940aa344928cede942cacf81a800910e705fc59abf793ca5a4f250915d5031b5ad6258a2aa45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3351f70a4906b271d30659e461386ed0

SHA1
befd1db88c890183f7c3dd0dcbd888b3cac41c6c

SHA256
a262391c54b151c08ed993ff2102123131de0f2d32f8ada52916a75e67b20e46

SHA512
c84f3a8ab19488b91c71ce51f139de336baced0609c962f34e1bce48198b9bd7fbe1bc424ef173fa0b7db063746ff861694d227dcd2d572165fd97dc2bc8623c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
159e81e8eaecf353b3612f73097befdc

SHA1
217fad081c80039fed76c5a86dea9f936cd518ea

SHA256
8364d525782f86c5c2e8df24d6f5da334896f15452ac131fd51d8a2937b2b4d2

SHA512
f9931d731117ec8dd92345223f64f315c45607f71a7fcd737c70d6599c4cede11f9fabb8f5469b4451605bd77964ab4b2799a30ba109eb1dcac42d25b4397f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7b97e72addcfc626a78a0f560fc23a27

SHA1
0c630a248447a4d20e261ff427502f576c4b6762

SHA256
fc926376b79e058fe8d99c500c3e1e3936b0183879a1a1cc77613692d8bf6656

SHA512
af79a556fa5267975b11c0063a209364926aeb119a894cfea1e3c9b59dab084bf5d1dd28589888d45929bfb294f66602f2d58f67596d16e887dc4490ced58081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c2b31bc577b8bfb023606216e00a7ef0

SHA1
f8d5776ad00c7a8790cfe440e67c45b2e96f1175

SHA256
0c2f0c159d1d01b089b900acec14bba717b225a4b9aafea8854dc943693897df

SHA512
3010c9d7651b0e99017601d1839273534e779127293ef38be020e9e9f10c2da4aa9bb5823c6ac58a2f0a7e90d2932a49ba7b0797202cadf47491a89a84c346c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
91f0f5dc7e4c42c026aacb5cd04bb9d6

SHA1
dfc637a1b82dea281d07d7470856091cbb9a7aa7

SHA256
5a898277ea228a3b4f55ba9bf475be5dc34f68cc7766f261f6f9cb5a4cf027b4

SHA512
d9678c6b5b610e9cc9a7a9903303dc6947ded30548eef2c82ac6c5cc39f78fd96e04a9a6b32b9f4b85feae277b4818eb52d32e28d11ae5085c8dac4a9eb7595c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5af2d1f24bb3dfa66f1aff0a0414f127

SHA1
336512a8e9c4c7c78201770d64552e0b043fd133

SHA256
89937915dafce8bb854f3353ea4ce42e3adbf3131f80e988ce71bd360565ea1e

SHA512
ab4b009feb411eb5ecd9eb4b7c416d1307481a795d7967df0de0206f7f040dcc70927043a087c9c21ea7a790f3564dc9ee6f0d024abee5664fbe8ad830b80e03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b5d3a1f07b328d654519dfa6d9350fbd

SHA1
43a670ed0725e50276258c2216b5ccc9b85b666f

SHA256
51628acf0e10a6a3e440b95b9fc4f2c1560f581013694675f87987b4052d773d

SHA512
f45666c14483e6e4f9ecc731515c67c4bd1848c348e0af0054b3d5734491f4bab213e276b2fc9e9d715b7e536f4cd0c8d4f08fe1ed8a4606971bb31098216fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589edb.TMP

Filesize
1KB

MD5
f83aba3e97741a3bc34d47d24d0ec5fd

SHA1
a69a8002a799dfa25bdbdb6ed557739205dd7bf7

SHA256
cdd7c3cbeb3947774da9f91693a3107d616ba06aaf066f302af3f066b7b033e6

SHA512
d7a16a7fa098cf2390a53a8be8260be59448b013460e63b37fd3c39dc0f71a4c8701be70e3040e7ca35253aa88267d511c887500b03cbd722c6c562a3029dc9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
abf578860b6d9c47c1b816ea7c8a4aa5

SHA1
d86084ae5928be6766e60560fe1037e01120bf72

SHA256
35b39e8f0b6422b98af51733ddca1937431a52eb2d2e7afdd508357cd130e2dd

SHA512
85185647036e11c0176da8abfc7be22c5eccf33369a4e35dcb1258a79a56994a81e3bb9b7e91435b0fede0a933db53687cfad303e3c3c829611546eeb9a1473d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d744a33cf659af6576d1baa644976ec

SHA1
86c910c7f20aab3d6e4da95d75eab612f09869f4

SHA256
d2573820e4ad1745510996a7f322d39bd66b6d3cc589b23770b9e3b529cafc8c

SHA512
49046a29c3fd5e00203669fabb18eaa19fde7e25fc7f6b32a4bb6e6ec55be529f6e8c828d3ef7b91b271cbc75bddc4135653ca673c92638a22dceefbccfab372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
17b6e8b22416ed7e1d7ff163b549645b

SHA1
18bbbe61288722702ebc9c9ba6b930635c314d53

SHA256
5550636c96565bbecc8915de4af657118c5194aa716a8029b43c66151566c29e

SHA512
89abb873ad07d584f6789b96c9a8555269e64d7605139751ce867d8861464efae4d458480ef3e3393def4b543d512f32d2cbdcb57eca1d8013f8ddcd1d8dc920

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 890324.crdownload

Filesize
7.2MB

MD5
2a39b191557fe027454094fcb79e4c9f

SHA1
a8c2d42f149ec3d8b8ab2fb38e7b1bac786ca8da

SHA256
1cfa38c4091921ff9231b90989c616f9d73bf8f328a263e9e1621a42b1053201

SHA512
77df1c00cadf139dd4f791555abd927d16ddcc5e696a7760ef5a2901f277997f23b2334fd8b2b50c573567139b3f653afb7a8beef089084e2db7fe4fa10ccafb

Download Submit
memory/2104-1980-0x00007FF862F60000-0x00007FF862F70000-memory.dmp

Filesize
64KB

Download
memory/2104-1972-0x00007FF864E70000-0x00007FF864E80000-memory.dmp

Filesize
64KB

Download
memory/2104-1984-0x00007FF8631E0000-0x00007FF863210000-memory.dmp

Filesize
192KB

Download
memory/2104-1983-0x00007FF8631E0000-0x00007FF863210000-memory.dmp

Filesize
192KB

Download
memory/2104-1967-0x00007FF865610000-0x00007FF865640000-memory.dmp

Filesize
192KB

Download
memory/2104-1982-0x00007FF863070000-0x00007FF863080000-memory.dmp

Filesize
64KB

Download
memory/2104-1981-0x00007FF863070000-0x00007FF863080000-memory.dmp

Filesize
64KB

Download
memory/2104-1986-0x00007FF8631E0000-0x00007FF863210000-memory.dmp

Filesize
192KB

Download
memory/2104-1979-0x00007FF862F60000-0x00007FF862F70000-memory.dmp

Filesize
64KB

Download
memory/2104-1977-0x00007FF864E90000-0x00007FF864EA0000-memory.dmp

Filesize
64KB

Download
memory/2104-1994-0x00007FF864AB0000-0x00007FF864ABE000-memory.dmp

Filesize
56KB

Download
memory/2104-1992-0x00007FF864AB0000-0x00007FF864ABE000-memory.dmp

Filesize
56KB

Download
memory/2104-1991-0x00007FF864AB0000-0x00007FF864ABE000-memory.dmp

Filesize
56KB

Download
memory/2104-1990-0x00007FF864AB0000-0x00007FF864ABE000-memory.dmp

Filesize
56KB

Download
memory/2104-1989-0x00007FF864A00000-0x00007FF864A10000-memory.dmp

Filesize
64KB

Download
memory/2104-1988-0x00007FF864A00000-0x00007FF864A10000-memory.dmp

Filesize
64KB

Download
memory/2104-1975-0x00007FF864E90000-0x00007FF864EA0000-memory.dmp

Filesize
64KB

Download
memory/2104-1993-0x00007FF864AB0000-0x00007FF864ABE000-memory.dmp

Filesize
56KB

Download
memory/2104-1997-0x00007FF863DA0000-0x00007FF863DAB000-memory.dmp

Filesize
44KB

Download
memory/2104-2000-0x00007FF863DA0000-0x00007FF863DAB000-memory.dmp

Filesize
44KB

Download
memory/2104-2001-0x00007FF863DA0000-0x00007FF863DAB000-memory.dmp

Filesize
44KB

Download
memory/2104-1999-0x00007FF863DA0000-0x00007FF863DAB000-memory.dmp

Filesize
44KB

Download
memory/2104-1998-0x00007FF863DA0000-0x00007FF863DAB000-memory.dmp

Filesize
44KB

Download
memory/2104-1996-0x00007FF863D80000-0x00007FF863D90000-memory.dmp

Filesize
64KB

Download
memory/2104-1995-0x00007FF863D80000-0x00007FF863D90000-memory.dmp

Filesize
64KB

Download
memory/2104-1974-0x00007FF864E90000-0x00007FF864EA0000-memory.dmp

Filesize
64KB

Download
memory/2104-1973-0x00007FF864E70000-0x00007FF864E80000-memory.dmp

Filesize
64KB

Download
memory/2104-1985-0x00007FF8631E0000-0x00007FF863210000-memory.dmp

Filesize
192KB

Download
memory/2104-1971-0x00007FF864DE0000-0x00007FF864DF0000-memory.dmp

Filesize
64KB

Download
memory/2104-1970-0x00007FF864DE0000-0x00007FF864DF0000-memory.dmp

Filesize
64KB

Download
memory/2104-1962-0x00007FF8655C0000-0x00007FF8655D0000-memory.dmp

Filesize
64KB

Download
memory/2104-1961-0x00007FF8654B0000-0x00007FF8654C0000-memory.dmp

Filesize
64KB

Download
memory/2104-1960-0x00007FF8654B0000-0x00007FF8654C0000-memory.dmp

Filesize
64KB

Download
memory/2104-2004-0x00007FF863330000-0x00007FF863340000-memory.dmp

Filesize
64KB

Download
memory/2104-2003-0x00007FF863230000-0x00007FF863240000-memory.dmp

Filesize
64KB

Download
memory/2104-2002-0x00007FF863230000-0x00007FF863240000-memory.dmp

Filesize
64KB

Download
memory/2104-1987-0x00007FF8631E0000-0x00007FF863210000-memory.dmp

Filesize
192KB

Download
memory/2104-1978-0x00007FF864E90000-0x00007FF864EA0000-memory.dmp

Filesize
64KB

Download
memory/2104-1976-0x00007FF864E90000-0x00007FF864EA0000-memory.dmp

Filesize
64KB

Download
memory/2104-1965-0x00007FF865610000-0x00007FF865640000-memory.dmp

Filesize
192KB

Download
memory/2104-1963-0x00007FF8655C0000-0x00007FF8655D0000-memory.dmp

Filesize
64KB

Download
memory/2104-1964-0x00007FF865610000-0x00007FF865640000-memory.dmp

Filesize
192KB

Download
memory/2104-1966-0x00007FF865610000-0x00007FF865640000-memory.dmp

Filesize
192KB

Download
memory/2104-1968-0x00007FF865610000-0x00007FF865640000-memory.dmp

Filesize
192KB

Download
memory/2104-1969-0x00007FF8656A0000-0x00007FF8656A5000-memory.dmp

Filesize
20KB

Download
memory/2336-1955-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download
memory/2336-1889-0x0000000073230000-0x0000000073440000-memory.dmp

Filesize
2.1MB

Download
memory/2336-1825-0x0000000073230000-0x0000000073440000-memory.dmp

Filesize
2.1MB

Download
memory/2336-1824-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download
memory/3292-28-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/3292-5-0x0000010E8C2A0000-0x0000010E8C2C2000-memory.dmp

Filesize
136KB

Download
memory/3292-45-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/3292-4-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

Filesize
8KB

Download
memory/3292-2-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1-0x0000010E8A410000-0x0000010E8A4DE000-memory.dmp

Filesize
824KB

Download
memory/3292-0-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

Filesize
8KB

Download