meduza | hxxps://raw[.]githubusercontent[.]com/obiiyeuem/vthangsitink/main/BananaHub[.]lua

Analysis

max time kernel
454s
max time network
455s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://raw.githubusercontent.com/obiiyeuem/vthangsitink/main/BananaHub.lua

Score

10^/10

meduza discovery evasion persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

meduza

109.107.181.162

Attributes

anti_dbg
true
anti_vm
true
build_name
6
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/6080-1439-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/6080-1440-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/1740-1453-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/5280-1455-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/4260-1468-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/404-1470-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza

Meduza family
meduza
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 21 IoCs

pid	Process
448	RobloxPlayerInstaller.exe
3116	RobloxPlayerInstaller.exe
3984	RobloxPlayerInstaller.exe
5280	MicrosoftEdgeWebview2Setup.exe
2736	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
3136	MicrosoftEdgeUpdate.exe
4196	MicrosoftEdgeUpdateComRegisterShell64.exe
2860	MicrosoftEdgeUpdateComRegisterShell64.exe
5064	MicrosoftEdgeUpdateComRegisterShell64.exe
2996	MicrosoftEdgeUpdate.exe
6068	MicrosoftEdgeUpdate.exe
5712	MicrosoftEdgeUpdate.exe
5720	MicrosoftEdgeUpdate.exe
228	MicrosoftEdge_X64_131.0.2903.112.exe
2932	setup.exe
1508	setup.exe
3156	MicrosoftEdgeUpdate.exe
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Loads dropped DLL 19 IoCs

pid	Process
2736	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
3136	MicrosoftEdgeUpdate.exe
4196	MicrosoftEdgeUpdateComRegisterShell64.exe
3136	MicrosoftEdgeUpdate.exe
2860	MicrosoftEdgeUpdateComRegisterShell64.exe
3136	MicrosoftEdgeUpdate.exe
5064	MicrosoftEdgeUpdateComRegisterShell64.exe
3136	MicrosoftEdgeUpdate.exe
2996	MicrosoftEdgeUpdate.exe
6068	MicrosoftEdgeUpdate.exe
5712	MicrosoftEdgeUpdate.exe
5712	MicrosoftEdgeUpdate.exe
6068	MicrosoftEdgeUpdate.exe
5720	MicrosoftEdgeUpdate.exe
3156	MicrosoftEdgeUpdate.exe
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
211	camo.githubusercontent.com
8	raw.githubusercontent.com
11	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WF.msc	mmc.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 54 IoCs

pid	Process
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 6080	5080	setup7.0.exe	137
PID 4660 set thread context of 1740	4660	setup7.0.exe	139
PID 5408 set thread context of 5280	5408	setup7.0.exe	141
PID 4192 set thread context of 4260	4192	setup7.0.exe	149
PID 2920 set thread context of 404	2920	setup7.0.exe	151
PID 1292 set thread context of 3652	1292	setup7.0.exe	191
PID 1708 set thread context of 5944	1708	setup7.0.exe	193
PID 5788 set thread context of 3880	5788	setup7.0.exe	195
PID 2872 set thread context of 3020	2872	setup7.0.exe	197
PID 2160 set thread context of 928	2160	setup7.0.exe	199

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\VoiceChat\SpeakerNew\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\PlayStationController\ButtonL2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\avatar\heads\headJ.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\AnimationEditor\ic-checkbox-off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\MaterialGenerator\Copy_16x16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\RoactStudioWidgets\toggle_off_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\Ubuntu-Italic.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\9SliceEditor\Dragger2OutlinedRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\CompositorDebugger\clear.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\scroll-middle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\avatar\scripts\CompositorAnimate\v1betaRC2\Animate.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\Sarpanch-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\SourceSansPro-Semibold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\bg.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\msedge_100_percent.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\DesignSystem\DpadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\PlayStationController\PS4\ButtonOptions.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaApp\graphic\profilemask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\9SliceEditor\Dragger2OutlinedLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\MaterialManager\Show_in_Explorer.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\RoactStudioWidgets\slider_handle_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_12.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\R15Migrator\start-page-anim.mp4	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioUIEditor\icon_rotate5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\AvatarCompatibilityPreviewer\publish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\DeveloperFramework\PageNavigation\button_control_previous.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\wns_push_client.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\TagEditor\Insert.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Settings\Radial\Menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaChat\graphic\gr-overlay-shadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\ka.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\RobotoCondensed-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\CompositorDebugger\clip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Menu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Emotes\Large\SegmentedCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\LuckiestGuy-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\AssetImport\btn_light_resetcam_28x28.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\AvatarEditorImages\circle_gray4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\TerrainEditor\mesa.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\ResetIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\NotoSansThaiUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\AvatarCompatibilityPreviewer\bg_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Edge.dat	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioSharedUI\spawn_withbg_24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\vcruntime140_1.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaApp\graphic\gradient_0_100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\R15Migrator\Icon_CharacterConversionTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\api-ms-win-crt-math-l1-1-0.dll	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2996	MicrosoftEdgeUpdate.exe
5720	MicrosoftEdgeUpdate.exe
3156	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 305765.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
740	msedge.exe
740	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
6116	msedge.exe
5156	msedge.exe
5156	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
3488	msedge.exe
3488	msedge.exe
4496	msedge.exe
4496	msedge.exe
448	RobloxPlayerInstaller.exe
448	RobloxPlayerInstaller.exe
2736	MicrosoftEdgeUpdate.exe
2736	MicrosoftEdgeUpdate.exe
2736	MicrosoftEdgeUpdate.exe
2736	MicrosoftEdgeUpdate.exe
2736	MicrosoftEdgeUpdate.exe
2736	MicrosoftEdgeUpdate.exe
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5796	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	setup7.0.exe
Token: SeImpersonatePrivilege	6080	setup7.0.exe
Token: SeDebugPrivilege	1740	setup7.0.exe
Token: SeImpersonatePrivilege	1740	setup7.0.exe
Token: SeDebugPrivilege	5280	setup7.0.exe
Token: SeImpersonatePrivilege	5280	setup7.0.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe
Token: 33	5796	mmc.exe
Token: SeIncBasePriorityPrivilege	5796	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5796	mmc.exe
5796	mmc.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
3908	RobloxPlayerBeta.exe
5728	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4472	740	msedge.exe	85
PID 740 wrote to memory of 4472	740	msedge.exe	85
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 2868	740	msedge.exe	86
PID 740 wrote to memory of 3720	740	msedge.exe	87
PID 740 wrote to memory of 3720	740	msedge.exe	87
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88
PID 740 wrote to memory of 3508	740	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/obiiyeuem/vthangsitink/main/BananaHub.lua
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbcb646f8,0x7ffbbcb64708,0x7ffbbcb64718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- - C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5280
  - - C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2736
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4196
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2860
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTNFQzQ0QkEtMDM0Ny00MTdDLUFBNTctRUM1NTA4MzkyMkVGfSIgdXNlcmlkPSJ7QjVBNkJERUItQzczOC00RENCLThEMUEtRDUzQ0Q5QUZFNjVBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFQTBDMkVBOS01NTM3LTRFODktOUZGMy1GNzI1MDg0N0RCQkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDcxNDUzMTgxIiBpbnN0YWxsX3RpbWVfbXM9IjY5NyIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2996
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{13EC44BA-0347-417C-AA57-EC55083922EF}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6068
- - C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 448
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:3908
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:3116
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15232829437587120736,8010691488098586427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:pB54gjqeQOLdpYejYPxWtjdEUYvOYMvXQ8BSAJuAML_y8OFIl5LFICLCElX8fbYhvnJjx5B-z25SsxEycPk8DT8At0m8UhcaM93OyGVpnb3-EoqzVw1Pi09pIqANWjq6IjNBtmI07ULiHe5Gc-e42Iuv4jl9daiDmRHGCUOC-WcTsC7LT3bukGkvd1m_YiNjInDNTSK6MAUZVyzHYIl0Fz76vga2GCHPBkE52Bbt8jo+launchtime:1735089892731+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1735089508949001%26placeId%3D2753915549%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D9874ff70-2a46-4082-9316-ac3ae72f31a5%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1735089508949001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5548

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5080
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6080

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4660
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5408
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5280

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5796

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4192
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:4260

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2920
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:404

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5712
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTNFQzQ0QkEtMDM0Ny00MTdDLUFBNTctRUM1NTA4MzkyMkVGfSIgdXNlcmlkPSJ7QjVBNkJERUItQzczOC00RENCLThEMUEtRDUzQ0Q5QUZFNjVBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGNEE0MDBGMS1COTc1LTRBMDItQjZBQi1GM0I4RTNGMDQxMUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0NzY5NjMyOTYiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5720
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\MicrosoftEdge_X64_131.0.2903.112.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:228
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\EDGEMITMP_F4BC9.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\EDGEMITMP_F4BC9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2932
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\EDGEMITMP_F4BC9.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\EDGEMITMP_F4BC9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.205 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECDBD342-C3D6-40CF-8817-9DE61BF47592}\EDGEMITMP_F4BC9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.112 --initial-client-data=0x21c,0x220,0x224,0xe8,0x228,0x7ff69ecc2918,0x7ff69ecc2924,0x7ff69ecc2930
      4⤵
      Executes dropped EXE
      PID:1508
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTNFQzQ0QkEtMDM0Ny00MTdDLUFBNTctRUM1NTA4MzkyMkVGfSIgdXNlcmlkPSJ7QjVBNkJERUItQzczOC00RENCLThEMUEtRDUzQ0Q5QUZFNjVBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDODAwNkM0My05ODU5LTQ4MjktQkM1Ri0xMEY5NzI3MENFMUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy4xMTIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0OTEwODMzMjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDkxMTUzMzA2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzcyMDgxMzIyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2Q5Y2Q5M2MtMWQ1ZS00NDliLTlhZDctZjFlOGQ2YjkwNTA5P1AxPTE3MzU2OTQ1NzgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9S0R0UnhoRDU0andQTm4xQ3dIR1k3dldIbUIyMzFZdGNKWVBpTVl4RU1IR3MyaGFteGprTXo1TUE5Nmd1M2dmRVdSSlFYYmVHQjdkYWl0JTJmSHIlMmZTQkNnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2ODcwOTc2IiB0b3RhbD0iMTc2ODcwOTc2IiBkb3dubG9hZF90aW1lX21zPSIxNjExNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3MjA4OTMxNjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzM2OTUzNTEwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4Mzc0NjYzMTczIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODU0IiBkb3dubG9hZF90aW1lX21zPSIyMjk1OSIgZG93bmxvYWRlZD0iMTc2ODcwOTc2IiB0b3RhbD0iMTc2ODcwOTc2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2Mzc2OCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3156

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1292
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:3652

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1708
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:5944

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5788
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:3880

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2872
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:3020

C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
"C:\Users\Admin\Desktop\setup7.0\setup7.0.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2160
- C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  C:\Users\Admin\Desktop\setup7.0\setup7.0.exe
  2⤵
  PID:928

C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Installer\setup.exe

Filesize
6.6MB

MD5
f0dc48bc6e1b1a2b0b15c769d4c01835

SHA1
66c1ba4912ae18b18e2ae33830a6ba0939bb9ef1

SHA256
7ada85f31a3b501eaecd2aa37b8df1f74b470b355279b5db2d1fbc0bb7de4889

SHA512
d2ceeaf987446f7463e84a6286dc1c8f50a80466af641f77d174826189ff5a56b048e616ad8d97ddb12a2f68e182af80309be717367224605c06dcf74a84cc0f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB2F1.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.1MB

MD5
dc0a0de94ad86e22785e385a4fbbfe2f

SHA1
8dcd6f06fba142018f9e5083d79eac31ed2353d7

SHA256
a4e80eba29eec1e534950f605de2bba0a174e9eaf56c82fd6f4d221e93667f92

SHA512
39582cda82f479e5e25fc2021878d071261b71efbb68f827599d4020de61698273a2cde3d1dc323d14205615a509687ad1e04f1e25626c0826c6f297f5a75dce

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
bb35402e9a8bb1f93b7ae470bce7ab37

SHA1
0bd432540608333e9a88d167e3a9b2f6476b69da

SHA256
d43c3c2ec4d68affcb812f83b05996650893e4c0219929debd0035a07a4150ba

SHA512
8457da01bb82e64108aab7001736bdd6641b7a64b2923637e66e184849ae0546f49303311057ccaff7d74982662679d00154b35ff2f66372d81398ad4e8e5ab5

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
89KB

MD5
9e436fabe1700722783b0d9e52ca563f

SHA1
d1f0947ba88e605f8cedf981131fb3c2eea6b1d7

SHA256
9a03ae28a47f4e1cf0d8e281b21c92417fb2b947d44069b0d6bd20c634899676

SHA512
df4a0327884c65c45396e62d23eb2fb257669c6cf3eda5749379c3875ef4da8db7fdb0edb8f48481d98de7bb0513fddf4fb65a602dca6cabd9aacb6d95eaa291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\044e1563-6c68-4b33-a11f-897b8bba14b5.tmp

Filesize
1KB

MD5
a7724f6f2bc63629d86ee82c46995ee0

SHA1
23518b7a07606365051bd2e7692fbf1fa1985f06

SHA256
75e6144b8014d716f46e7a01d6240868769285a1e04b9d54d43a7037a1e6804d

SHA512
72eff8008c8afedfb5a001be2bb5163944b10177d1a4f559b3c3c819173c7ce7ff7bbc819971033ef7855cc86b5781c9d36c9a09964bf64868d5122be4bb07c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dc21ae8-afab-4027-a7b3-8db14902121c.tmp

Filesize
4KB

MD5
a1f94c20d297807d31d07753e8e6d004

SHA1
40e0d3d8ab88ec7d175c8d3127da9a4629fd4283

SHA256
4bfd6903979d85d0542b61d507e2bad492392eee46c00a622cb6582a4e680199

SHA512
7ae030e35c8f5f8e7f0b7b7fb392f29ce824b1edad899691b13d7a6f01d43bc2be8982b6bbeb11de3e6004d26b6efca8ad23e7dbfb6bea06862a6d3f5e53d7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
127KB

MD5
72b2a2abfddab75fedec5e995783b93b

SHA1
77c2bac8a3b2c0dbd4035e738c60bd9252a7cbf3

SHA256
fc41e56da63243f51b49f8d6674c91ec6f13464cf4f78a0694b9252adefda47e

SHA512
9486ed556a34c7883c9ed062ea4fe526777a967fb6b575e6dcbfc0d8ff9cec31348da3bdf05c2db066cb011b69fba974597b4063acfa867699ee4e78e670eb37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00011c

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
5cc675a009fbf510f300449b2db005c9

SHA1
da73daeb4091c91daa93ed7b2fbb1562c1b6b302

SHA256
61a5552377873f1ebc60d0640fe6ba0e36481a2e72df88f6bb6aa4d02bff9662

SHA512
4d2a6038e1c2cd5d86d56d5aa058f8219aa53a9ccb093b0a3052a0cce83c1d27306e7e911d2b7057189e5c63a43c2180e932bd73855ddafe8f240cdb8cae1acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
71e455229032abe08e2a7be559378c3b

SHA1
2958e122885258e1909c5cb4ad8a621f65d3b4ae

SHA256
a450779a2940b49161f43949fde29ff1eb42f5fb8a6f6c792bf0ba5123026197

SHA512
fb4324eb7dbd0a72400270c422d582d9f23b05841b42a28384fc5f3f42a392f40243d44188516e6a74733785d1b43f071f425c5a8a75299f10e48278011b2bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cb170ea609b16269bee08ba662012f46

SHA1
0031800e7a7647ae7a1c276b463519c20f0dbdc0

SHA256
fad73070a4a07da93f7046eccbbdd057872502e45a94039c12834a7a7ab60155

SHA512
0392c8a8bcbea76677c592cebb2e3cbe1f07eeb9662d75a1059c7d249ceeeb82149bbb9816b92cc76cff28c63ac3f93b266b78b645614041cc69eb117f3951a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c1a3429eb378fa6c770e3aea2e9242e7

SHA1
b8ac2d033a217db84e12ca4d02e29f0338f98ca3

SHA256
48c96627e87b0fb4966cbbd88f3ed28cb301ee1c5ebd5a064e42995a1274f2d6

SHA512
fcdef82af22966823b841861439c153b27913e2f03f480e30c9d7e32e21e0f67d53a320123f7bc285666adbb9f49ed4d766e317227145d3e8135616ec9852587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
fe8471f7fba0768a07fdfda832252a8d

SHA1
5fa55d5d0ca318b4116f5e0a4b1bf42632ae5dd3

SHA256
b5a7f1565136e96197b14d1ac0dfe78cf79e730423fa95e47ddf25c053b9a6f8

SHA512
97e595b484d57473ad85b81dd7669e8c782209b3744425c94b18b1ba4495134d9b59018c56efb96ce7ab10fa0924da769603d412a1115a37b1c66313426355f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
6ff5a34cecae94c443db90de5fca7557

SHA1
3f17cdc25fa11017cac130db07b92397dec8a851

SHA256
096678b6ca7f669e9ba4ae1558cc57bc2b655225fef7789a55ea2d8d37d1c196

SHA512
18500705091f6fa75853bba7923ac0b8519daca71c17ed14790071f5cf07062974d39ed236a673e2ac634186c56ddb6a1957e17cd0a9b7eb42ec878663b43781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
21ec13379ff057ef7c2c14b53cda8167

SHA1
78f7a4e020e78228c2b11d0989ca313584ce8e8a

SHA256
a022d835e8bd28c66679e15e32c231cdcc955ee842f4cdf99c654ea3d6bcdaaf

SHA512
8709ac5d1e631eda1aa6f0d334e26056b3768a061a8ba0d6685b2da1c91928cd5f323f4f9339f204189b3590aff2511ff468f46eeadf11de00b4a6536a9356e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
910d3b460c30f841078ad5b5e54b4d77

SHA1
baff216eb1d8f3e5cbc28f3eff0a803797065da1

SHA256
0488d95a2405148f459db0aa118f8c074559fff18b8c377e2ca769823010678f

SHA512
18e296509f793c0cb6acba09061ce5d19445b8a34d2d6a05249a060e60fdc02201c857d54dbfcef66610eed8465017fa90298510897f8e3868beebf1b4c1fef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
cbd4452d0891ae0929d8e4078c21fe64

SHA1
14bc16c9fd64a9d86e67ead1fe1d671180fdb812

SHA256
c77d9a9c7bd1c8b5a5f8448736789c2b44370815e45a0255ce718df22f5f861b

SHA512
fca5def42a9aa8a3ee31e8fd4e48d06abb7c0c2e691d39ea7a7da14a9b271df97b473914bbbb17f81b3a17791de530c34e65f9ef74e7cbc85cb1f64a0acde3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
c18888b280760a72305b515ed86f6444

SHA1
2db00e0be3a14825511734601b07e201501127b3

SHA256
e2a3baac2a1cf5c4d55a3950776aebb4418a1ecf9a183753a278f567b87614c4

SHA512
85c25db936376aa15703108c06be94f7a145ad1632e3550eb93b86d292303a6daa953cdbb063b6511b9156a8f8aef56d8acb06824ec237cfb996164b80b29773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
872fdf5958008e017f50edb77983b401

SHA1
ea8463ad309d17d189ed6fd7214dbb8e9f0b5f61

SHA256
9fbec8379eb84e6d083c87c6d43c25e7f84569ff4cb726bd131a611e44f6cf43

SHA512
162ff90a8e424ee1640ba7d680e50ea55e9594504f7b93d676436c7f738af0cfdaefcbbad4ac1c0c201b497df0121eefb2b9a31fba3671e5ca2dea1def210ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
4f15d27d0691dc4a091bf93d0738a90c

SHA1
897f88a17d5ba2d1d776619ae9808875496a2df3

SHA256
d186b7f595e8748103a776b0729946156a181c1cf613cfee3197972e19428430

SHA512
352c84542e3735fa71ded367d5d1c07dfadf9c98279132a88730b9e5298ba7db80afc6add02f283be1d382ca9a450e87a921cf2bba15cdbc9a5fcb8fdaec5da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5af07c.TMP

Filesize
675B

MD5
74a0c7483acf20cf6bf083d1f137320c

SHA1
f7108241b7867a0c344edf09b053e2997a80b84b

SHA256
d76550e4b9049ef6aaca1558f883e13475c60a2015a89e4e67f1a3a312f314c1

SHA512
2c4ae12485fc03c0177566795c262c9b8bbdbfebccfc465790a56493f1b9f5a6a815895f4d80aeccb2e13a5dea6a8622644125d14b861e7d0ccd634d7f4a981b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
74f752ced0b902d52b72134b3450cbcb

SHA1
860ac667267a263c07a98b84de2627eba371ebef

SHA256
05478ce604907f1243fae143c11ee499ba8fd6e643f88b15b5f1f9d240ad08eb

SHA512
b16041aa044b32ac0b5658c8b740e0ca030f2b7041562473cc4770bb342399d8b6c2d64342d1b72aa78f6ca76a9586840a8274e98abed75a52bab4ab802e7661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
187faa803299e7adefbb3c2687db7611

SHA1
7e09d92bcf510e187739cb7e0d0366fc153f5d47

SHA256
a19b28437995024a6e43235008d9357ff1e78a607061133132bd1373db6b4a31

SHA512
959d076fc20a37480612fc738b989e41ee25dc2956c1478b3d1864d7d3b345ee2943cc5b679db30b038092609811557fc746fb4fdb590e426f648a6776ec20c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3cbd2413fec11c5ee50efcc04f127f41

SHA1
c783fc789e9900963a2287ab4e62885dd83e0662

SHA256
ea132fbe95fb63587adb2916777ac8e83eede5a1684b1c373ae418893139917a

SHA512
fea129887a57aac2fd048e9165369668ab983ca3b5f16dcf10e47f64ead302f17e37914346fde6da183f92923331fa352d01433e4f1d3bef25f72419dec9b1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
35fa63cb3887255154a805a73a30ee87

SHA1
a387501f087f60625ab7d6c6dc60b1e793f0ee40

SHA256
48c8a9443923468b8272ee07073502dcfe439ed69e97da5a9ebdd41d7db1e630

SHA512
fee51e0ea2a00f1234942875fa4ef070c9bfaa9de1dd31aff9c655e5ef764ee71e2989efa282286a280655045b43a0aa74eae384a5d6cb8dcad3ea1ac6534c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
36f47cdaf2daa8756f043887b24db0e7

SHA1
f49428e1716088289665c9b12b29de9b17fb8a52

SHA256
37950bd0cff4e11c597b230858ef17a5d4b59665325a46ef2684a8e1f096ea68

SHA512
278ba8535a1d70f07af93961c7ba31f788052f2cb076ba9c28dbfd698f38b3a3b40a9e2dd6ca0a57d28d7ee926a2adb58e3f02c3ad003a2c358174cd9892047c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b7a9af6b3694a08a8f38dd7eb3fc91a5

SHA1
29803cf5f43647e8759ede5e6fd5128a5d360d76

SHA256
3e6a78dc846e7bda2b5179d38c50a451bfd36a501fdebe8541e8906258526186

SHA512
1316285e16158f6b4e1cf3dcb5077a7c2ddb48a75a9972168974e087bdefc44994631254adb4a5043b534ef09bd39957a284a3a688567c2a18d98994ff4b7496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
512f64eceebd72b1afc43af4535a042b

SHA1
80dd7398542f2ba50b86a19ec3e22c46c00cfbe2

SHA256
ecd2cbd4bce2de522ebe6c77e40495375c638faf5626d8a9b405c61f6c74711f

SHA512
291432abf685896a06362faff94b7c23a6d84d0cd6ddb0d7a9ed47d39652b3a889cc8ff835d62ab0fbdecc6954d224ba65b9f3857f0bb86a3708f660f4a33e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4e94eb1d25fbad794fa0c9669e30b8f2

SHA1
7f7108c1e76a1d0feade505d5778c0057563d923

SHA256
56552b6d06369e344fcdaf062d1113a72e130b37dae0f492caee4d76c49fd8b2

SHA512
354f78595a4b08f0872bfb8ade632f58c329f249627b08b7aaf92e9b039856f871fab50a321b8e33c848985a6e42af5b3fe06366dc1c46334c106a4f335d809a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6f50cb41286287d6ce8bcf149212bb45

SHA1
a161396fc89507e76a58d7221a584a664d888bcf

SHA256
372224fdb8fe1a7fb679d9574cf1fb2ab830dc0667d3c48aafa11c9d6c868e90

SHA512
c48032be15462f71424a78c554f7fafb26a24eb7692471b15c9341f8d68acedf5103d012ed7ffe69e152550cbc107159a30b8819b25e1f4aa472adbd8a9f901e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ff70a08edbcd17db20b7350b3dd659d1

SHA1
10534e7d5be6843bfdea913b145e53cc95bf1ac8

SHA256
f83b91416b647c0a4ed55de0e37988dd4943dfae432cf0e94b47d214cdf0aee2

SHA512
9bc27cb471a8946dc727b9c72cd0c1380c836c7caccb12d2824ec104b78f3132c5a48632cb52984aa9e8d4bfcd49e5e2c488e9ab99d0555b9821fb9b5d93e556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c136c9ba6971b5bfd20c952f8c173e7

SHA1
5f280a87d44bea08b98489641f263316f024c577

SHA256
cc29fa2e42c426574b316147eb8d88a7b6b8d04ab0bdcdc4f2eefc6c052c6e2a

SHA512
696b80bee1755b51d84eb6c2d17291d067bef9989ef8590c7cf3ef6b9d1371a49de5c92b0c1b9333d465a5233846b4e61d10fdc2419292f4aaabaca155302b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
29f9231b047f1f8c34079dd490a79abe

SHA1
174d1633008ffafc5a9892f5e569cc1f992ae99e

SHA256
9282e794d02871902d890c1807ebbab88ae8545e81e72429bb764023b2b4fe09

SHA512
6c38c5311e44ea4c8e62a336b06c98791f261ac3483e2c22cb1d1e956dfb31e6ce8ac112ce4065c2b465716c0dd7744ffcac8c48527d33428ca90e11a430da60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1d8726ad1cceb53f9562e3688ddbddb3

SHA1
0e0ebfe3363a78a3f55815303ddc3b217cf23da6

SHA256
c59df08da7d88f3bccf5cf044247fef48b6ecccbd0cd5fdb5c724ed734a75698

SHA512
e005ce1c498d1bbb37cab1a924474e30e8af2fb9f34cb83a8b71605949c6105d0b09cebb2161398ae706d18d58a09cfa0e58ec00ef5af44c360b2b7a5f0c4049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f8ac97b714403a027a6583d32769b291

SHA1
5de3a51bd1cba93c98a1d00072efc0265bf6436e

SHA256
958bab0f2d4997037133fd84469c614a99406a606ab5a4594df12eab77b6d7a8

SHA512
cdd210d762f62caef71810053dd1f03b902d30e3a1ad8ec552bfa1aaef02d218e8b1fe58196ca1acbe60d5a41d12b08072d2055dd8e5020a89be5826aaf703d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1db17e9a5a1b6b38aa114064f8b0be48

SHA1
d0c6164edfdd9189acd4fec6d861c96eda5fb358

SHA256
e2464518f8b1fea0e5d9442261f66c288b5f726e4efae6203107a75883d86076

SHA512
aeb11b1aa17d84a64faa2f6245db04f5975d3cb392dd77050fc1be41773dee27b0968cafa5469105171798e7f476ac0d41ee4eaab4c98364c642d3dd8e2fa094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f7a213cb9cbd461a2dbe598e74aa6286

SHA1
c5b8f8ba1d6f24b49807fec31076e6426ca45f4b

SHA256
5f790ff0d3c2b0624b743f9c8dfd7c93882ebb3b845fe6d5a021bf8dafe44956

SHA512
57d14ff0d57b7ede10fa8e35e78d32c92c2930e7a40f4e1fac4807862da147620a3425a25a2203de8b5640441b4cd5fad330b7a79af66ca80d1d4e547e6082c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f24455563393748096db783fad49009a

SHA1
eb9d8cf9b74af2e30f63f4ac1f7a728058aaed9e

SHA256
b7b0bec31a1ea31d8b922fc93d699b2ab3194735bd8d847146e0474b25d96aac

SHA512
374184158e51ea9cbb540df29818d45c6d45f6cdfdb6a453cd191a3a939fc7ef4d58ac94d4e2caf2257070d505da0dd873282c137082a3416bad299a61e096ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c58b72ac06d4115a08075f7271db38d7

SHA1
42867f65c42d8c33e38d74c83b6cb6743c441003

SHA256
3b4992703912e32e4c3956643bcd01e6449ea3d725799e27a91aff4d1ac2fb22

SHA512
c0d6298bda6f26b682e79d22a78925629be36c1662b19a9917a1a7278dd0022deec1e7c934bc488ca4ac6cf2cc6d683e2373ed278c8d9e04bdde9fc5bb8f9fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cee50b4ca7fa82053b93f0613738e824

SHA1
3f0bd7fccc44e84997f9f731a8b4f3f2f57ed6a4

SHA256
c65aaa06a04a47a734c752294fec6e2d33dfdec65280330933b56fea7afcba3b

SHA512
2ff6e0342b8f625226ff062e7e1c8959c59e703654034ab48f4ad971df7d3afd7f5016d04c52616fd3fb251921969f8f9c9d80c46405c125cd1d9e257259586b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
93f7ed762356987b1a88b9de3019cb05

SHA1
490d62f2029de1ba1dbd6a5b882a8267859af202

SHA256
e5a4188d31778b141e440ca73ddd4e87459f9bdb2015699f26079f8909174aa2

SHA512
9f2cf4d280da4679138b951e391784b53275a223f30711a80dbfd4d1baf228cba60c272708b53f5be51a57d55dac36c13b4bf2a23a433617d31a461e0da22b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bb248f137ba29caf91de5bc0654b2712

SHA1
6f7563b30dc8a68c6aa8a2edd74092dfc829b726

SHA256
acf6e80903b22a68e91d2eff76c1e6974d42e008cf837513f37fc51537898898

SHA512
dd56eef0f8dd71d206541c725d4227bfe145340abbdcd4432ef94266d925cb28bae73b3c1264d756819365936faf5ae32b684db4c8a516c8f5e92d14080a6ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
79c5f5c43d91130e25e7557b1cece727

SHA1
4d609730919cd40dbf8f042bfc50bbe827ca73c2

SHA256
eb667bd996a1368f72411a285c12bbbf4b8211a11714a5b77e79411c0b439934

SHA512
7d06bc9b2e8b982f56e09ae4ab21de5c96ef9986d04f862f7aa183b87ae394fed0985e3327c51ce4c327f393c30e337c0ee427611d2c9348d293bec4e79f321a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
445a78625e370a60ad4fe855952028cd

SHA1
52e13bdb832f28c6fd8d8de1d2b8070d5631a01a

SHA256
bf361fba97d42592670fff1885a22b292eb95dae6de542acfd9d87c2984d0f30

SHA512
587485236ea05b34051b1683d2ec4b706f900bb2608d57654ee228da1276b66c9f54bb05c2c2d15f127e276cda63d4f8eacce5cb7191f8f4719c96eac470e6b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
12ddcd958ee1d514dc30c7bc2e6547e2

SHA1
d5a78153328ea61952fcf6aba273f2d10bff039e

SHA256
dbd170383ee2438e6398611299e940df89cb8e91e3e7a1dbb96c0ac97274273f

SHA512
9b5e333400ac8f3a505acd11824eeec9575cb78d99a2ab4a7bca67e0b682a67f9e8f224b2708661b92d98115b211e5abf6d27237613e76104eec2b3f9405bdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
dcee289b148079d42d93a32ed202893e

SHA1
0ab4659b979a98b00c3e09bd670c82618776c0bb

SHA256
83b5aa3103c24bfbf9d66130ffe508afcfe31756c2fea33a23002eac5f498a40

SHA512
20f93ba8e29f975b29e84b71f0739c2c5ba7411902023a9bbc332b77563e667ec98be428d9b164f42b3cd3f232ae37ef0781f5cb5eb74f14551df1a3ee51f228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
da8f03979527ad3d2b5ed482d9463cd5

SHA1
10d833bab45e15fefab12cd79aa36d45c565a783

SHA256
749502024cee9d6325995b0267780f7c8501f55e8c4a51bb38e252d2cc849b94

SHA512
dbd41222991622ea37cdefa47d67350745151baaa3fdf6a4aa47b1872230d5c15fbd93b364714dbd5df15bda5044aa4234125dfbdc1a010f8c0592f7412bc8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9c16986f4f3ecae6f0d47acf0658454e

SHA1
674aca51b420e668d870257ba44b0161ea7164e0

SHA256
137403b4cd860e4c531794ce3d426a02f2a0b9d8407a1f63fa6178c7243156fd

SHA512
4d833df99feec59a6df408dbc76b4236910abfd63524d79233a1bf4c56fd99db135909541672e1dff0a38459044565270d8cf1af049fb711c8efd81782ecaa95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3a0f52fcea533afaa549eb7a3d952784

SHA1
6e42c77714ddc9a970454ebe623576a8b3b32fbd

SHA256
ccccb348d12991842ad9cf233f56045c2b442af04b586edcb6d8db18e6f3088c

SHA512
05d771fbeb8742d05df00a074f67c8875930df292ca52e783bca23f13c9983b1ca8b58bac52af58e43df286758d8922b496d5e0ab544b18f711c48c59e2f0d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
96c7c9b117b015d41c53de8f4bbee2d8

SHA1
40de810b45f8f4ab8e466fb29d5158d870718921

SHA256
fba99676de40dbc54710c7c977220d45251c29a6b4ef528132a6af3abde333f4

SHA512
a47c4edfdd669d11ca9416a73e4c067fdf3b2248f0182d805969f14be7a6edcfd054b133ed1275f9add040582779c0af25b2c705b26d6a0bf3b16c6ebe8e234c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1480bad37a9ca51d4b4cd28baf89c4ea

SHA1
20517a314e36cc76d5ae0a99b6db108283e28a1d

SHA256
cde6eb1402defd58934aff3d8f8eab5898c8f9b1508fad50de209b39d8a4c697

SHA512
ca7424739a1e9fb5cf02f70f9a39cee3b8b9bd2614825a5865922f0867da950fe22a992c1244c7fb4b7cc358e08d64daaf7be66a0598a4c77f78e6a115142445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ec4f8f1e6ee3f8ea0465ea5da21fb61f

SHA1
5593af0c2c147d1b532f40e59214d278c2c6b36b

SHA256
33469a744281d3ab4f82aef9d3b0e109c2aad5cf2b68cbe97046b0e66c8e57ba

SHA512
aa19251bf162653ca1f8ff5406299cccab3936aebd8645ad733d9376a8be2752eb5efc728d5fdd0257839cbf7497c4fe1fcbd796ad476411c649b28b36b7f1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bbb6ff81ab1b6bdd4f46002808bc8b97

SHA1
21fd7cc1fd2cbebab0a27c4b876623463e1e872b

SHA256
41f81f05879a17e09b07c73b121160ebaec948665b4c644b0aee8c9d58f96129

SHA512
67c5926e6364dde23e94298397a61d71d39887da86e2f118a46292ee75148df1a92129faf6ca80a02abcad1c73323cfdc1ab7d3c95410be2c29b7ac436fd689b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
469219374dd3a22d3e6d727b3d648e63

SHA1
c25bb7087223dd46e2662f0a562d140c26ed95ce

SHA256
d908e40525c15b5287c2bd2749b109a0c427c6a235bddec407116bc18f812592

SHA512
b6d84e1f69d15b9c68d4f7639344423217b968b07ae18037aa7d9d22aa76b0352323f7c37fc016cda51bd3eb9b23ec8ca3f8f0e64eba0ceb7dae4565530ef14f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0a47a8e160e984ace8a3d2f0d751c279

SHA1
17867069b14fd6c90c602895ad27a5ebe3f0e9fa

SHA256
b67d0ff6b324f522c4af63d731859bdac3c17d875e96acba3125bb81cd620bb0

SHA512
d35631df926892b220d3208bd60099aaec585c760f1b5f7f796c25a82e018ad669a49575e1f960331683e00848091d074fbce6053490a45b5f5f4b0fa5525bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
56ceb3f2adf04c7cf7bbb35e15271495

SHA1
ae9757b78e5ffaaedd4160466dab1510d948038c

SHA256
7fcf11f8312d8c4494686e44894de9597b6997dbd566022ddfcf423b1d54455c

SHA512
bea66f5903722af518b700f4ff35d9a55583f1bcdbc40ea91e983a031bdcce982b5644d3321238d469f4e493f715090b968367b5675954802c25fb5dd529c8da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
73c3a4e215d868ade5930c9aa5da26b0

SHA1
d16368e0f4783e3a3cc3968b310b3dfd132e9234

SHA256
f38878da6468711440f1f6e1cc6869ef051942effb03351b6414f34e89ccce9f

SHA512
d1210e84a73766abcef335660bef314b9dcb243ed28845ad865ea0992d2236c6781d0df55890617dfdc11e66cbb6e949129652982e60ae77f92f7ace60967d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
07e7e3968f92ace30db34f57c1c981d7

SHA1
b9eda9292dc0606b7671e3192136b81793d7986b

SHA256
b6fd411c2408c5ffa639cbe2759157cb671b6c7bb486e586a2790a69ef7b6ba3

SHA512
935d70feba3246301808740a8edfc0cee69383af7dfb07d9afe4ea166ede748dbd47eb945cb49dd7643b456ae3e072b9e1ac1160c8920861698812998fe181aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
805c956c146a7db3a51b89760903051f

SHA1
6dfc5759214b68c7ee05057b5c1aad3139a9c0af

SHA256
15804f01ce97b2ed09092f939559cd0df4006cd8f14181b66c653c43308a3f7a

SHA512
bc0a6d6ff785c1f3869b24e0b52db0345e30281ed48d2217e8bd6abf277ac1f3810b9a17b84a831ab0fc1d072025a2f4ea902feceb547b43e9c585d71758a929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
f10541b1134deae4d9ae814958d2d3ba

SHA1
9ea2e8dda1cb80777902a12444ce60d401709ae2

SHA256
8de7ab99f5d84ee17f8f12b80b83bfe609a89f1a06993dc228324beb27343c1e

SHA512
9579d6d4351c2579ee0b70fc927f144be56f5a345bdd928a7112bff4b9b99e883f4f5858e0c247e903917c161ca573456cedc5e0a61020e85a2a88f3d91207d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a152f96d78ff6511ff0938b7207af69b

SHA1
e7d906730316679f42f87037182d6ad6ee41e7b6

SHA256
6c17aca6eb5c6127e8f03a7e5edb5ae03da1ea2246ad0abc0f9efaa911d79bea

SHA512
66ef98b78fabf6cb9eb9d88e723adc54288a5b594a888cd08684cbecb55a80ea71f03a564927ed1f78f968049ef5977a8153c0cace55df5eb775f6e8fab20611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d47b6718794e65fcd7af2e87edc6e12c

SHA1
5e68940ff4e01230b7a12d45fdffa9456643b068

SHA256
be93a2bc8bf0ff582288442a22c712f827f73b92f8af8eab86c430eb939ce57d

SHA512
ee7df374dd4762c36061f6e308380b7a8015a9e06590776b60bcf8d2e0e41873c6097096a59933baeedc85f3415a1602a1074862894f4cebf628ad6098a2c766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
6aff658fe3ad6b78357a0f4a8b66f497

SHA1
8f6e9fbc4e9d80a8453fde849a82eb34aee650dc

SHA256
e73485990434e11af26015f8eeb9ded1d3e7c9388e33a77549db2ef498f5c3a5

SHA512
339192534ac4c2c6041b4f59b5734b3fdff351f2c7514c8d30e14c5c776b9ba7078af550520a0ad8a5bccb52e9d4e6d740207a51b60cc46f8eb5b4954738ac5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8ac00d6c59365c060bfab8e5ed26e521

SHA1
a61febe44106f9999a4edd6177532909036bed3a

SHA256
2219c2d8217cd4f081f74d76b9ac714381a892143b184cd402ecea109dfa705a

SHA512
14d116865196052569e94042050f0314ae9285151bf74ef2bf9a5bfcc303924b5b2e75b082ee863aa2af13bce794df2f7350ba53776054e62792f06bf74fba3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
4700dc49143daa0fbd351fec4ce1823c

SHA1
ee569abf3ed7c39d05a92835956fcad4c2164694

SHA256
eaf805a3375ce6a335950a0effb6cdc8adad6cf02572db31ba2440172ef7c8cf

SHA512
d1a79bbcb58ef1841144d34b888b6e8d88805ff3c9400ce1e26b970ba39ce8c8d6abbd1ecfc0ebd2ed4cd3e60e3d9eda12680122b0f1ea12068a537fd5f85a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
f354f2ce5ceaefd219ee79e42b1b732b

SHA1
d186709befea359fc08c4d65c21d20c1e3e3d54c

SHA256
e06774e32d00aba43aa7a157d581f5d038ad0846205491c06f7efd87a5c03c8a

SHA512
d1e1c9a26a80aa054c283a2cd2d8da0d643a86500b61583e91641af77e268267e9240190dde31a010699edf341e82e2f649c96a70dfaf9bdfd939646bf733f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a307d621470e4e307ac91b0cd7603c98

SHA1
2f83e607570cf7eb3f28b4c545bf9ff2b6392646

SHA256
76466f74fd781283620463bc700589a6ecdadd4e523776a957dfbf5339e349fc

SHA512
cdb189eb52de983e5b1d0fbc2ebb49091aefb7f428670a6cca39d73e7537680f19f6d402f91a1952f8987652c7b85a3235a77152422d6aeb447721217008a972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
eccb6d513772e289d4030df7721ab750

SHA1
3b47d6d5077df1daa37c78d7af4f14cf0c89b544

SHA256
d8240a085020f1c15844ab3972bab562ae81b990b512216d50d022653947ae32

SHA512
1766784058f81148ab6d10cf658a2d49b0f785080e1079918274a8d3711b91111da79983edabc7b820aba612f92db22a60ff9c6534b1c94f40653993adea43de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6d605d7d06d9c209a1b14c25d4212175

SHA1
6cf9fd0a9fe74ce33f31202d2895c1096e2eeb41

SHA256
b735c4b6c8a83048b4a5b6000ff62eb0284791494e9eaf5b262159385606520d

SHA512
4bd7d8a86ee9f77293fe6b71c24b3542da96303cb4b2265813e916be121dab4da93937f4982b497fcff4e83ddb55c32550167fbc382a8acddd7d94592b050abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
81b5b807381cb5c148a7321664e825de

SHA1
111d664619624eb11ccd3fbc79fb433f35d58905

SHA256
d1e2684801add143ddd9e1fc7fac74c4a2583334c9df8fe5fd8aad69987c8223

SHA512
4da50bbdf88d4a1131b42fe6ef291bb618c86bf8e8e63237985c66b50e49930c26214a05e0b603c70c5e506349feda6552815b83acdbdcaf5269d73f3de5146c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bfa6.TMP

Filesize
204B

MD5
a1335710890ff5374cef5314c375cf20

SHA1
5c8cdf9f6124efa0af00f862a01349d851f32fb2

SHA256
bfdeb2fb0a67ea23e386e01c1108273f341893857a81e0373b9e2aaf4de5eeba

SHA512
0f49ac4600f6ce063a6baa9634acc3ae3ea6902d95c3d2e240ee6d0cb25c519df49a3924a9b5876655fb3314390b2e57d65fb8b0f1cffece769ed704f8a42417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\daf0ad79-9169-4766-a04e-a809478fafdb.tmp

Filesize
2KB

MD5
fbd4a53fa965bd237d5441f24f72e49b

SHA1
e1b8bf11d1c364a7963523aafe6190a8db859b53

SHA256
d5abbf3888c457505b9c3d5ca0a252739dd4fc714496cbe528ebccfe8c3217dc

SHA512
c4dc7fb1ec4cf62cf96369fd3927c9f4cefefc0bec9f9ae29e81f5769035f0d79a578fa0c0e163b0aee12fee154016ff9edbbb60e58df4b67033b21120181cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81d11b677dfaaf2ada91b7af8031257f

SHA1
ce08e01cc4b97f34989ed7f3d76b81b4d36a5632

SHA256
f0c46cd8a8f5a96c3090e2acbacda64f1632ec276ccbfdc2131a49f4cfc6d4e6

SHA512
bd0d92e63c2155374e4509c3aed7f9101516c57f676857f66a0cc81ca74c31cbcdc1e5986ef5f91c9e34b0b8372e945bbfa96f8305391452bfdf96c946c9390d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8b03c65fb07b23d85c6699be9ca30998

SHA1
cf52e52f7dc0222db3a46d891b2cec9215d95706

SHA256
d94b042d7fec026a82f660c78b0f03ef7618bd13927ada8d86b188e8903a1f7f

SHA512
ca6593f50dee73eaf18536a5803db5531e27a991f79be9163aad6af2f218e5a07d7e29f8e916c5bf0577585de0a148eda10ac57d737f37741cb09c7d3f774ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b5373ef58ef110c041e3bd39f370a20d

SHA1
c8afc1d953003edd05b865e63c1d62fb2e0ae8cb

SHA256
b95ff22f019d73eebe90abc668964c978baf8c8f28d7c12c26a53133bf9fd1ce

SHA512
ff127def1c6e8ae73f3017c302d7a7e361079ed1d208712a487ed878fa71a72c6f215c475891c601c3e6c8eed68f7fc3d27170ff2ad533492498d83778dbda85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4d3c8a33680f7b66d272f5119d5d0fa

SHA1
e19cd0a1c7c08e8c834d2710084c20de1731908d

SHA256
0d93021d732cf3ec70e7d7a3494794b54bf00ae360e36fe81aebbe02c903be30

SHA512
597fe00abfb60dd93e98904876a573794434d46fd48db5b9ef7027aa9ac0aeefd5482f783ed4165f254479042fa29ee33a8423def8e1d3a5505d91e4aa5c9b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
719d5bf8ae687e24d1da2f3cf9d71b08

SHA1
5136ae5ba8862dfd01b18e0b05ed403ac7db102c

SHA256
12818ed85f4a027df80376e29f35727a369123b5ccf1b79a0225785977587786

SHA512
14b95004a8a28a670d15f1e669280c6642300af332bd44a7f57a936b1848af61870a7a8ec5ac38c27200378358101bb2fa2e56adef28f352a11c5f2d88467488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19596153d5298992fbd75ea4eeb2ed78

SHA1
b09260bb92e6834f0e52b4d49807217d3d28ac65

SHA256
d1fb90134405fd0937be0f8b20b0eb1aea7893fba343f1d11d42e678d07a7714

SHA512
61635fcb32e83b905c505010e9086023c803fcd3b3a7f9f75365b41ae34f5031a2725deda59b00b9aa09da9a3e5c723fd737a51386d50b51c9a51e278079941b

Download Submit
C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem

Filesize
232KB

MD5
3548d8825b94ecf3cb6fc617e32e8989

SHA1
54edbb080d5505f03dff5bbf71efa31794d0e064

SHA256
5a03d0cf132b66659edcf43c087c4cb1b3647f341ace02dd84c693c804a0a5dd

SHA512
fc5a5d81a9d052701ddcbf62437a7c64813d22a842468fbaa530ff3a5541cbbf2270b885974627c468d6af217806e39ea20802e7a3b79ee76e9700fef56fa024

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
abef53850dd64f6e9297204d41da7d41

SHA1
577e64abafc1b9bb0497725c9dbce0edc1600668

SHA256
1890c489a74312d8d31612c59bb08e3a941fabb2f87d1ad5671529b970a7fdd4

SHA512
09a21450564550bd4742e6f7b74907d566e331285eef5e682a9191c9c8dff9c6b3819cb05946c3a32e3671d377041dfd2dbf6f327e96d8fb79f5d1e9fb6a22f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8aead0735957c6366baf2ec8cc4bb75a

SHA1
3be4856ca426bb99d2c99ac88559797bb86d0856

SHA256
23e8f9dab513af57e913640624e7349f325bf5620c33b98732a14b73bb92629d

SHA512
560aee738446ff1b425e2fae697d018b4175fa51fdf3a52c0f9a3bc5824b8c31e405988d5b2c60ee24a415d5508d535ada2b2343eae1925646fbdf8cb5e4011d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
fc5ef3bd913608b6224fe2e5156096e0

SHA1
367bae225343a82c852d6b1e1ae94d592ac0183f

SHA256
2fec2d59bb4659f21ac982c4e7c75ff72c3d6fac7d42addaa873531e7e3ac1fc

SHA512
0d0f7c6b940308ee3ad5eddbbcada69c7117749ed7d839f6959c2dcfd9643ee7c9fea99eed3590ddf5d3c08d1f7ce698adf1fb24f2e8442fade68514f1cbad88

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ac379c4de9af2f7cc09e9d9673f773d5

SHA1
aa803f6dacc627129a2184f3f76afb103283d919

SHA256
e5edca37a157daca04b3d9a511d17a9a8947a1add7b2fa0f53281f3c290ffd6c

SHA512
583daa6456ac695cce4f181dc81726bf266d520bf3e5fb717ebf6fd8d5ddeb6f5e9a503227e2b5a8955cea9d481865aa5c765440809bcf1c0d3ea3cf12aa4f3a

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
7.2MB

MD5
a1c0810b143c7d1197657b43f600ba6b

SHA1
b4aa66f5cdd4efc83d0478022d4454084d4bab1d

SHA256
30f233f41ec825806609fb60d87c8cb92a512b10f7e91cdbb4bf32cee18217ae

SHA512
8f45702da43526c04b957f571450a2b53f122b840fa6118a446972bc824c8ee7acd6e197177b54236ce7f428fb73a7cbe4ed18d643c625c9f156463d51ee038a

Download Submit
C:\Users\Admin\Downloads\Setup5.0.zip

Filesize
2.3MB

MD5
d7d4d1c2aa4cbda1118cd1a9ba8c8092

SHA1
0935cb34d76369f11ec09c1af2f0320699687bec

SHA256
3a82d1297c523205405817a019d3923c8f6c8b4802e4e4676d562b17973b21ea

SHA512
d96d6769afc7af04b80a863895009cd79c8c1f9f68d8631829484611dfce7d4f1c75fc9b54157482975c6968a46e635e533d0cad687ef856ddc81ab3444bb553

Download Submit
memory/404-1470-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/1740-1453-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2736-3175-0x0000000073710000-0x0000000073920000-memory.dmp

Filesize
2.1MB

Download
memory/2736-2231-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/2736-3295-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/2736-2232-0x0000000073710000-0x0000000073920000-memory.dmp

Filesize
2.1MB

Download
memory/3908-3308-0x00007FFBCB450000-0x00007FFBCB480000-memory.dmp

Filesize
192KB

Download
memory/3908-3312-0x00007FFBCA6A0000-0x00007FFBCA6B0000-memory.dmp

Filesize
64KB

Download
memory/3908-3306-0x00007FFBCB450000-0x00007FFBCB480000-memory.dmp

Filesize
192KB

Download
memory/3908-3310-0x00007FFBCA610000-0x00007FFBCA620000-memory.dmp

Filesize
64KB

Download
memory/3908-3316-0x00007FFBCA6C0000-0x00007FFBCA6D0000-memory.dmp

Filesize
64KB

Download
memory/3908-3318-0x00007FFBCA6C0000-0x00007FFBCA6D0000-memory.dmp

Filesize
64KB

Download
memory/3908-3317-0x00007FFBCA6C0000-0x00007FFBCA6D0000-memory.dmp

Filesize
64KB

Download
memory/3908-3315-0x00007FFBCA6C0000-0x00007FFBCA6D0000-memory.dmp

Filesize
64KB

Download
memory/3908-3321-0x00007FFBC8E80000-0x00007FFBC8E90000-memory.dmp

Filesize
64KB

Download
memory/3908-3319-0x00007FFBC8D70000-0x00007FFBC8D80000-memory.dmp

Filesize
64KB

Download
memory/3908-3327-0x00007FFBC8FF0000-0x00007FFBC9020000-memory.dmp

Filesize
192KB

Download
memory/3908-3322-0x00007FFBC8E80000-0x00007FFBC8E90000-memory.dmp

Filesize
64KB

Download
memory/3908-3326-0x00007FFBC8FF0000-0x00007FFBC9020000-memory.dmp

Filesize
192KB

Download
memory/3908-3325-0x00007FFBC8FF0000-0x00007FFBC9020000-memory.dmp

Filesize
192KB

Download
memory/3908-3324-0x00007FFBC8FF0000-0x00007FFBC9020000-memory.dmp

Filesize
192KB

Download
memory/3908-3323-0x00007FFBC8FF0000-0x00007FFBC9020000-memory.dmp

Filesize
192KB

Download
memory/3908-3320-0x00007FFBC8D70000-0x00007FFBC8D80000-memory.dmp

Filesize
64KB

Download
memory/3908-3314-0x00007FFBCA6C0000-0x00007FFBCA6D0000-memory.dmp

Filesize
64KB

Download
memory/3908-3313-0x00007FFBCA6A0000-0x00007FFBCA6B0000-memory.dmp

Filesize
64KB

Download
memory/3908-3301-0x00007FFBCB2F0000-0x00007FFBCB300000-memory.dmp

Filesize
64KB

Download
memory/3908-3311-0x00007FFBCA610000-0x00007FFBCA620000-memory.dmp

Filesize
64KB

Download
memory/3908-3332-0x00007FFBC9820000-0x00007FFBC982E000-memory.dmp

Filesize
56KB

Download
memory/3908-3333-0x00007FFBC9820000-0x00007FFBC982E000-memory.dmp

Filesize
56KB

Download
memory/3908-3334-0x00007FFBC9820000-0x00007FFBC982E000-memory.dmp

Filesize
56KB

Download
memory/3908-3331-0x00007FFBC9820000-0x00007FFBC982E000-memory.dmp

Filesize
56KB

Download
memory/3908-3330-0x00007FFBC9820000-0x00007FFBC982E000-memory.dmp

Filesize
56KB

Download
memory/3908-3329-0x00007FFBC9770000-0x00007FFBC9780000-memory.dmp

Filesize
64KB

Download
memory/3908-3328-0x00007FFBC9770000-0x00007FFBC9780000-memory.dmp

Filesize
64KB

Download
memory/3908-3302-0x00007FFBCB400000-0x00007FFBCB410000-memory.dmp

Filesize
64KB

Download
memory/3908-3303-0x00007FFBCB400000-0x00007FFBCB410000-memory.dmp

Filesize
64KB

Download
memory/3908-3304-0x00007FFBCB450000-0x00007FFBCB480000-memory.dmp

Filesize
192KB

Download
memory/3908-3307-0x00007FFBCB450000-0x00007FFBCB480000-memory.dmp

Filesize
192KB

Download
memory/3908-3309-0x00007FFBCB4E0000-0x00007FFBCB4E5000-memory.dmp

Filesize
20KB

Download
memory/3908-3305-0x00007FFBCB450000-0x00007FFBCB480000-memory.dmp

Filesize
192KB

Download
memory/3908-3300-0x00007FFBCB2F0000-0x00007FFBCB300000-memory.dmp

Filesize
64KB

Download
memory/4260-1468-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/5280-1455-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/5796-1456-0x000000001D010000-0x000000001D4F6000-memory.dmp

Filesize
4.9MB

Download
memory/6080-1440-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/6080-1439-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download