hxxps://cutt[.]ly/www-roblox-com-users-29325508454-profile

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
20/03/2025, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cutt.ly/www-roblox-com-users-29325508454-profile

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_294381573\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_23501232\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_23501232\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_755781265\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_755781265\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_2004877372\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_2004877372\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_294381573\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_23501232\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_755781265\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_2004877372\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_2004877372\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869511464591244"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{C2767E74-05B0-47E5-B0F5-0753C43BD66A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4564	4052	msedge.exe	81
PID 4052 wrote to memory of 4564	4052	msedge.exe	81
PID 4052 wrote to memory of 1140	4052	msedge.exe	82
PID 4052 wrote to memory of 1140	4052	msedge.exe	82
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 3568	4052	msedge.exe	83
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84
PID 4052 wrote to memory of 4764	4052	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cutt.ly/www-roblox-com-users-29325508454-profile
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffd9b60f208,0x7ffd9b60f214,0x7ffd9b60f220
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2496,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4064,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4092,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4108,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4292,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3616,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3620,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5248,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3588,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3748,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5796,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=5944,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1124
    3⤵
    PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6468,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6788,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7044,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6404,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7496,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7356,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7708,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7652,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6052,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7680,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7544,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8020,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=5656,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=5712,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=3708,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=5704,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7532,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4752,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=4760,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7300,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7288,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8008,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2728,i,18207546980662471501,15562430508086952211,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
  2⤵
  PID:492

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
046b1cdbd636e82e7711ea1fde31d7e3

SHA1
f5fa4183cb259a99b4148ee957a5f76e80a77ada

SHA256
40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

SHA512
460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cbc9fc2d9ad2df85283109b48c8e6db0

SHA1
721ea0dfafd882d6354f8b0a35560425a60a8819

SHA256
7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

SHA512
09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf

Filesize
162KB

MD5
ca84f7aca145d4fe5aa44a4c7eaba15a

SHA1
91b0a9ba97ed4a5227231e8028a295fbc41bd0e5

SHA256
ed31cba878c6ec4fc8dbaac01de9f887d95e4bb603b19dc74330ae79d01b4c43

SHA512
fa7241418667d83d2a4433ad3cdd3f4351a9eeeea98ad6e875eed5b13097238d95c958db3e98c64e829aa9974af24d38cd261ef582da00c373c9c329bd3b87bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2

Filesize
112KB

MD5
1e1aa6bed96dfbd2a06b9f64d62ff214

SHA1
02a14fe939dbc72afabe54c3b4779f3eb5ab5425

SHA256
7a17f2b88d8cb2c92f10c52d4c7da9ba8bf6df44fe7450ffa5b179914e7e37e3

SHA512
e50554958ec702201eea01752f2fb79894531736259a8c1b433bc481cf6191117e65a8fc80e079acd2ce60f0372d17255d5fe93151a2455121e8edf91efa1beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3

Filesize
85KB

MD5
de5193f5867a110ec4bfbb5b8b9e18c5

SHA1
e25d4ae2364125909778734d7c7ce6bb52a0b86d

SHA256
0385f831c7ab722c3d654248d3123a6a101e717e7459bd40d03187fa03a05dc4

SHA512
094014a2fb708e72564671f0b5955e0835730b4be59ad64edc84016476505ba2883659b680de32e389e55bcf5808cfaf3d5fbb3dbd8fa51c2f4b9bf055280201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6

Filesize
41KB

MD5
359928b925d0f81cabb84ac2a5cc9690

SHA1
be74ddac84f09e92b6097908a774df86df208c84

SHA256
c868d598d0ead7b331a611eec2332facc3cdf4032629b1dde06a8c65f76e0205

SHA512
91bac01cd113130fddd6b4fedb288feb77c4116f4f084846fc46f3642858737e2687ab74bb1287d24cc6ef17717742f2d2972ad13d3be3436604492d9ff9cd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
9ec3fe5d06098b7ec69d7cc8d2c487f3

SHA1
95baa46b7655fa4922452040f138fdab3ceed5cc

SHA256
b30391f9272cf48ecf979647357de17d0c7f1656e40bb070eebafa5248cc97f5

SHA512
507f00044cde22aaf1b5114a23f646767a890d68e661f86ee0d287bbfc2a49d9bbe1c7687db20941bbb274ad4368529578a18bf2065b8e95c6372dd0a13975ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
7cb3619cafd6b32e710c4af2bb90b13c

SHA1
8d62a12d62ec4a25eb1c2ae79e696ab36fbe5ce3

SHA256
cfd4a69e36fd740e0542c54c57ea9a3e9dc374ec8fa38bdbaf909d2e4791e7c8

SHA512
d8e908c22adcb070254279036ae3bddafda2d9adbae21a2ae6be3b7faed707864c9d61c7811593c6c60bf7f3c555a2665d4017b2ca94d5724b31cb5dca462d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
11KB

MD5
2885c30204046d5463c0714d8bb2c6be

SHA1
724ce72a5c135891419b53d452964e96a0379ba4

SHA256
f05d53a28518d25d97a74b303ac05e19f5a6007a7807b23d36e0fea9a12941b8

SHA512
cdfc04f344918bb8b1391324885572da1242c4a2785925ad79f3fbdab153ab602f2ac4ca228d5dabca8715c776e66ac7b2dce4e24c43e9717d6309cf604c3a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58652d.TMP

Filesize
4KB

MD5
6af9fbd51144d27a89f143924e455780

SHA1
a371bdc12c7eea53760feabd0bd35df987ac7b4f

SHA256
9fb19b8f4a6dfcd07e8700409563f22cc360a18f7e0f173a8f6bc7db40af22a7

SHA512
44befdc8752776804b93b36a7d8bd7b84e78a444b3284d5c86b23e0c2847d9824dbcbb96f57944625c761179c742c84cc045d7edd3e63c00bc79361af23226da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com.ni_0.indexeddb.leveldb\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com.ni_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
15KB

MD5
dbe17db30fb7c3fefb459895a10e0359

SHA1
57019dd29579fde28df65da6510ac29172f55161

SHA256
7e831ae5bbe1c7bdfef5dc41a8c1239a1f1bcf0aa37876d0b086f05045013cb3

SHA512
bf7651cc6bc0cb9f1328ff5a1b216fd55e848bdb82d8779bc9b8da5fe281a2db4aa849a6b907347d3f082dd19fd9ebcf3906dd0ec94c81193f249145519905b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5218a0b2faf9f1a9c053caf1f4cdf6ab

SHA1
bcfa17ad837f744dbafda8b80c99b60814a914e9

SHA256
3abc5a5651c807f32ade6268f6ccc6ddf1be2e749c7bba0dcdb63e68f33b2635

SHA512
b78d525d47b1af6bb8606cc243fc5d2cd249bfc14980d28cf96b770d697812eec43425728fbdbb7cf14f984d9479f7b1648f5f58ef0a09658877431c0e93c3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
5683532662d51204e95bfcbe3ad7fa33

SHA1
bf2749b9adaa9ce047e66ccee7ea089c6fa8433a

SHA256
3cd0e702fe6640dc06ed0271b7ccdb8b0017e02a89293a085db05daa08f50fc1

SHA512
be603f4a84fee162d7c17e45e5a9df2597f6d622b33aac8e0dc16025dad605bc1a93e67219d6088cea23a9f20f42aa23b583b0bd244153f5aaa41bce46ae8028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
f6e023ba7ccbd0b7672c82c1e1322e9e

SHA1
a6b271dc1aa854c6cbe51d026e30514603ba94b6

SHA256
5723e4a6735de7a2b337d89b595f24cf720934c4e121b0e7c8087f878d0f45ed

SHA512
a5c5e2d6cfe870a20ee25453924eda10c608b9aed27456f26d70e9af14ba7ca8d8055103b527571997e9788a457d4b3315e840060e32d93a23a637adda836dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
6b0a879bb5ee597580a3eb0bd0b6dab3

SHA1
852c9ad87b2752a3d7537c95e12de3835b13bca1

SHA256
d89d0dc111a6b538853fccc0a9b65b9dac21c680d36bbcd60e306d65a1cec4e8

SHA512
cc52ad308d7e5f588e267db0990754c6aa096d9843c4e2df7b73030d7bffbeebc0a3243c9ac8c13fda0f4b3bded74287c8829a3ba0d5d79d1560cfb95ec0f339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b60cfb62436bdda4e42b673c7183139d

SHA1
5d414c8af3e9c4dc46ab817d840f46e6a473f832

SHA256
3233c0898257edc8fe0765babde0a2df13a172d472cbf163f8aca2561d9b1b51

SHA512
8e489adbb51958a120611d66e6399e5381ea4ff47d446f47498dd0850af77f5250532af25e074c9ffdd1231a0d18e63705aa11ef538a7e988096c2bf421d8ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
a9352058fadfa57cd20c327934bcafdf

SHA1
a60ac54288300fc766a2f39abc324cb263b83fa5

SHA256
897c856bb2dfb384c47db5d209ac4f861fbb309e7eb841509d9446910d7c1aa4

SHA512
3460c9703425b7532a8d778569c422f4936b637d640dadfff3082edaf259854d71a5deb124a2000e97a686ed2b3a8266079ab55f306120d0acf284b9dd75210a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index

Filesize
2KB

MD5
67cf7ea71b27b58d12d5ac05fb768135

SHA1
4faf0c5333b7054d40ff24a966305f703969e3be

SHA256
52a259db18784079da59648cbf54893d3475655ed39bf8a381a1e71d35879049

SHA512
a60e8f7b9e2fdf1cae055a6168481c54b8c1a3d37b9ecaa9c6ba1898ee3204061ff391399d5c7e2994f786658c03509cbaac5fb1936ae370e8245e806b3ee6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index

Filesize
456B

MD5
ce3a2c55a2751cee33b4c740c495ee23

SHA1
2614316ca11eb6d6131d9a565696188c846a5458

SHA256
ce38006246adf34204e20a3e2ae22561e4e6cd5e3334d41601fa4dc973526e8e

SHA512
ec0b7ea5aadc450cb21b69f714307c1a03cfcae8fddcbbccb0964470ae7a4b14b3a5b926d93b21469659f64c1c0efb1bb7a0905db8e877a86c02e4474c959b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index~RFe57f8d7.TMP

Filesize
456B

MD5
451ab0772ed3a366d13227b79b939a62

SHA1
9949daa4e96df830d05800907515d1139f8f9558

SHA256
8bab8842730981ae2fee309247ad50e81de8ec0f37528e2a516c3260474f02c6

SHA512
4a491294b029c0f11d8f0ce56eb502a92364ab1478f0b0cf46976d807128ff31acb432ec41c6ca51c19b68b02245b880356ab20c06d1d47a17ee99ec2eef26c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\ee91b116cc2005be_0

Filesize
57KB

MD5
a5b20ee57dc7bd6fb56bacae86628d57

SHA1
347ee522b4116080fe5c295c20833f9d66c8bf8a

SHA256
8d5171435f3ddfbacbbf56a71b4b590aa199c776ddfc36b0db650a7dbae324aa

SHA512
2ff8651e61d4ac2ff9651b8ab6b5918d2d7ff28cb3e7697f4203f0d621e8631ff368fb313af78a6e3b5cadb6fe6dc9178004bdd0e629b91e122f212b8a298630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\index-dir\the-real-index

Filesize
72B

MD5
89f0f16a7bf6ac6148902ba1a0c88f25

SHA1
1ee6a7adefac3f040096ca981587af83f0c1a8c2

SHA256
c94e20a0b75931e7a3bef8ddacb02a6b6c96bccc73bbc03a196a39093a11eaad

SHA512
c491a9993642442570d7c32c9614b642f6da9961e41e7f81376b8f3dc560a29c1ded48850b987f8f7f62e34e08022482ec07c1244b6870d0452dd254a05af523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\index-dir\the-real-index

Filesize
72B

MD5
8499e1354f13158b72d6240ea9022cff

SHA1
464b03e6eb601866ce08eda3388b20b554313c4e

SHA256
5bbb1f38b22b170e5edafd997b89f8b8ac7cb9b6eb2a0de2dc4689b2a86aa23d

SHA512
b23ecafb6dfa54c1f49c74f5b313fb72f7a600138cb4bfb184c7b763d72c757cf3083e191a798b4fd22e3aa468582fb37ab1887496cc8245f3b4c11a484301ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\index-dir\the-real-index

Filesize
72B

MD5
008c2f3ccb40cc1488afad98a78e1607

SHA1
7be1531783e270b6a9cb3275f4da7421f09a4625

SHA256
e37d2d70e6460faee98205649a8bc7c18f682cba142a82ff1c7e3b66b610d059

SHA512
d4188ff75917b1c727fdb023678820f170e05440346bb9a9d10421135e3e1dbe92845fb11f0254965ac9af68bedc89fbb689d8fee6460685ab7b42c28b72082c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
86426122c081c849a086e031f47fe0fd

SHA1
1b0eb43c6b214951f7ea6e2f7851a77f4f2727cf

SHA256
87de12c96390de9326e2a3cae0e056136563266a4c4b2908357544c5f13b6c98

SHA512
c075651ee660cab019910e8808a34db8ef4476f460f17f76fc7916c7b04cb3c1f24d7841043c3ba411b8fc5972cc921f305d97d43c1b062ceebe291782a0c272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

Filesize
115KB

MD5
fa574e0c18e3ea87c550a50b6aef8cbd

SHA1
a825ae36f768d59568d18e9e9844b0d4675993a6

SHA256
38dc470dc1cee4c64bfed96b6d768e0f5eeac16fc357895501c273f67ccee2f4

SHA512
b4f9b2e62413ebd580104c6548e3837240390101ee2a8a6e5cd71baa930c4bf30e485eb0118bbe6b7463f2f05aebbe982f0a64dcfc17b0c6912721ba9594e7fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
d3e3e4fa8801fb3dc47db4bb5abc2dd0

SHA1
7516ae3fa87e518c602cf86f483934c481900b47

SHA256
f2c50f6db75091ce63d8a243a25a6f00f176523e74bd47c27db0a8e5fed68131

SHA512
506aabd1c399c19d1cd139356cb066c76a07dc708c04818023e259cec93d7e98f04cdcbc18f6d522fd147598d11fdc422deb063e1697fc439abdfb07ba639609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584e3a.TMP

Filesize
48B

MD5
e1a7bd8e375af85dc08ad039283db031

SHA1
0f7f3b9aa870c5c516dc235dbf48087d79da0ea9

SHA256
d838d5d5942ff0eb0e882983bab276e9bb482341627133f5772d2a9c93e064d7

SHA512
7bc28cecfe9254e68c4272f96aef35168f8394cbeab568eb8953ebdaf800f987f02558eff4be8590d8cab51c0e7264d4f724f76975e47ecf4fdebb395c5aad4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
54c9097a384b1f3daa06bdb1816a8050

SHA1
ef0be219e491c45358bddff47179af5abb3dc6a5

SHA256
ffce8a0f2ee503b55e1e46e848d9ad66f07877210fb8e62469bbe1c40ac29cc2

SHA512
3bb323f73801a81cf31d6887bd8850819cff181e3963e949609933fa0c2e15c23e24c572c1cbf310fa1781b30edd4bbea67d30dae52f739ca781d753c36ac60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
91a7e46eee96de59e64dbc77e44ef378

SHA1
697ff7492fa90fd8bef1662bd34b48fd6248aa80

SHA256
4246b57a66b774b6ed9998dc20cbb9def476f8fe99c9debf4f62ca7db2126ba6

SHA512
755f5b75922bb9cba23dcae8a0546dee6573d5fa55faa95f2665377b94e4dcdc5726113be4c92ea2313272db7f373d8796a6db09a68948a19af9339bf3d206f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
c09a9b43b8d6e2c98814e77a3529d572

SHA1
e1aa253d04e2e24e7a267443715403df1b4a85cb

SHA256
66de949fdf09137949261aca6d29131d09ac300d18d92f0554b267f23e9f7a16

SHA512
0385f2c76ec9fa798af5160a9b74aad31f615079ef55b6728f51ad9dac9c193378edf7ad6fd64af3a40d5688ba39824d7a9ee81edf4ed6a2633782e959745a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58a88f.TMP

Filesize
469B

MD5
ba86af50c697908b689e376d09a272fa

SHA1
737340b73392870d9643aef00909b8326c16084b

SHA256
af3afc4feed5264549d40336b737ceda51b021aeef18124268a04d4843f58ef6

SHA512
36d1f9a7db482d8e68dbda052edc36de11cfb45bb5b2ffb17cd14d4d217b1ac481043cec6a2a94c38c0439176ec77f343ab085a71efaeff1404cffb6080756d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
21KB

MD5
e4dfd0504387a1ebcc4a48846e44a23e

SHA1
a5a91da421e3d8728ae857694dbeb24ea72b7866

SHA256
d3c39babd9652bcdb02ae17f895437ed85f617cb04f7ba4bbaf7ad7e8ab78cb6

SHA512
94a1d4ab7b18763b55c9246d73feb0ed64a7e506572884a2940696b12910d6ff2a03a0b1aca3e4035a81548633acd437e762e758952ba72dafc97f191e46d419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58a9b8.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
34KB

MD5
dd9bcbf66a4e3d403447af68e37a7179

SHA1
a3ca2fe1345d5639ea524c70e627684365b162c9

SHA256
229070ece407179e66ac6b83820e09464bda2c5b55f9527cdea8b5bf85bb5910

SHA512
036a9a250e06e49e68b0f379b916585967f071bdd1afa3fb4f4e0785b5931d33ec8893b939ba3c61bb1474023455872f3395d2f1e24e87c705e2c9d9270a5369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
81175e8a02b42ae4e3ec3ce080dccbc9

SHA1
835c6c96c37f4e184fc7fb7c1b0fbaff64ad5bce

SHA256
ca8445fa6551e53f120a146cf462616dc9fc622676889ac99fa2cb6b30e87d2a

SHA512
1bfc3c36fec2074a82a1ef31ed57c1a434414db8d80166b993251efebcf0c8bcee2acd3609efbc6e72a74ad37200dcef0a887f77825ddc002b40dae5a2295d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
649d1f92ee81e4ffec3cb9a0676eb487

SHA1
52f7634ea9aa01443a3abc9fc50c209be24eca86

SHA256
01cd0ae767d0a8f11839055072531e13ec92d43268af85558561be113c5143a7

SHA512
6daa22f35a5eeea3be71cfb49f49f6bf4d252651a755afd39a308d38e63f4c0a360f4918bb0899e36e4bb62b8540d149b6c0b2705c0638381d31e1f3d2c7104c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
44ea0ab4b3591fe6febeec0927d502ca

SHA1
2dfecc3f8589fbdd32b0e8c18dbc71e82a6d477a

SHA256
dd07c9dc0a36a019fb1fae99d2dc7bae1cd2ab967b2d4a0ac76fb5bf70de0487

SHA512
5521f80ec560faa07dc6c800f76aba13ab79b53b0ff8d17f99c39fec009fab00a1c08788f3cbdd18fa69d13dfa875e68c55f869959cc08e052c06860fae650cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
23b079e923e5a2619dbea64e7e333ec8

SHA1
fabc28cab1d19d84a65ecfc8dc751ae30b3e559a

SHA256
5add9997ea389fdd171cf38a7b41f942c7c85d5e24bb6d29246eec8eadaf77e1

SHA512
cf81d6dd14161ebb0381f1c83a5ab83789175fc3d77e3091e6a942ac705f6a66c78ca77a233bed279f4a42e233dfc7b200eb8b17fc1c0bfb9a8353ac6562b9d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d6818c24939919b9c0231f4bc58fa4bc

SHA1
51a0b2e2849192739b25c50f798943903c0731b9

SHA256
77e143dfeee49737ec3937f0fd40179ed3363c549b5e42929a4ea210fb410046

SHA512
23158f98ae1b943fc8352c32b67bbd0246223b848d5461d18a20fb69db9918d8c6e606356f68658757bacd743cffbf6e1f9a6bcf6cc044af130283a6ade1cd0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
e97746cf3b609cea22d0320ff3f8facd

SHA1
d1186f8aed38969e7759e2ca0c17caab94f7d013

SHA256
8032299d083b94c57ea81edb6f9795a26c0fcf0a6e1d451b29158643b25d4b11

SHA512
ffee688d9987fe0df1fe0c848dc67b14bb16bfb97750015d9a1a5771a0c0a9a079cf8cd3dae6e92130c2ff61c58aee29da07def22fcd53fa14c25abc31a96fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b1b7.TMP

Filesize
392B

MD5
39a2be3a41bc9ca7aa4aaa40b73214b8

SHA1
88b4eab03c481404d20686ccfe9cd992c6c8b380

SHA256
673e49711038efc07018e21a72b36ebba586e900649e75bb6779f008a1e2905a

SHA512
32eced8e38d586328ce3738710519839b0f279f15ea13d4e14a7da3cc91fd4cf1a3ea6446481b647bc0c487c8cf135f525069b8c071ee385717bf774707a160c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Temp\555a41d0-4193-4615-8748-233d34d1e528.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2ce688d-cba1-4b91-b45d-a7a98c71f389.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4052_1155355610\b9304ea4-4633-4ff4-935c-04788823f1b6.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_2004877372\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_23501232\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_294381573\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4052_755781265\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit