c24855d316a3f7e445035168a2f03dd09d8e69ae35cd4c3d1c27674288383896

Analysis

max time kernel
765s
max time network
766s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krnl.exe
Size

1.8MB
MD5

e9cdcd3816bbd105ca2f309af36bc16d
SHA1

fc3fdd5e7fa88defdf76b8307b0fa2be48a45db4
SHA256

c24855d316a3f7e445035168a2f03dd09d8e69ae35cd4c3d1c27674288383896
SHA512

c8aa7fa445539017aaf09936f308c9743c1d1cfcf00ebc98ede98212e22acf8ea7d8738a9d11b759910af866b1d0786e4850bdd12a9fc7002d2d9d4cef5c3867
SSDEEP

24576:ePABanooMW/8umFbh8A0SsKFucT+KNgxysc5U7ecSgL6y+gk+rnxdarFsP:eP1uB0SV1+KSxyr5UzS65+x+rnxYruP

Score

8^/10

microsoft discovery evasion persistence phishing privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Krnl.exeMicrosoftEdgeUpdate.exeKrnl.exeKrnl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	Krnl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	Krnl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	Krnl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 18 IoCs

Processes:

RobloxPlayerInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.68.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
6060	RobloxPlayerInstaller.exe
4120	MicrosoftEdgeWebview2Setup.exe
1608	MicrosoftEdgeUpdate.exe
4564	MicrosoftEdgeUpdate.exe
3712	MicrosoftEdgeUpdate.exe
1580	MicrosoftEdgeUpdateComRegisterShell64.exe
2096	MicrosoftEdgeUpdateComRegisterShell64.exe
4844	MicrosoftEdgeUpdateComRegisterShell64.exe
2328	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
4328	MicrosoftEdgeUpdate.exe
2448	MicrosoftEdgeUpdate.exe
6880	MicrosoftEdge_X64_126.0.2592.68.exe
6948	setup.exe
6968	setup.exe
6780	MicrosoftEdgeUpdate.exe
6384	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe

Loads dropped DLL 18 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
1608	MicrosoftEdgeUpdate.exe
4564	MicrosoftEdgeUpdate.exe
3712	MicrosoftEdgeUpdate.exe
1580	MicrosoftEdgeUpdateComRegisterShell64.exe
3712	MicrosoftEdgeUpdate.exe
2096	MicrosoftEdgeUpdateComRegisterShell64.exe
3712	MicrosoftEdgeUpdate.exe
4844	MicrosoftEdgeUpdateComRegisterShell64.exe
3712	MicrosoftEdgeUpdate.exe
2328	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
4328	MicrosoftEdgeUpdate.exe
4328	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
2448	MicrosoftEdgeUpdate.exe
6780	MicrosoftEdgeUpdate.exe
6384	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RobloxPlayerInstaller.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

6384 RobloxPlayerBeta.exe
6668 RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe
6668	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerInstaller.exesetup.exeMicrosoftEdgeWebview2Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\Locales\fa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\DeveloperStorybook\ToolbarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\PlatformContent\pc\textures\plastic\normaldetail.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Chat\ToggleChatDownFlip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\DefaultController\ButtonSelect.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\VoiceChat\Blank.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\PublishPlaceAs\WhiteNew.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\VRStatus\ok.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\SelfView\SelfView_icon_camera_disabled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AvatarEditorImages\LightPixel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AlignTool\button_center_24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\R15Migrator\ic-blue-arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Settings\Radial\TopRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.68\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\MaterialManager\Filter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ArrowCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\DeveloperStorybook\Collapse.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\UserInputPlaybackPlugin\TapCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\icons\ic-back.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-cn.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AnimationEditor\image_keyframe_elastic_selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\StudioToolbox\Animation.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\xboxmenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Emotes\Small\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\icons\icon-share-game-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AvatarCompatibilityPreviewer\img_triangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\ButtonB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\LegacyRbxGui\_preview water 03.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\TixIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\TagEditor\Add.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Health-BKG-Center.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\CompositorDebugger\clip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\mouseLock_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\TopBar\HealthBar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\Auth\GridBackground.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\icons\ic-add-down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\9-slice\tag-bubble.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-14x14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\models\RigBuilder\RigBuilderGUI.rbxm	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\wns_push_client.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Slider-BKG-Center.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AvatarImporter\img_window_header.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\AnimationEditor\ScrollbarTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\DefaultController\DPadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_2.png	RobloxPlayerInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

RobloxPlayerInstaller.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerInstaller.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeRobloxPlayerInstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-1088f3c8e4a44cc7\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Krnl.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exemsedge.exeRobloxPlayerBeta.exemsedge.exemsedge.exeidentity_helper.exetaskmgr.exeKrnl.exemsedge.exemsedge.exe

pid	process
4888	Krnl.exe
1924	msedge.exe
1924	msedge.exe
3608	msedge.exe
3608	msedge.exe
2756	identity_helper.exe
2756	identity_helper.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
6060	RobloxPlayerInstaller.exe
6060	RobloxPlayerInstaller.exe
1608	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe
6536	msedge.exe
6536	msedge.exe
1608	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe
6384	RobloxPlayerBeta.exe
6384	RobloxPlayerBeta.exe
6260	msedge.exe
6260	msedge.exe
6308	msedge.exe
6308	msedge.exe
5680	identity_helper.exe
5680	identity_helper.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
6424	Krnl.exe
6424	Krnl.exe
5432	taskmgr.exe
3712	msedge.exe
3712	msedge.exe
4168	msedge.exe
4168	msedge.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

Krnl.exefirefox.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exetaskmgr.exeKrnl.exeAUDIODG.EXEsvchost.exeKrnl.exe

description	pid	process
Token: SeDebugPrivilege	4888	Krnl.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	1608	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	1608	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	6060	RobloxPlayerInstaller.exe
Token: SeDebugPrivilege	5432	taskmgr.exe
Token: SeSystemProfilePrivilege	5432	taskmgr.exe
Token: SeCreateGlobalPrivilege	5432	taskmgr.exe
Token: SeDebugPrivilege	6424	Krnl.exe
Token: 33	5000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5000	AUDIODG.EXE
Token: 33	5432	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5432	taskmgr.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeBackupPrivilege	6084	svchost.exe
Token: SeRestorePrivilege	6084	svchost.exe
Token: SeSecurityPrivilege	6084	svchost.exe
Token: SeTakeOwnershipPrivilege	6084	svchost.exe
Token: 35	6084	svchost.exe
Token: SeDebugPrivilege	2864	Krnl.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeKrnl.exefirefox.exemsedge.exetaskmgr.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
4888	Krnl.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exefirefox.exemsedge.exetaskmgr.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

firefox.exe

pid	process
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

6384 RobloxPlayerBeta.exe
6668 RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Krnl.exeexplorer.exemsedge.exe

description	pid	process	target process
PID 4888 wrote to memory of 4844	4888	Krnl.exe	explorer.exe
PID 4888 wrote to memory of 4844	4888	Krnl.exe	explorer.exe
PID 4888 wrote to memory of 4844	4888	Krnl.exe	explorer.exe
PID 1416 wrote to memory of 3608	1416	explorer.exe	msedge.exe
PID 1416 wrote to memory of 3608	1416	explorer.exe	msedge.exe
PID 3608 wrote to memory of 5068	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 5068	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2792	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1924	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1924	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2368	3608	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Krnl.exe
"C:\Users\Admin\AppData\Local\Temp\Krnl.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://krnl.place/invite
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcccf746f8,0x7ffcccf74708,0x7ffcccf74718
3⤵
PID:6348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
3⤵
PID:6220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
3⤵
PID:6568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
3⤵
PID:6740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
3⤵
PID:6956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
3⤵
PID:6780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
3⤵
PID:6664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:8
3⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6273607369173898136,6998026283949357756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
3⤵
PID:1012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffcccf746f8,0x7ffcccf74708,0x7ffcccf74718
3⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
3⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
3⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
3⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
3⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
3⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
3⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
3⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
3⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
3⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
3⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
3⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6132 /prefetch:8
3⤵
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
3⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
3⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
3⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5634531454015818059,13095038722891330938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1280 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x3f0
1⤵
PID:1288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.0.1780566876\1033253682" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecdbfa21-cecc-495c-a256-83b1d7577656} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 1688 26a6efede58 gpu
3⤵
PID:3804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.1.1366960448\33898830" -parentBuildID 20230214051806 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a7bcde3-eb86-4086-91bd-73077756490d} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 2388 26a5bc8a258 socket
3⤵
PID:2144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.2.1712081743\1529256052" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {805e67b4-7d23-42b1-8368-1af01788c576} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 2972 26a6ef92f58 tab
3⤵
PID:2244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.3.619694145\1662345716" -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6218306c-9d1b-4e49-8149-42b4fa64e2a9} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 3680 26a74e76258 tab
3⤵
PID:2740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.4.1134659252\982312811" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e720da3f-daec-4e8e-a4c5-a69a41f69cc9} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 5288 26a76d04d58 tab
3⤵
PID:3200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.5.1826338385\1064467242" -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5440 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec6ea622-6dec-4eef-bfe9-5834de33ed33} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 5420 26a77374f58 tab
3⤵
PID:224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.6.696396733\942662057" -childID 5 -isForBrowser -prefsHandle 5592 -prefMapHandle 5588 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e604610-4732-4c96-9699-c20f2c21740a} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 5636 26a77374958 tab
3⤵
PID:1520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.7.1561073616\1721388531" -childID 6 -isForBrowser -prefsHandle 6084 -prefMapHandle 6080 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dea5c3a-ad26-4d86-b620-613225b4fd70} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 6088 26a78f08a58 tab
3⤵
PID:5556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.8.1172422943\220109809" -childID 7 -isForBrowser -prefsHandle 10284 -prefMapHandle 10276 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f467fe4d-a3d0-485e-a909-a85c27afc386} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 4928 26a6f3ceb58 tab
3⤵
PID:1968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.9.452208542\967861629" -parentBuildID 20230214051806 -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 28041 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1d36cd0-1064-43c0-973e-5dbea2715203} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 4936 26a7674f658 rdd
3⤵
PID:4656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.10.642366809\1518713074" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 4976 -prefMapHandle 5992 -prefsLen 28041 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37f0c2dc-b38c-4bfa-820f-017763f9a546} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 5812 26a76750e58 utility
3⤵
PID:3684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.11.672335843\334311862" -childID 8 -isForBrowser -prefsHandle 9972 -prefMapHandle 5372 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef79ca4b-fddf-40f8-85e0-0605300d275e} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 9956 26a76d3cc58 tab
3⤵
PID:4820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.12.188140221\907929119" -childID 9 -isForBrowser -prefsHandle 9268 -prefMapHandle 4084 -prefsLen 28177 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a69fbd33-3ac6-4ebf-a45e-b6bd40274a69} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 9252 26a7b03af58 tab
3⤵
PID:4892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5204.13.75988643\2095251958" -childID 10 -isForBrowser -prefsHandle 9232 -prefMapHandle 9236 -prefsLen 28177 -prefMapSize 235121 -jsInitHandle 1244 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de06f208-3431-4784-b20d-d1acfcffc30c} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" 9224 26a7b3df558 tab
3⤵
PID:3928

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
MicrosoftEdgeWebview2Setup.exe /silent /install
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4120

C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4564

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3712

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1580

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2096

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4844

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTYxOUY4NjQtOTE4Ny00MjdFLUEyMDAtRTY4MjhFOTIyNzg3fSIgdXNlcmlkPSJ7NUM3MjMwRkEtNzAyMy00MzM2LTgwM0QtMTdBMTY3RUI5N0E3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQjlCRDRDRi1BNkQ3LTQ2M0MtQkI0MC03N0VBMkMyNUM3NzZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2MzkzNjkwMTgiIGluc3RhbGxfdGltZV9tcz0iMzk0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2328

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{1619F864-9187-427E-A200-E6828E922787}" /silent
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4644

C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" -app -isInstallerLaunch
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6384

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4328

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTYxOUY4NjQtOTE4Ny00MjdFLUEyMDAtRTY4MjhFOTIyNzg3fSIgdXNlcmlkPSJ7NUM3MjMwRkEtNzAyMy00MzM2LTgwM0QtMTdBMTY3RUI5N0E3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4NUY3NTI1RC1BOTNCLTQzOEUtOTI3NC04ODEwODM2OUY2MTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NDIwNjg4MzYiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2448

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\MicrosoftEdge_X64_126.0.2592.68.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\MicrosoftEdge_X64_126.0.2592.68.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
2⤵
- Executes dropped EXE
PID:6880

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\EDGEMITMP_8864D.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\EDGEMITMP_8864D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\MicrosoftEdge_X64_126.0.2592.68.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6948

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\EDGEMITMP_8864D.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\EDGEMITMP_8864D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F8BE3902-2A0E-4281-818C-1C1156D2BDD7}\EDGEMITMP_8864D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.68 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6ac6faa40,0x7ff6ac6faa4c,0x7ff6ac6faa58
4⤵
- Executes dropped EXE
PID:6968

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTYxOUY4NjQtOTE4Ny00MjdFLUEyMDAtRTY4MjhFOTIyNzg3fSIgdXNlcmlkPSJ7NUM3MjMwRkEtNzAyMy00MzM2LTgwM0QtMTdBMTY3RUI5N0E3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQzgyNDgwRi05RjM1LTRERDgtQjc0OS02MzU1MUEwREMxNTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI2LjAuMjU5Mi42OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY1NTA5ODc5NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NTUxMjg5MDAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODY2ODkwOTI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hYzZmNjExYi1lZWI3LTRhNDItYTZkNC04Y2Q3MTQyOTZhMTE_UDE9MTcyMDExMDE1MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1DUVRHUk9pSEdwcmh4ZDlhWVNqa0Y4cTVKd1R0JTJiM1NCVDlCYlVLaDNxQWJTekFxWkgzQUhSTnNYM1BmSVVaUDZPNGdJTFBmdGJSMmZSYWQ3azl3SW1BJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyOTU3MjQwIiB0b3RhbD0iMTcyOTU3MjQwIiBkb3dubG9hZF90aW1lX21zPSIxNTA0NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk4NjY5ODEzNTciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODgyMDEwOTI2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDMxOTM2MDU2MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjgxMyIgZG93bmxvYWRfdGltZV9tcz0iMjExODMiIGRvd25sb2FkZWQ9IjE3Mjk1NzI0MCIgdG90YWw9IjE3Mjk1NzI0MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDM3MzMiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:6780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf0b88d87hd971h49a5h96a2h428ae9d67504
1⤵
PID:6208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcccf746f8,0x7ffcccf74708,0x7ffcccf74718
2⤵
PID:6252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,1130375440094039624,13248054374859859548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
2⤵
PID:6528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,1130375440094039624,13248054374859859548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,1130375440094039624,13248054374859859548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
2⤵
PID:6564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:7056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6532

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6716

C:\Users\Admin\AppData\Local\Temp\Krnl.exe
"C:\Users\Admin\AppData\Local\Temp\Krnl.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6424

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
PID:6684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcccf746f8,0x7ffcccf74708,0x7ffcccf74718
3⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
3⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
3⤵
PID:6892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
3⤵
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
3⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
3⤵
PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
3⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5256 /prefetch:8
3⤵
PID:6476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
3⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
3⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
3⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
3⤵
PID:6924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
3⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
3⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
3⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 /prefetch:8
3⤵
PID:6760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2512351255420160443,1619850896303682113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 /prefetch:8
3⤵
PID:3444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x3f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:3SftwjDof4y0aOgEyf3QrEIiaXCnzAH---XtvQqprIfEe__RVHmllWSSZnHsxHtXVXjYjOYtfrQ-OS7op7WGk1UJq8_0siSF6tDNsLJ-MRG6ig0VkTICKwLb5EJ_dgc8N-tF7pwomtaRFoDAlcObYNqYa0t1efoz0KpgTjgfmGZ6dY0mqpHut2lYvetsQXgjWRTN0U3RjcvqDmP28CVmmFLfHI--aoSmASuc2vGYd7k+launchtime:1719505524987+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1719505269074005%26placeId%3D5991163185%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Db9b78ab3-daca-4fd9-a40d-5855c62367e8%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1719505269074005+robloxLocale:en_us+gameLocale:en_us+channel:zperfverify+LaunchExp:InApp
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:6668

C:\Users\Admin\AppData\Local\Temp\Krnl.exe
"C:\Users\Admin\AppData\Local\Temp\Krnl.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
PID:4204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/roblox/9NBLGGGZM6WM
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffcccf746f8,0x7ffcccf74708,0x7ffcccf74718
3⤵
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
3⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
3⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
3⤵
PID:6196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
3⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
3⤵
PID:6416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
3⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
3⤵
PID:6148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
3⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
3⤵
PID:6636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
3⤵
PID:6676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
3⤵
PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12300165139802081655,39886286397659673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
3⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5464

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.68\Installer\setup.exe
Filesize
6.5MB

MD5
05e320ae544022adea3f8c441646765d

SHA1
3c6266b8a8c0132a97b2785bcb9ae7546ac02cc9

SHA256
e1618f31f476932871871ebc6e63d57aad643b74ea892d3d305e4125df1e6f10

SHA512
c1cf5c001ddd6b3b3c68b697f8ec9f1cbd48b5881f9fc805d74eb14a13eedcdf71e958ca1b790353a4edc64008558295741cfb785e0a3824a8f3a62bc985d387

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\EdgeUpdate.dat
Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\MicrosoftEdgeUpdateCore.exe
Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\NOTICE.TXT
Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdate.dll
Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_af.dll
Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_am.dll
Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_ar.dll
Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_as.dll
Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_az.dll
Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_bg.dll
Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_bn-IN.dll
Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_bn.dll
Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_bs.dll
Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_ca.dll
Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_cs.dll
Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_cy.dll
Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_da.dll
Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_de.dll
Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_el.dll
Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_en-GB.dll
Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_es-419.dll
Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_es.dll
Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_et.dll
Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_eu.dll
Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_fa.dll
Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_fi.dll
Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_fil.dll
Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_fr-CA.dll
Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_fr.dll
Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_ga.dll
Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_gd.dll
Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_gl.dll
Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_gu.dll
Filesize
28KB

MD5
f9646357cf6ce93d7ba9cfb3fa362928

SHA1
a072cc350ea8ea6d8a01af335691057132b04025

SHA256
838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

SHA512
654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_hi.dll
Filesize
28KB

MD5
34cbaeb5ec7984362a3dabe5c14a08ec

SHA1
d88ec7ac1997b7355e81226444ec4740b69670d7

SHA256
024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9

SHA512
008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_hr.dll
Filesize
29KB

MD5
0b475965c311203bf3a592be2f5d5e00

SHA1
b5ff1957c0903a93737666dee0920b1043ddaf70

SHA256
65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0

SHA512
bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU4CB.tmp\msedgeupdateres_hu.dll
Filesize
29KB

MD5
f4976c580ba37fc9079693ebf5234fea

SHA1
7326d2aa8f6109084728323d44a7fb975fc1ed3f

SHA256
b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791

SHA512
e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Filesize
5.4MB

MD5
4fa63f4ccb9b1fca93ab82e51c6d4750

SHA1
1f26018c15ed5e14140ed44c28cf52a7b892fc86

SHA256
685f8b14eb645f892a666cf61cf691d086fe0d3e344a245323f1fe75034869fb

SHA512
a25031fb2afe1baebe9b46266192574c6c73b7fcd8e3e2897873d97b3f6232c5228fa4f633b1df98b9410808d5afe1dd470cd8f3f6dbc0c52526311b769554ab

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat
Filesize
280B

MD5
d45e982425e1955a80668b7e623437d2

SHA1
9b1bed28100311aec9636017f8e7b49b46361956

SHA256
953b994057f43425406296bec664276b2eb25efe17acd7042f7b903ede2b8056

SHA512
2a16a6fb694b1ce33053bee20b9ef93d0a1a3ed7c488a3024a06fb3922f226647bbd6e1491499b10bdaf0173ed78474fcb8747ffefcd6236adc088bc4b5f9d7b

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
66KB

MD5
15b74c1424729292b6684da7dde27ebf

SHA1
9b0d8eda6ea37ff14532bfd455f71814d5595f1d

SHA256
277c7a28f947cb64598073ff19e2e228d2319936a995d9d80017932c9e52d5f6

SHA512
ed0d5fd6d6a288e9289f46c6dd91c77a24ad660d45d4695ff522a836e425967f6e69a9f681cbae0ea77aa248c215300a53e69ed81c5c0187f962cd0218660141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
86927c97ccfe88d9fe623419a895cf2e

SHA1
4a9c2b6e91e9a5afba6a5b24cb21ae7ac2d46154

SHA256
1516b6c914c762ef9e68e817b0f35fa52491f977c4851ad6f3f9c66b98703dea

SHA512
1415cd360d6bafe7a278239a7a9e1fa701e74cce4c3dc84df612ab65f2d7c9c64f611040071b588ae64cd36e557e0c6ac97c361ee20144a873168f6229828550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d0ce0ecc99d7de1ad5f9d795ec9e10a6

SHA1
3d3542a3a16bf58af1952469cf3b355ac677722b

SHA256
c226347788de62804f7cf38ab5ae9e9e1e8c0038886f30758b4945ea36585133

SHA512
1e61062fdc42ac933f64ddc85002149cb2542825582cdc0c26bc80adb0626c481db6d447e48ef520b58e14c18bfc0a5bf0f2e34f1e3f361b45e758e7f6dc9c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ebbbcf58be96b0152ce4774277e38dfb

SHA1
845d0d87f3a2c0b744ddba4ef8847d4264c62562

SHA256
80b371067196f090b6d8524b3e414948f8487c0f848083d4c929db5750f44d97

SHA512
a826f4dec5af7b255e2d8417049d3a2c7e8fecd1e4fed025b0a3393506d113c6c489c9568cc27f0a33a9f70e881e97a551efc217ab63133ed01f056af5b2660a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
21394768016b0ca339c9a07afa763869

SHA1
b75a8ee541a2bf49fc888f5e39a1dac30c9a9c5c

SHA256
70668ad7679e765ec8ebb021b3cea3a3ab0e5e81a14bc18ac63ab50097534d80

SHA512
246065aa5334dc80795c45d3b88541d9d77a01a12a8af8a0010789503dc15802afacd33ca581373964f0aabe6ee6a1c1eb637b0bee238747a3958a9c2ced38bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
597670d272b702d991fa221f78b2adf1

SHA1
c94bd5255d362ccb1582f0ad161a63847b60d9c4

SHA256
576af19f35fe87f694ef94fbf42b3a468237e310086b01793d9519d8a714cab1

SHA512
1f8fa084bc3a3a64a36ff24ec9eaa39d4daa6c7246f087b59c05ace89881fb897c42818dfc767770c6782becfe04f7ca2deb6da751735975ec2e023162de4c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7559acc5-5077-48a1-9d44-1551458484a3.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
3ce9035b7d4ed4ac5d374dc77bf5cdfc

SHA1
82f5f8e195e392b578e60946f5740c773414faef

SHA256
24c7d4cc0e28785f648cedc80859072ca1c631c2a54950b8971a8e4c8fb3a315

SHA512
0cdf53807e503ac174d8b1c8d42cb52c9b4677b0fcdb9d28e56a734133b5852e2ad8e6bdbfbec342564f0a71b257362038d42f0af4c5938909f3a132341391bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
de575b25bed32f24448e4f529bcd6a6a

SHA1
124e806af843fba784bcaf31ca065ee8c48c302d

SHA256
973507b4fab5597c8f3b7aa6939c40380141e6ebbd50b347034ca62e2f06b078

SHA512
fbfb6fbcfaebfebd97b85b89deec618f50fbc80cf6b9c9bcab2d6c37afed1d77de625d58ce07ec4b1532503048762ae73ace5fdce00c0c6baea8eae975d8c5a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
d8a6ef12c6a95d4e9a210b223e592e42

SHA1
7009136529b1253339ab4a8ddbcea2329f8279ad

SHA256
35330f3429b298bad3400a728cdab8dc7147bb07a295ada775b9b2a0e4e39379

SHA512
7f0059d141e2c006b66ada9b4a24e8515f86dbf1ddc9fb9ef369d950c875f88ea4da6b2c60aac9570b2f80fc2cf7039d11d6485a67c469fa2bbb079cc02df97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
01f18a9546f6156fc862e0771eaaeac8

SHA1
bf5b08713078efac77de61ceb2ae4eaf530ce3d2

SHA256
1770319c7dfd7ff855509664a62bb720479b4b3be7ef5762eebf5b198ae6e6a8

SHA512
7fbb1ae726e70fe02c5f35ff3dabef5d18575ecf92c5e56ccb20483b79442d818a179baa72b94d7add6e729a603f038ef6b77f4482a9139a81b5fa84c9468c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
51d19c3515bbd64f3779de325f046c53

SHA1
b8c0cace06687c3f13332fe78011aac1c642a315

SHA256
66e51389fc5bf9725f1a4aa22c45286574a8273f9f4e94016396ae599bca7769

SHA512
5f7f6d4a731de6f393a50b0b45e84704a7341d6d23401102548269f2b9c1b27f497811c37c90b4f464fafb48ccdeffbfc65d6fc732bba423fd39cbeea1b3eee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
50bf4dfe4d72577b443e9dbd05d976c3

SHA1
a7d7204b996e9a9db0a21b70682a01cf5def3bbf

SHA256
2cc5a73f320db0ed92686d0e3ccf1eab73b9565b92b975ba10d4700a9ab9fe28

SHA512
d5523947021f7f6864a1cbfb05f83ad8b2979536aabfffb2f1d49f360ed8ed5cacd44c4ac7d740a4949dc0fc54d749911c23fe5574ac245ae62c3172b130a523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
6e7056d56cb2f9e7f09aff248edeb9d7

SHA1
30089711cdd55be17f5f9a53f8ada0bc9a477f43

SHA256
ac14bdaf0a52c09d847614ebf8942256dd095158c1aee3822cc986d631c94bd6

SHA512
52b861f4513f7f332d49ada8630edf406d25bcb25cbe4cbfc9a0728214c64392ce1f7f9e7543148d2647fbeee7ee43837041dc118c36e3570ef5631480eb556d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
5a21ae045a6905adf9bdc196c806eebc

SHA1
9044814343669e25169fe375bc6be844fd5897b9

SHA256
7485a5633eece2f82e55d50081ab68be0fbd975524718a37fa498d494b39affa

SHA512
604a9ee18ecfdad8fb2be5db95d6b25ea688acfe581507941cf9a9dffe022ccdf11cbe77fc2f82d1ceb7b61cdc3d96e8d73ee98386ffe439dee523ed474a69fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
83d74411ebd6ddd4031b89cfc17b4269

SHA1
9b50ddea7cf57453ab3b5758896f97811a2fd522

SHA256
f3be8fecca7a69d1a012773604fe7267ed29a15258fbb757f2604427097ab129

SHA512
d8b565c59c81916727aa2f7f10d0755add15ea9ac25eda430de15e9d8a42f1ed64abfbbfc483d57f87a551fa2180c8163c9966744ec03f4ad6c7779e414d447c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
befb150dc33c27b367c61043d3f486c8

SHA1
fd5d9115b7b0e86e9b49278345c8d99e6d13ed8a

SHA256
4d0f9f1de478d1813e5e1afd0b0b08baaef96090c9497db5438a0db850d95b79

SHA512
0e0af7b871af0e90936a612e2082afd647e71c58080692f0217f5703270dd0dbb450a2204b586be93abc90dfd080a17d58ba67d53d38a0773dc668fcfc2cef8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2a8e7d1180dfee1b721e526c9a2a7c49

SHA1
5e117be2cf423c0761d1149cef123d352db01f38

SHA256
d7f5079e14b56905238c3ba5375e1b80233cce47845075b2cbeaa06a97adc41f

SHA512
c97ed54efe014a41f452aea6f8e536a8a24c8b363b132d3b0104331b898eea0447dd1cd779c1d8e3887c4620c2cc3c27550a19edb933487f9f20cd36b6d62694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7941c0b4d4e106298bd2eecce4183726

SHA1
d5f6336cb916d8f504b60e6a930a803c30b903c8

SHA256
2aecf7359ffb7b6873517bf7eccc3199577b3292a4b355c836925d4739649e80

SHA512
9c49db993c4260d56d44061f4341582d6eaf727b6c6c03641094db5f1da8ab6c0eec499c256ec4f526c00822c37f80973d420c377a37098147dfcd5e975cca3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2ad1d71bd73f7232975bd63e3049a46d

SHA1
ba9e332579f350ba33e92aa1317deedceab512ec

SHA256
7a2b2bc91bc99e1ce7fe30979ae78e508735accb4f07070b0ffc79241065a98a

SHA512
75fce8a5c66be65dda14fcb6504d107e8c265e046e2efb457beb1b6408c08064e0c56f6cc51ae347badf6954f7b58b2771d5877125dd0bad9d89e200e9ffc746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8a82b626bf5ba0c1de84f9e4a677aa39

SHA1
9595adf5d7797ac2d5c2297aae9820dddb6671c6

SHA256
2206ae9a114f0b8e9f10b823e5099fcfba6042e5bacbb123f715f6f2e072319d

SHA512
90f74dc9172af9e32044482da1a250231ca3efe19ca77347245d955c3fdc3c896ef56973b76de7a1e45ee0843ae1e9cff589b29f947b03bf7cd18434313b6518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c327cc083cc51f641c4df0174e1c7840

SHA1
081afc6b7f0fa51dbe6954d8d7108f330b6e2b89

SHA256
596fb90b793eb48d89e7883cf8fe30680e6854977ab948ef35b70a325a798f5f

SHA512
c98eab45268c4f0957dc49cedaa9050b32d546da92d23f9fe1000d09fac788d5c8b3166c633b9a57356540e3c336d02b6f27dcfe826e54713f885f9ff4188c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e54fb83e04edebbe859bb2ea6fc753e8

SHA1
baf83480e57bad7dc27f37604f8f21e443de0d79

SHA256
ca61476c8e7b8c2d7305afd057046f2b8d12c9016f3b27eb52398a115d08be7f

SHA512
5b67265b1bc503c56ac7417d2e4a1eae0182a7b924078697713de12eff9d6c17104d6953e0f01cbcd48e87dd0d14f99054f14f9d85d3326f2b9ba4f6a954cbea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
795e4b581b99d222e5ecee3e152fdff5

SHA1
2854f806af08007c631cba646cc0ae2a732519d4

SHA256
b20020e4246bcaca6019ba51fe4bf43532a92daad78daa20e8b92c4001c96195

SHA512
121cb39d49895ff4f5716f29ff265da250e05367df36c51f58a72421c701637e9c16095f480a82a6871e7700f3ec958de2476f2332b35ae42e1795e158ac0e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
226eeaed9800acba620795fca8be432d

SHA1
c464c2c297e98c8cd51d000a17cbabe239d7af52

SHA256
8f87ac154f50922bf2c6733692dacb1e79474e1708c6036e7d50bcbefadfbfce

SHA512
9a3260bf684109024b291a849dea4334c7a52a6fd119b3d81b9bc10d1d54d2fd8539899d1b00ba749f6ea3c1d29225e45d0c284aaf8eb3de059a3745d736fb90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
2a02c09e5357d2b760e1f2f2f2c9c605

SHA1
a422bfc4a58c875dc8bc5ab5133bdeb9287905c3

SHA256
9a45b2b75e191ba6e0195127876b90d4ee0d22233f0b80e6497d21f6ce1a05b6

SHA512
1da01904323afb9577433f9909a86258b3e590e947fba8a142ec94319a384440e93b62ce594b76a71264ebf92a560317a67fae3749c00c893c555e4b38ac279d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a807b29b8938a144b318eb4f5e976486

SHA1
db585f790dcd3e73533a0cdd4ea92b4f774f7ec2

SHA256
45be8b1a0d2a29cdcba6745efdb846d27de2e80faf29f874a3e2161bcc0daeed

SHA512
754cd20623961727a04d8ef8606789a639a63efd0082910546c0a9868c38b38fe2e85be017020e9082eab85f111e6bac7afd579eab723a67be3820df08b97bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
d2910949560fa1bb5eb09f2735e83bd0

SHA1
8e46074b344eb330ef15a7a9fd381590031a2a80

SHA256
480fb4ea3030acdff728e0119c44af5d41f5d4f5cedde4870eec84ed2b60a349

SHA512
6b4b1707c0955fda7d98939b0ac87b76019e8f2807be1f00c5e7a00882fa988332d140e72b278e42754b20fc7e9205e52b5e8d42535770877c8bb6b6df014993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
9b4d7dc23b34f2dd8f4ba8ee8b3ef953

SHA1
7b9d9698d063879a23d6a9dba0a1ce04ac97dbb0

SHA256
0b9981f82cb84a5b127acffc192b28c58832886c9e6e0f24b7f4e922700461fe

SHA512
21c663681b188327d0c00258b335c73a49068be6374f35c0fc02de78b936cf3d6d27c4427bad0c4e1519feec534ce3ba860c6a651151d315ddcf65c933eb8c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
7d1f236f0514feae0d8bd68dca2a627f

SHA1
d8ef9bd1096d27dcbf937a30ffe6f6490f2dd33f

SHA256
4012d829e7f24479e75ec2116092825184358e0e95ef2a1001c53124f9f1d1be

SHA512
2438870ddd98e28b37004b5fa87d9de34864cb6d114bde3291ce923593acab2711ef038eeb7861e8fa7cdf31884a297d145cd6b599e48172d6c2f4dde2c4e419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
b8d69b155abcf77ff83617255d9ece93

SHA1
49cf25e33827fbb5382214d05905738ec6f3e1e7

SHA256
fe91ce40b05e15c990dd25eeb95d3003bf2dcd8fcf3bcdab4e485b51ccfb71da

SHA512
55b04dd7b7b69058496381e338fcda49635da72aa23b031580c216b74e0fe22934452b21f912801c5a8f83dc0277b01075c11e2b1661af077b77574dde059fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579858.TMP
Filesize
1KB

MD5
e515c585ab827b25a8565eeabf2132a0

SHA1
b56c069012219b64a5378e5e1a234119077f6d38

SHA256
4a4ec3e7b8e5932c4deeef99ffc30b66318219dd98c4b43dafd20e2b1a98c410

SHA512
f822077e196ded37fa503113fcb140401a29c38a77f708d457905580affc274eebe25d471c38703d84cf756f9eb368ad567999c12266d104de1c80839b193040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
d3893aaf081f8cf61aabfde3017668b5

SHA1
ca3a8676a60cae921ec8a9be36329394d439c20e

SHA256
7635b18e46b581be2884a08d02b7baf37c0b36ac044f2f21cef42f5e727d2645

SHA512
6f81337ed7c4764ca1f424a85cde860cb8757cb3da81afe1338b3356af9a985d8bbb44d7048257d55aa171aa90cdd095e0d89cc19a211714fcc4d130b5b41794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c9e5bdcc0993f646536459110a5fcafe

SHA1
66fc33db7b7de052e4d6ee3e15cc210e85c4417f

SHA256
815af97e6a219a5183a5fd2c7a313d5260e26ea8d206f67eb6ab03df153d2ed0

SHA512
90b37a065502fdf21b13741a137a30b2d9d8e835a7208cf0b1825a11baaf2e0bc7f5f9aacea9b4945aca45af134913815eec1ecf5c8fbacdeb47c0b92ad295b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
126f1da8f586e76dde3961e6ae35251c

SHA1
7a651370b9dd6cd631427af713f71bbdca5fc169

SHA256
27b438c34ccbd19ea7f31c1680c91d5e40d60519566e234500e30f3ef8da6ba1

SHA512
a0c7d82ae451abd63b1cef162d166b7c68c5745611cc88d84b13b1d3bae0c556c84f156e32c8f53517d0caf24e4110a9b716a940c6bb69552eb16f58c5b8db6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
213d1f52ffb865ad159d251698d4fc41

SHA1
f3433fb7714e2ddf8acf215b0cdfd2618a6f15fd

SHA256
1328b6313f921baffbc0af5aba699295dceec8feab9ba65ab4e4cafe4099187c

SHA512
cc2a8abbc80d03b45737a00efdcaf90117bd43321082105ce0ae06cbac5c7fec0b228fb0e6e6c963556dedbff2a1974d8aa9e5f66e131a49f18fd37419058646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
daad3b386fc5d84d3926e1b06debc260

SHA1
5aa6bd0ddd6afa678de8559e9d01dd6d09733650

SHA256
e5834662773e0ebfa037b4be7ee26d94624b94f03608fb1cbc4d790f0abae871

SHA512
f7714f626ac655594b79cdc715d5bdb88a678fd5632f6a19b102cc1b208d92fe640f74387c96bf5b641435ec4314a1cc6d11eb221c734fa2a7d08e2e88f18666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
e34319170860aa531b494278c16aa165

SHA1
f30bc1f97f314afea4e5df3f7c086df505569415

SHA256
95b8d435fbbd22a3ca4b1e81121ee19d108c8d5f0886f8e155c8f81c8fcacc76

SHA512
206405e2d8b0cb4ae2b098c529640cef1101a418e5100068df67f3fbcebd1e885aef6cfafb6c0b5d16be83d971aba2c87c60ba6f25e7a33059ba5ba68b87cb22

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\activity-stream.discovery_stream.json.tmp
Filesize
24KB

MD5
1edf8cea47d06ef69b301fea2849e83b

SHA1
10b34e84ca53f6a16dd6f1baa5533f087cca873d

SHA256
518db9f403e919adece356e92c267449fb1ac24aa439045f8a6447126959f108

SHA512
e7a5132d211602a8ce99c272773e3b21cc95b66aabed46b47774834d18313b03ab04b8e0bf6034780f0ddb39d1f0c624b642f676bef72bb096208666852fc238

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\10105
Filesize
10KB

MD5
b2317353e4e4d28455ae91f3a9e51537

SHA1
3d68f0c89acab1f6849cb2894b5f326ae962791c

SHA256
41d8a37b4659608cd852005b4dfc1c14138f2a07605ed830eef13dbfd401bac9

SHA512
c13bf2060f069b83259be65a032a7bac00682e246fedfbdd54a512ed528bce92b7ff8b72fe96da80314ac5b0db90ce503d2201e99dee2d528abfc94001dcc212

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\10986
Filesize
10KB

MD5
8d8168701cbf6b0542d69833831151c4

SHA1
99e8f0d5214308b96df671f17fbc379361970351

SHA256
a3d3c6d06f0a0b2fc461343a8a2b04d74ab698c51e589ac757cf4c6e6a9f116e

SHA512
59ebd8411fe2896e71e75955b57a28a65db992da45c425d19126e43d94b3d7d76ff8e3f0a2c3b212d3cf0c10b6ca3e99a7f6ad3219fd4f9e09e7183950c00b1e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\11541
Filesize
10KB

MD5
2e8022a4f0666b589b2a5f53ca6475b7

SHA1
593738d05e29c632c5d9f93e613dd04f1b088665

SHA256
56276abfcacb05f8107054ea63d2175c15aaf7174f3da3df524de78fa5e155f6

SHA512
330c1d458591ae19fc3c7f0ba4d7b59eb4a3e90299e68bf28aabad5c0aa93455d99b55e3d4fc949ce3f35b52909078ff47dac4f96080db906227efe62b83a992

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\16412
Filesize
10KB

MD5
97546920bdcbacfdb67e60784d83746f

SHA1
4bb5ee6c6888b1297bcbca16ae8e371e4397e86e

SHA256
328f58992eb953089d7d39520488bfa9aad83942618211826dbd36009d389f7a

SHA512
f738e4aa2f0804910feee8294c926103362c32deaf7d17cb299b142549a1aed2fc4f8015b3ee524a0a1298c6cd2830af9a09be7250b2d5a40811055d7fa9f1c4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\18722
Filesize
10KB

MD5
25eee2de5e15cf3a2aa80cc459b4a3da

SHA1
4877c45d3087be60fba094c9cb86fc61254ddf3e

SHA256
e36799ffdae360e9a933538ee755ec7b069852ace9ab61f1de5a73970021cf34

SHA512
1ee2f402dd96235c2743ed598345951692674d17f49687745e5b616a361e5b94002f32188f78bf12c295ef1d4e2d6ba155ddc056238f35a255c2fad9ffcbdf1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\2081
Filesize
10KB

MD5
678d353298078fae52c5c914e5a5f306

SHA1
c8a7e096f69716030a984c93fa30eb942e87ed6d

SHA256
82c1f06eb36e1ba234ff2db7810cf2876092f7e7be74a6840db2009a526d26e2

SHA512
b5d0d2c6c508c3f84d2ae9f2fe9c0ab7b1e0848e833c6744695b9ecac3a7ff445c1ea5e8121c6a7ac2c60cff39478c765635c50b2204f168ef29329cd9d68750

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\22224
Filesize
10KB

MD5
244e64c583934bd81496685ca5aad23c

SHA1
3e6eadc953ff69e16b2524fa19ec5ae415c55758

SHA256
b130ad06f6236e8fb69ed63466df14917114c5822f34496d4a5bbc8f5ce3288f

SHA512
e2e241a45772fb70d5a0b64245370e51af3ca8da69f2bd0a560fb836a2de2d31ae4c0ca676788cb06f546e503da4a154d21e881b3de2b6e036c3fb6a97ddbf88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\24177
Filesize
11KB

MD5
3604a8d48190dac0928879d51f748fde

SHA1
8e24e64e03db9063d335fdc91576f0318de06dea

SHA256
1cd50cf0c0ad7eb21d4e782c418343daf91f5e99164cc79fea209fa38170fb17

SHA512
5a8eb93d4c7baddde17de17c3d78e683bff50c1a7627308842abb5eb248812730b2a1d2629b225cefa84b27ad543cd6099ef3291e11811a608e610135d5701cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\2428
Filesize
11KB

MD5
2b6b9ab323f1049834cd57bc282158f3

SHA1
8913b508abb1f6b9a66d5ebbe9f4823d43e56458

SHA256
4984a6216c09e63c9c49eaf209d48bf53d66f1caf2b7f95fc48146fc22f50d95

SHA512
f4793f4d4b66e64e02aead472236e5268be12526c7766a1805e1aee909a8ee420f484771d5f0f78fe8d16cea07f1dffe8e92ed9c001ac50a6efe33041a3524f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\24603
Filesize
10KB

MD5
d8d7ad9598852e45c3fab12380cdadcb

SHA1
12bea8b4dc6c26e088fa8b0197bede7b2e5cdb83

SHA256
784252752fb8b4ed8436e5a0968d268cb7432e8f19e40c2f1d15b231f4c74aa1

SHA512
84d647df01b6fb88fcd1065917786ad386800a5e0834cbe3eafe1e77b2b5af95d8f3792a45eea1238284b889408dbb3e620e10b28875b0b477eae37f05cb0bcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\25052
Filesize
10KB

MD5
cb93a6c4fe5acefc68b6f0cd6a12a396

SHA1
094f128b1ab9268b721b1b74b3a81b837875d034

SHA256
8cd9a306836c9fc233e519b8d35e8bf3c7d3e687e1bbff0445d0a441b68b219e

SHA512
d46280e24a2c793aa388eba1bc8dc2b0657aeaac35055cd9d3c40d58e5638299c01d98432512de6dcabf3ab6c0a785f9a9af1a1e5140d1a7fce52b319825812b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\25288
Filesize
11KB

MD5
4b2dcf8fd40c3b71a32c9643bf8559fe

SHA1
058a62557980cc824b057e7c9d4f67e1b0f57162

SHA256
607f9504100d1008a20774477ed3b063ddc41539af5a06d19d5053ba5c37fc99

SHA512
9d1c92ca6a94d8a448efcf1db148d3fd6194adbfed3fbf421c8d7d977924b5065135fc1cb87200f9d966f46fec5dca105d557669ffaca4507f25690be33d80ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\27175
Filesize
10KB

MD5
f714aa856fba1b5039d3833d9b597170

SHA1
8b5f7e15996703ae2ec5d18cb803e45f4a1a5f32

SHA256
32c2f0632c99c6b8873cccd1a35d71ffc8f13ee80f968ccae443ef74288ae93a

SHA512
f53488a3e56620a3368d64c5c4b50da280c9b82b12930b6635f15d915c9258bd9f5bd6ae258427d81eaf135bc12c4d0a950002c106cb1cdc57c6bcf69bf56658

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\30337
Filesize
12KB

MD5
af1ecf3d9b3c59f958d1b64dfa262272

SHA1
75eebe4ed3d2c011b173baa8184f531c9b33e7d4

SHA256
73e3b4363ff0aedf0d8bfa99137ef6402050380c5ad21b73f019566baae559eb

SHA512
a57b09f1049bb76e1b0e77ef9105daa6c9befc3617c49d5ccdfe6d30ddd227235d03eab2d297a655cf7ffcf92d3bfe93769e8a9e2893ca33328e8f3cb84dfc12

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\30743
Filesize
10KB

MD5
8b06da08f2d529beebc5ae9b09eef2c5

SHA1
0c18e5f56475f0dda80c10cc7efd2e3172e78f74

SHA256
64952695c3ab2d99443b869e52c45867f23275ece9b8993f272f65e1183591ac

SHA512
154bbf79269057d7998e1beefc4065eac4483e1609bff1f39e819bbf8c05132ab03f24c10f468d2de2af83bb43d058257ad13a1f82477a0639801b89bc08a7d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\31459
Filesize
11KB

MD5
1e8b91edfdbf395d2b136e25bacbe200

SHA1
674be96906e6767d49756a754fb7f53502044056

SHA256
e0f36bc9b5bd970f05aa044ddd3b11b9b2bb50c9a00975716f8bb0d6658d3cac

SHA512
8d851a0f152d2c1c4afbbe3a38aa8e61771a62fd2e6a3703d5a97b927525b51121609ed235b48f7ec7e3f7e806d0285e2bc9c1b38bf8a3c8046c1981e29eb6f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\31931
Filesize
10KB

MD5
bc7be9ba21c14c2297a7382563f63963

SHA1
0b6053325e6267aa70a5da887d8114688644aaeb

SHA256
8834742d24db88eb0032a809c6e0a7bdceb25232b283aba469c343496994846a

SHA512
a707b3269db10468992fb42ca2bda085e20922dd4600167a51a153fb34020b1ff8dfd5f5e00bf28b17ef2cdd990f3f8fb6c06b846c510351f083ade8d7ace514

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\3791
Filesize
9KB

MD5
64d0ba1fb3b4707aba2d45f0ae3ef78b

SHA1
18405760f7c933354b0a6764c651bd3f9e34c8b7

SHA256
47b3bac353d1a2bb4ef95d2b9345218367a7ebdd671fef7a87f3d644f32bfeea

SHA512
8847f5ff8abb95fb7812eb492382bd72c296a34846a982fb40e1c433a40670e34024b95cbf2af77b3a363272a6e8fe6b55cbbaa5f072ede7b247caa81535d16d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\5458
Filesize
11KB

MD5
e274b757ecd47f94a39587727d197fa9

SHA1
1ca0532b91c0b6777f8b64b12e5a8d7c8085004a

SHA256
5f4f15baef160ca9a4826be294b7100ae181925b86eac6872be4a6b96ac563b0

SHA512
a64977bb13c675124425631673ba6b2a31198c475615f36a7a8b75a277ef3a94f502274e14478f5d21ac1d617f25d102dd73bd9cb60f63fa92ac54be7d99a1f8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\6681
Filesize
11KB

MD5
1d513dd463765c6fb5ecc550c7da2982

SHA1
df6158eb9fcd75cfe686ddeb0aa4a946fde28690

SHA256
9232ae13e747290765629927bf68e34611de3901bf2c45ef18d9ccb4e2619f11

SHA512
f0fc726eaf452c90fa935111731ffed52f4cb064d01b1ff1ba17ce1cb6156503739d4ef79f3fc0b62e45bd8633d92e8d37ffad2cc8b4d87744c335b3a42e2cf9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\970
Filesize
11KB

MD5
eb94e6312ab8e0248895325a14d71333

SHA1
f69d5789a4cb7b4f8c744c048726c351d035fe19

SHA256
e2f98fa96d780143aacbcd62ac78a8485dc289c3ee0190002e893c1c47ded2e6

SHA512
157ef09364c2b3cdfd6b99d9b4bbb5da8a912cbabb2d921802f5b21326f4a38c5e09a9a41309004a92d83e375ff2b9eac6a287066746fd63d9db279ab3270b1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\9958
Filesize
11KB

MD5
4a6a736efe77c5b124694475da9a05b9

SHA1
dff731a3370d4666aad5f87e910c47d669a1c00d

SHA256
1945d0d08cce9c34f862801059ebf2f2145849acfaf250599b3028f1437c3b3d

SHA512
1a3b630596430c12cee65b810dd94f4dbfe8a4e61082855d068c2cab8aff275a71f4e64d1bc76d7f150e3ae42023ea2efc353daa2e3f57dd4b22939f2e3ec56e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s2p9ahae.default-release\cache2\doomed\9993
Filesize
10KB

MD5
d3a0d82d6a90e5bd4e406a0e60d5e265

SHA1
509e77de42c3dfd1f96d916bfaa7ab6cd96c11f8

SHA256
da8ab496dd3f957f80016405976f0a9edce6d18194a8e99691f4ca677313a8c5

SHA512
152ba883ba83857e676313815dd18135e87af8f37353140b1f9715bae7d7de1e29ac101868ef23a74cbabe7b2db922658daf0807c180f7632bd3dab4a7078b3f

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b022682dd39d113f2d5a65a172dbd28f
Filesize
5.8MB

MD5
b022682dd39d113f2d5a65a172dbd28f

SHA1
aa874df3d3d0a9539c53a8a0c96c4c119bae2c52

SHA256
47a2e8bbef18d5491be3c449d9a5464a8804d9d1a85bc7e24ff80876e85104a3

SHA512
d6746ca7c1e10b1ed7fb48d857210ce5cd0f0542c81fdbf00a6afaf4607f30020ccc09f4c41ef9f50bc2562bf6e4380e7abaef1d5a5b1e91773281bcd9e58525

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
16KB

MD5
02ac633a4f17894199c09eb98427c272

SHA1
9b7b13ad2a304d3b8befa1c8a7a0809abb789085

SHA256
20188aa899b3d042bbf82c4e54add40fa4a55256e4339a5730d31b0f5c48d83f

SHA512
cd435a47658a324d206eef85071601dce509bc5fb3a1246e9f473e21d101c8046c98d36ef6bbc99b41f7a5473f6d530e31e4f62e445cd8b367816d739c27ad28

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
17KB

MD5
0dddb6b7ca38f11e4bcc374d11f521be

SHA1
481dd51c60b79f22b6e2acd51742ebc71b0fb9dd

SHA256
dcde5022ab423e5bef506e0e33a16e64fe8e0da9a5db63acb8d84b5f4702c326

SHA512
2b540f1742f3d6e27186d707a471af26762cbaa68ac88c7d413414cf9518a2d0310d2579bfc88b8da9af08909af40ed5f1187a4b31fa9c6cded47270c6122944

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\prefs-1.js
Filesize
6KB

MD5
6a29a9ecd6044ffff0407a095ac4ccd6

SHA1
ad164a97e79bf9e5a9e87bc253248a5435282b56

SHA256
af25301a2ebdc8dcacce1e4fe91ca36369998e9ec95be37559e043743eeae3b4

SHA512
da852987c889b2c70fe555a3413a42754f85c779e94fb890082e4dfe1d0fe0be7bf252f91bdd580208450ea7a5b141ba54408df44488523fcc2095297c0244c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\prefs-1.js
Filesize
7KB

MD5
3edd0a90d23072086049a7077674e415

SHA1
eddad73eafb8afa30680ff6175700e1cf10a5c9d

SHA256
e3e76d4a096780db9abad1e95cf0bc912dfc8be6e9ff600fa4a2efb93f418837

SHA512
8723c81d30e6d7a5198ffd03421a73521c0b2014a96ae1f0a072f4b193ec50cdb575eb6063f844520ceffb0205b90bc0a9089fcacca056ab2520545eb6241f8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\prefs.js
Filesize
6KB

MD5
5bc3eada936d96b4907a6546c3e8bea4

SHA1
262cf6258b9d1ae6f9ec4be83bf33b6d98413c31

SHA256
1e60208130a54add891ee9268bbc87782b680ff4c598e488cdb3caa419056cd1

SHA512
3f81b59ce3ca483c8ab09320c4587f7c9c8bb2fa9c522c9f27646bea915b5ae46343f1c9ec05e4b3decc5e02c0215b2f2f0f6b1539df522de8de457c73c54f05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
7a501bd5ecdea58762a211c12ed9b3e2

SHA1
5c8a45aecf6b385dc5c0b64bd1869617058d2fd3

SHA256
98af62108653598a030bf4fc3b5ee2acd580d97bbcce9336605e9cfe0c0c731c

SHA512
f263e41e6af564d6fd96ae62ffd1723ed5e19e60b56d7ed0977e5600400b10a61874e4b5af042cdc5ada98c904e106e2a796079f5e03028466c6d0eefebc9a6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
3cdb8583415975d62bc434e13f70a381

SHA1
ee4152bdbcf4663cf597e9933ae73617f48968c1

SHA256
87d873207e6c117313d5377d38db323aef856a978d01e11dabd5d5dc2a22661a

SHA512
3adee8c8d30f6405854274a1ee55f35e79a399dd0008883918acdb79a2c24ad3ab65842942ec4033923d1037cd9fdbe9a09959088dc0555310866d6ca6cf8667

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
6dccef1ef40c34698d0293ca58493578

SHA1
51ca11d2ad21730c13a8187c2d45b2f9ffec3290

SHA256
3600033ab07a3e7fdc9b5d8b09a0c465218eac9592b60544fa97cb7b5b8fa01b

SHA512
5cedb28106fbe939ec22ab6d3997a2d402b7a14d952868f57951301bf82d0374a2cb06bdd896be3294d9429f8b7914fd9b8747f3cb9356499f4275f715e80b7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
9KB

MD5
f842b9a770c34f32a2f8ce527d8a5b77

SHA1
0bf0b286814eefd0708efd420fb58c25843eddb5

SHA256
f41c8deabc987ae7e08510b0fa370411802b9c0ca82014f87fe2cb8b69dc295a

SHA512
14db246b4db8eec54ee08ccb5493e39fc1057bea77ed3f3c409fbd4de6c6742e88cde1c667c0c80995c171893d61d892a0b939b9d11dfa71bc315ab6dd57f9db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
02ea297f823c658fb5f282cfcaf04a11

SHA1
a9064524da0671d68810036313483a75096c8777

SHA256
3f3c6e32d3c3337772b32f179246e242709ac9fb4639cc6f55c16a8781ea0e1e

SHA512
61d7592f95124b07eff01ab45c7aa79279abcb40264318d1ff78e6c9bba2cc51d42973a9cdc4d34d91e1646271240df5534272833d86d6b7ba74609635a5e729

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
9KB

MD5
e50a5e7a0e42a77b9c098ab8d845931c

SHA1
f5b18c598f27b70176d9f6da714203f3e4485279

SHA256
4f8900183009a4fec7f7ed3341f895354977b5b1f90e6a9759fed6793319ed0f

SHA512
8bb3d4aece0ae496ce7f1c7a725347c75fdfdd23e031cc373ad5f084e8152cd67df3362cd4ea9c23c387714574b72ec15cb5ca2ecadbd19a74380cfdb9373742

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
516a05ebf066adceaa539dfad55a3634

SHA1
167aec8b947e071a01dc910d8566acfdb2b8a79d

SHA256
e8e2b250730d9f1242bdfb08498783e6195b0541763a65efb8ef42f90a7ea0c6

SHA512
2154442700aa489042eb1cb539d4fd5f8b396a546bec658e3d7a497e2d5060e975757d671d2e2fea1186d5d80642547d533b38f9858fbb61b7a7ffd4ac6b1c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite
Filesize
48KB

MD5
d36a1df049e5d58d8c186903025959a1

SHA1
38b62215eb6cd2546129893a894dc66b7894fb31

SHA256
66ccc0e7fc3f7c4c8f56a23c5962781a15007a815a9c2d91596e4a249e9b14f0

SHA512
ea3ecf1b77382cf57988ec66fc9e926df21dc9a6122517faf64452cafc65ce4a68c48b1f4303e9a91b7b7f030709f222ddf8fc3a2f9b596110624ed74653e469

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\storage\default\https+++www.roblox.com\ls\usage
Filesize
12B

MD5
5caae0fb7831e85c93368d35e8009340

SHA1
317833877472c539bfe2b81b69377ba9ece060be

SHA256
acfec7decfc002ccaba3ffdc540855bef790ecf4c91b2fce5f01ef3bd858f1ea

SHA512
8eda692270283c27ec9e75ad03f6dec056993a6b0696ab09293b3b25a638c7f2cab8502f87dcab5e165382fc5d4c83cdcaaf6295bc7dad1994468670f11fc9b2

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Filesize
5.5MB

MD5
94740510822524d579f869a81e02f5ea

SHA1
0e87d714e9eec2eee7c3af028e8e66e7478a107f

SHA256
ad927962330c2d2cf2bf7c33c1a5395df5ccd4ceabfb10c72db240041d773dda

SHA512
7cb3e72b0f1bdcbd53096fdec470fec9a6aa56d56b5f4bfa86b6afaa3ddbd2be6878f7874feb2c15647a627cea34a1fee7be35f6d1dffbf6a5a9c0bf8efa1d24

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.rn9UpWq0.exe.part
Filesize
31KB

MD5
7442c08f3e78582bece4eb541912b7f5

SHA1
6f089318e6b619261caf6b224f8f585a5f96b59d

SHA256
f4971bbfa2989a6b3bfdcd1f36a6b14b3b89872cbd952f8248bf3fa52cb99b7c

SHA512
895d2e97c366b759c3193dcc2e6dde1b386bf423bdc618edb892f0efa28da1c4d14bf6be48d7eb85fde3e833a89f54d686884145c81b8fcee02caa16e9fceb59

Download Submit
\??\pipe\LOCAL\crashpad_3608_YMSQIVSFYTQRMFXR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1608-2218-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/1608-2070-0x000000006B540000-0x000000006B750000-memory.dmp

Filesize
2.1MB

Download
memory/1608-2069-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/1608-2164-0x000000006B540000-0x000000006B750000-memory.dmp

Filesize
2.1MB

Download
memory/4888-232-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-1-0x0000000000DA0000-0x0000000000F78000-memory.dmp

Filesize
1.8MB

Download
memory/4888-2-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-3-0x0000000008870000-0x0000000008878000-memory.dmp

Filesize
32KB

Download
memory/4888-2463-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-4-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-251-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-231-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4888-5-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4888-0-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4888-6-0x00000000098C0000-0x00000000098F8000-memory.dmp

Filesize
224KB

Download
memory/4888-7-0x0000000009880000-0x000000000988E000-memory.dmp

Filesize
56KB

Download
memory/6384-2231-0x00007FFCEBD30000-0x00007FFCEBD60000-memory.dmp

Filesize
192KB

Download
memory/6384-2253-0x00007FFCE9E50000-0x00007FFCE9E5E000-memory.dmp

Filesize
56KB

Download
memory/6384-2252-0x00007FFCE9DA0000-0x00007FFCE9DB0000-memory.dmp

Filesize
64KB

Download
memory/6384-2251-0x00007FFCE9DA0000-0x00007FFCE9DB0000-memory.dmp

Filesize
64KB

Download
memory/6384-2247-0x00007FFCE9780000-0x00007FFCE97B0000-memory.dmp

Filesize
192KB

Download
memory/6384-2246-0x00007FFCE9780000-0x00007FFCE97B0000-memory.dmp

Filesize
192KB

Download
memory/6384-2245-0x00007FFCE9610000-0x00007FFCE9620000-memory.dmp

Filesize
64KB

Download
memory/6384-2244-0x00007FFCE9610000-0x00007FFCE9620000-memory.dmp

Filesize
64KB

Download
memory/6384-2243-0x00007FFCE9500000-0x00007FFCE9510000-memory.dmp

Filesize
64KB

Download
memory/6384-2242-0x00007FFCE9500000-0x00007FFCE9510000-memory.dmp

Filesize
64KB

Download
memory/6384-2239-0x00007FFCEAA80000-0x00007FFCEAA90000-memory.dmp

Filesize
64KB

Download
memory/6384-2238-0x00007FFCEAA80000-0x00007FFCEAA90000-memory.dmp

Filesize
64KB

Download
memory/6384-2237-0x00007FFCEAA80000-0x00007FFCEAA90000-memory.dmp

Filesize
64KB

Download
memory/6384-2236-0x00007FFCEAA60000-0x00007FFCEAA70000-memory.dmp

Filesize
64KB

Download
memory/6384-2235-0x00007FFCEAA60000-0x00007FFCEAA70000-memory.dmp

Filesize
64KB

Download
memory/6384-2234-0x00007FFCEA9D0000-0x00007FFCEA9E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2233-0x00007FFCEA9D0000-0x00007FFCEA9E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2226-0x00007FFCEBCE0000-0x00007FFCEBCF0000-memory.dmp

Filesize
64KB

Download
memory/6384-2225-0x00007FFCEBCE0000-0x00007FFCEBCF0000-memory.dmp

Filesize
64KB

Download
memory/6384-2224-0x00007FFCEBBD0000-0x00007FFCEBBE0000-memory.dmp

Filesize
64KB

Download
memory/6384-2223-0x00007FFCEBBD0000-0x00007FFCEBBE0000-memory.dmp

Filesize
64KB

Download
memory/6384-2254-0x00007FFCE9E50000-0x00007FFCE9E5E000-memory.dmp

Filesize
56KB

Download
memory/6384-2255-0x00007FFCE9E50000-0x00007FFCE9E5E000-memory.dmp

Filesize
56KB

Download
memory/6384-2256-0x00007FFCE9E50000-0x00007FFCE9E5E000-memory.dmp

Filesize
56KB

Download
memory/6384-2258-0x00007FFCEB080000-0x00007FFCEB090000-memory.dmp

Filesize
64KB

Download
memory/6384-2259-0x00007FFCEB080000-0x00007FFCEB090000-memory.dmp

Filesize
64KB

Download
memory/6384-2260-0x00007FFCEB0A0000-0x00007FFCEB0AB000-memory.dmp

Filesize
44KB

Download
memory/6384-2261-0x00007FFCEB0A0000-0x00007FFCEB0AB000-memory.dmp

Filesize
44KB

Download
memory/6384-2262-0x00007FFCEB0A0000-0x00007FFCEB0AB000-memory.dmp

Filesize
44KB

Download
memory/6384-2265-0x00007FFCE97D0000-0x00007FFCE97E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2266-0x00007FFCE97D0000-0x00007FFCE97E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2267-0x00007FFCE98D0000-0x00007FFCE98E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2268-0x00007FFCE98D0000-0x00007FFCE98E0000-memory.dmp

Filesize
64KB

Download
memory/6384-2269-0x00007FFCE9900000-0x00007FFCE9926000-memory.dmp

Filesize
152KB

Download
memory/6384-2270-0x00007FFCE9900000-0x00007FFCE9926000-memory.dmp

Filesize
152KB

Download
memory/6384-2271-0x00007FFCE9900000-0x00007FFCE9926000-memory.dmp

Filesize
152KB

Download
memory/6384-2272-0x00007FFCE9900000-0x00007FFCE9926000-memory.dmp

Filesize
152KB

Download
memory/6384-2273-0x00007FFCE9900000-0x00007FFCE9926000-memory.dmp

Filesize
152KB

Download
memory/6384-2263-0x00007FFCEB0A0000-0x00007FFCEB0AB000-memory.dmp

Filesize
44KB

Download
memory/6384-2264-0x00007FFCEB0A0000-0x00007FFCEB0AB000-memory.dmp

Filesize
44KB

Download
memory/6384-2257-0x00007FFCE9E50000-0x00007FFCE9E5E000-memory.dmp

Filesize
56KB

Download
memory/6384-2248-0x00007FFCE9780000-0x00007FFCE97B0000-memory.dmp

Filesize
192KB

Download
memory/6384-2249-0x00007FFCE9780000-0x00007FFCE97B0000-memory.dmp

Filesize
192KB

Download
memory/6384-2250-0x00007FFCE9780000-0x00007FFCE97B0000-memory.dmp

Filesize
192KB

Download
memory/6384-2240-0x00007FFCEAA80000-0x00007FFCEAA90000-memory.dmp

Filesize
64KB

Download
memory/6384-2241-0x00007FFCEAA80000-0x00007FFCEAA90000-memory.dmp

Filesize
64KB

Download
memory/6384-2227-0x00007FFCEBD30000-0x00007FFCEBD60000-memory.dmp

Filesize
192KB

Download
memory/6384-2229-0x00007FFCEBD30000-0x00007FFCEBD60000-memory.dmp

Filesize
192KB

Download
memory/6384-2230-0x00007FFCEBD30000-0x00007FFCEBD60000-memory.dmp

Filesize
192KB

Download
memory/6384-2232-0x00007FFCEBDC0000-0x00007FFCEBDC5000-memory.dmp

Filesize
20KB

Download
memory/6384-2228-0x00007FFCEBD30000-0x00007FFCEBD60000-memory.dmp

Filesize
192KB

Download