hxxps://google[.]com

Analysis

max time kernel
1800s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2023 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

8^/10

adware discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Executes dropped EXE 39 IoCs

pid	Process
7956	AnyDesk.exe
8364	AnyDesk.exe
8372	AnyDesk.exe
1076	RobloxPlayerLauncher.exe
9564	RobloxPlayerLauncher.exe
6456	MicrosoftEdgeWebview2Setup.exe
1272	MicrosoftEdgeUpdate.exe
4184	MicrosoftEdgeUpdate.exe
5616	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdateComRegisterShell64.exe
9824	MicrosoftEdgeUpdateComRegisterShell64.exe
392	MicrosoftEdgeUpdateComRegisterShell64.exe
3212	MicrosoftEdgeUpdate.exe
7780	MicrosoftEdgeUpdate.exe
8980	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
8252	MicrosoftEdge_X64_112.0.1722.58.exe
4356	setup.exe
8040	MicrosoftEdgeUpdate.exe
10016	MicrosoftEdge_X64_112.0.1722.58.exe
408	setup.exe
8712	MicrosoftEdgeUpdate.exe
1080	MicrosoftEdgeUpdate.exe
1560	MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe
9484	MicrosoftEdgeUpdate.exe
6160	MicrosoftEdgeUpdate.exe
5136	MicrosoftEdgeUpdate.exe
7136	MicrosoftEdgeUpdate.exe
7144	MicrosoftEdgeUpdateComRegisterShell64.exe
7052	MicrosoftEdgeUpdateComRegisterShell64.exe
7864	MicrosoftEdgeUpdateComRegisterShell64.exe
6584	MicrosoftEdgeUpdate.exe
1440	MicrosoftEdgeUpdate.exe
7112	MicrosoftEdgeUpdate.exe
9180	MicrosoftEdge_X64_112.0.1722.58.exe
3508	setup.exe
2144	setup.exe
5184	MicrosoftEdgeUpdate.exe

Loads dropped DLL 37 IoCs

pid	Process
1272	MicrosoftEdgeUpdate.exe
4184	MicrosoftEdgeUpdate.exe
5616	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdateComRegisterShell64.exe
5616	MicrosoftEdgeUpdate.exe
9824	MicrosoftEdgeUpdateComRegisterShell64.exe
5616	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdateComRegisterShell64.exe
5616	MicrosoftEdgeUpdate.exe
3212	MicrosoftEdgeUpdate.exe
7780	MicrosoftEdgeUpdate.exe
8980	MicrosoftEdgeUpdate.exe
8980	MicrosoftEdgeUpdate.exe
7780	MicrosoftEdgeUpdate.exe
4864	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
8040	MicrosoftEdgeUpdate.exe
8712	MicrosoftEdgeUpdate.exe
1080	MicrosoftEdgeUpdate.exe
1080	MicrosoftEdgeUpdate.exe
9484	MicrosoftEdgeUpdate.exe
6160	MicrosoftEdgeUpdate.exe
5136	MicrosoftEdgeUpdate.exe
7136	MicrosoftEdgeUpdate.exe
7144	MicrosoftEdgeUpdateComRegisterShell64.exe
7136	MicrosoftEdgeUpdate.exe
7052	MicrosoftEdgeUpdateComRegisterShell64.exe
7136	MicrosoftEdgeUpdate.exe
7864	MicrosoftEdgeUpdateComRegisterShell64.exe
7136	MicrosoftEdgeUpdate.exe
6584	MicrosoftEdgeUpdate.exe
1440	MicrosoftEdgeUpdate.exe
7112	MicrosoftEdgeUpdate.exe
7112	MicrosoftEdgeUpdate.exe
1440	MicrosoftEdgeUpdate.exe
5184	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\BHO\\ie_to_edge_bho_64.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\PdfPreview\\PdfPreviewHandler.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\notification_click_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\notification_click_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\notification_helper.exe\""	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.61.4_0\manifest.json	chrome.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe

Checks system information in the registry 2 TTPs 26 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\__tests__\identityFunc.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\React.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\loading\robloxTilt.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\InGameMenuDependencies\Roact.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-edcba0e9-2.4.1\JestGetType.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Number\isInteger.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\RoactLayout\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppCommonLib\AppCommonLib\utils\GamepadUtils.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\IgnoreAllFriendsRequestsMenu\init.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\ui\VoiceChat\MicDark\Unmuted20.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-4ad47a93-d2d12716\ExperienceChat\Actions\IncomingBubbleChatMessageReceived.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\RobloxRequests\RobloxRequests\lib\html\voidelements.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC4D2.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\TerrainTools\import_toggleOff.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\ui\VirtualCursor\cursorPressed.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ApolloClientTesting\ApolloClientTesting\jest.config.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\RobloxAppHooks.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\fonts\GothamSSm-Black.otf	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\2D-Collision-Matchers\2D-Collision-Matchers\returnValue.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Fetch\LuauPolyfill.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Components\PYMKCarouselComponent\PYMKCarouselComponent.test.lua	RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.58\Notifications\SoftLandingAssetDark.gif	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-4ad47a93-d2d12716\ExperienceChat\Events\AvatarContextMenuWhisperSelected.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\Formatters\formatRecommendationContextType.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PlayabilityRodux\PlayabilityRodux\Thunks\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\EventHostedBy.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\textures\ui\LuaChatV2\ic-friend-empty-border.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\RecordPlayback\RecordPlayback\Resolver.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\RoduxFriends\Actions\FriendRequestDeclined.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\Shared-a406e214-4230f473\Shared\ReactTypes.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\JestReporters-edcba0e9-3.2.5\LuauPolyfill.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ReactTestingLibrary\ReactTestingLibrary\__tests__\auto-cleanup-skip.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\Scheduler-07417f27-17.0.1-rc.17\Scheduler\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\CredentialsProtocol\MessageBus.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\DiscoverabilityModal\DiscoverabilityModal.storybook.lua	RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.58\112.0.1722.58.manifest	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\textures\ui\PlayerList\Block.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\buildApiSiteUrl-5ccc87be-c56e1d8a\lock.toml	RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.58\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\content\fonts\Merriweather-Regular.ttf	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared-d86ebb2a-ca453478\ReactDevtoolsShared\devtools\views\Components\types.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\textures\ui\LuaChatV2\actions_editing_compose.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\ProfileQRCode\profileQRCodeApi.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Promise\Promise\.robloxrc	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\optimism\depTypes.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-201ca530-56b79d20\ExperienceChat\Actions\SetCoreGuiEnabledChanged.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Alert\AlertTitle.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Math\.robloxrc	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\Otter-7466d762-0.1.4\lock.toml	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameIconRodux\GameIconRodux\Selectors\getGameIcon.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Symbol\init.lua	RobloxPlayerLauncher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.58\Locales\gd.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared-a406e214-4230f473\ReactDevtoolsShared\devtools\views\Profiler\utils.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\QRCodeDisplay\QRCodeDisplay\DisplayQRCode\DisplayQRCode.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD9A9.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.58\icudtl.dat	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphQLServer\GraphQLServer\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphQLServer\GraphQLServer\schemaUtils\schemaUtils.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\RoduxCall\RoduxCall\Reducers\callList.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UnitTestHelpers\UnitTestHelpers\mockStore.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-4ad47a93-d2d12716\ExperienceChat\listenToDispatch.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\ExtraContent\LuaPackages\Packages\_Index\NetworkingCurrentlyWearing-96003ad7-1.12.0\NetworkingCurrentlyWearing\CATALOG_URL.lua	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	3536	WerFault.exe	18

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\BHO"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\BHO"	setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133268397513689375"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\MSEdgeMHT	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}\LocalService = "MicrosoftEdgeElevationService"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.58\\notification_click_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationCompany = "Microsoft Corporation"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationDescription = "Browse the web"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
8364	AnyDesk.exe
8364	AnyDesk.exe
9684	chrome.exe
9684	chrome.exe
9764	msedge.exe
9764	msedge.exe
10208	msedge.exe
10208	msedge.exe
7744	msedge.exe
7744	msedge.exe
10092	msedge.exe
10092	msedge.exe
7372	identity_helper.exe
7372	identity_helper.exe
7956	AnyDesk.exe
7956	AnyDesk.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1272	MicrosoftEdgeUpdate.exe
1272	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
9820	MicrosoftEdgeUpdate.exe
1272	MicrosoftEdgeUpdate.exe
1272	MicrosoftEdgeUpdate.exe
1272	MicrosoftEdgeUpdate.exe
1272	MicrosoftEdgeUpdate.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe
1076	RobloxPlayerLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
10208	msedge.exe
10208	msedge.exe
10208	msedge.exe
10208	msedge.exe
10092	msedge.exe
10092	msedge.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
8372	AnyDesk.exe
8372	AnyDesk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2988	4100	chrome.exe	85
PID 4100 wrote to memory of 2988	4100	chrome.exe	85
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2616	4100	chrome.exe	90
PID 4100 wrote to memory of 2592	4100	chrome.exe	91
PID 4100 wrote to memory of 2592	4100	chrome.exe	91
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92
PID 4100 wrote to memory of 4680	4100	chrome.exe	92

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://google.com
1⤵
- Drops Chrome extension
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94f19758,0x7ffd94f19768,0x7ffd94f19778
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4376 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3212 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4820 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4832 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5052 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=828 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4804 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5220 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5552 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5676 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5088 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5688 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5760 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5988 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6548 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6728 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6608 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5220 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4524 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5092 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=828 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6124 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6212 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6916 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7032 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=4492 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=7256 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=7416 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7580 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=7456 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=7716 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8132 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=8260 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=8264 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=8660 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=8836 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=8804 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=8656 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=8484 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=9356 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=8516 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=9824 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=10468 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=9912 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=10012 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=10020 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=10060 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=11072 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=10928 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=12056 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=11808 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=11680 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=11420 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=11392 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=11352 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=11100 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=10784 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=10636 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=12796 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=12672 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=12652 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=8520 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=12240 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=12232 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6844
- C:\Users\Admin\Downloads\AnyDesk.exe
  "C:\Users\Admin\Downloads\AnyDesk.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:7956
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-control
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:8372
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-service
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:8364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://help.anydesk.com/en/share?utm_medium=app&utm_source=adwin
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:10208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd91f946f8,0x7ffd91f94708,0x7ffd91f94718
      4⤵
      PID:10236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14644516281677050934,4642090497934921191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:9728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14644516281677050934,4642090497934921191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:9764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14644516281677050934,4642090497934921191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
      4⤵
      PID:9944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14644516281677050934,4642090497934921191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14644516281677050934,4642090497934921191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://help.anydesk.com/en/share?utm_medium=app&utm_source=adwin
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:10092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd91f946f8,0x7ffd91f94708,0x7ffd91f94718
      4⤵
      PID:10120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:7448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:9480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:7376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:9528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,204305515867837952,9155401941394540550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:9532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9676 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:8144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=14060 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=6708 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=14484 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=7484 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=13596 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=14636 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=13932 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=13916 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=14596 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=14664 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=14688 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=14812 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=14936 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=15064 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=14672 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=14340 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=17720 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:9684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=17916 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=100 --mojo-platform-channel-handle=17560 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=101 --mojo-platform-channel-handle=17600 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=102 --mojo-platform-channel-handle=14444 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=103 --mojo-platform-channel-handle=5196 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=14480 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:7316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=15704 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=296 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:9920
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Tower Of Hell NEW GUI JULY 2020.txt
  2⤵
  PID:8352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=7584 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=108 --mojo-platform-channel-handle=9804 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=109 --mojo-platform-channel-handle=4704 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=110 --mojo-platform-channel-handle=17576 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=111 --mojo-platform-channel-handle=6336 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2748 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6444 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=114 --mojo-platform-channel-handle=5536 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=115 --mojo-platform-channel-handle=9840 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=116 --mojo-platform-channel-handle=6020 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:7608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=117 --mojo-platform-channel-handle=14180 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:7832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=119 --mojo-platform-channel-handle=9840 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=120 --mojo-platform-channel-handle=6004 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=121 --mojo-platform-channel-handle=15680 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=122 --mojo-platform-channel-handle=8200 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=123 --mojo-platform-channel-handle=3288 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:9544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=124 --mojo-platform-channel-handle=8164 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:8764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=125 --mojo-platform-channel-handle=14620 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=126 --mojo-platform-channel-handle=1736 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12844 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7444 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:7268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=12872 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:7296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8572 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:6680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12868 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:8
  2⤵
  PID:10056
- C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
  "C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- - C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
    C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=3f368f2239fd95fe34aa8c4dcce2f54fa0700bce --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7a0,0x7a4,0x7a8,0x678,0x7b0,0x792768,0x792778,0x792788
    3⤵
    - Executes dropped EXE
    PID:9564
- - C:\Program Files (x86)\Roblox\Versions\version-40b6a27c6c4d46ef\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:6456
  - - C:\Program Files (x86)\Microsoft\Temp\EUD9A9.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUD9A9.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1272
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4184
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5616
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:400
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:9824
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:392
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTRENzY5MDEtRkQwNS00RjRFLThDOTYtM0E3NEEzMjZGNDlCfSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MTk4NEVCRi1BQzBDLTQwMDItODM2NS0yMUYxRTc4MDZGQUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTA0NTU3MjUxIiBpbnN0YWxsX3RpbWVfbXM9IjE1OTAiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        
        PID:3212
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{94D76901-FD05-4F4E-8C96-3A74A326F49B}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=132 --mojo-platform-channel-handle=6424 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:7644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=133 --mojo-platform-channel-handle=7788 --field-trial-handle=1872,i,13799728959470963581,7679759715521540529,131072 /prefetch:1
  2⤵
  PID:3864

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 3536 -ip 3536
1⤵
PID:1640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3536 -s 1772
1⤵
- Program crash
PID:4232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4ec
1⤵
PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9412

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:8980
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTRENzY5MDEtRkQwNS00RjRFLThDOTYtM0E3NEEzMjZGNDlCfSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NzQ4RDg1NC1BRURBLTRBRkUtOTdGOS0xMDc4NjhBMzdGMzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTEzMDY2MDE4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:4864
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4011F8FA-E1D1-40AA-AD27-83352FD3E7A6}\MicrosoftEdge_X64_112.0.1722.58.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4011F8FA-E1D1-40AA-AD27-83352FD3E7A6}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:8252
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4011F8FA-E1D1-40AA-AD27-83352FD3E7A6}\EDGEMITMP_7AF8E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4011F8FA-E1D1-40AA-AD27-83352FD3E7A6}\EDGEMITMP_7AF8E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4011F8FA-E1D1-40AA-AD27-83352FD3E7A6}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:4356
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\MicrosoftEdge_X64_112.0.1722.58.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:10016
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\EDGEMITMP_3CD7E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\EDGEMITMP_3CD7E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:408
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTA3RTdFNTgtN0JGQi00RTlBLUEyODEtRjlCRDkyMDUxQUE3fSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFRURBOUMyRS1GRkU4LTQ4QTgtOTcxRS05NUE0QTVBRjM4QkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuNTgiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTkwMTMxNjU2OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExOTAxNDM1OTY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNjM0ODQ1NTM4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMzczOGUzYTMtMWE0OS00M2UxLWJlMjktZTRlMTY3YTdiNjRkP1AxPTE2ODI5NjQ1MTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YkRXTFlsVnhKUkFRTURpazZad0U4Zllibzhibzc5azNaTjZtWGgxaHclMmZZOHplWjFwVUtuJTJidGlRWmNxSDRkeDUlMmJUZXhINmtMemJjQjduYTNvdjhKRWclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjYzNDkyNTU2MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMzczOGUzYTMtMWE0OS00M2UxLWJlMjktZTRlMTY3YTdiNjRkP1AxPTE2ODI5NjQ1MTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YkRXTFlsVnhKUkFRTURpazZad0U4Zllibzhibzc5azNaTjZtWGgxaHclMmZZOHplWjFwVUtuJTJidGlRWmNxSDRkeDUlMmJUZXhINmtMemJjQjduYTNvdjhKRWclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNDMyNzU5MzYiIHRvdGFsPSIxNDMyNzU5MzYiIGRvd25sb2FkX3RpbWVfbXM9IjY4NTAyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI2MzUzNjU4NzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjY1NzAxNTUyMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0MjYwNzU1MzgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxNzkiIGRvd25sb2FkX3RpbWVfbXM9IjczMzQwIiBkb3dubG9hZGVkPSIxNDMyNzU5MzYiIHRvdGFsPSIxNDMyNzU5MzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9Ijc2ODk4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:8040
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTRENzY5MDEtRkQwNS00RjRFLThDOTYtM0E3NEEzMjZGNDlCfSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEOTRCNkY1RC1CQzMxLTQ4MzItOEQwQS1CNTJFQkJDNjAzNTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuNTgiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5MjEwNjU2NzMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTIxMTU1ODA2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI3OTYzMzk0OTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzM3MzhlM2EzLTFhNDktNDNlMS1iZTI5LWU0ZTE2N2E3YjY0ZD9QMT0xNjgyOTY0MjIxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVMxV3BYVUxQR29GeVB3Y3UlMmJnZEl2NmhBYU5PZW92VHAwdEZmdW04Q0IwNE85WEVyb2wlMmI1UXpPNVpuSmM1YnVSRzFENkNEdzF3YnB3ak9PSFNzMXhKQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE0MzI3NTkzNiIgdG90YWw9IjE0MzI3NTkzNiIgZG93bmxvYWRfdGltZV9tcz0iMzc1NDEwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI3OTY2ODU1NzIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzQyNjI4NTQ1NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM5NzA1NzU1NjkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzMDIiIGRvd25sb2FkX3RpbWVfbXM9IjM4NzU0MSIgZG93bmxvYWRlZD0iMTQzMjc1OTM2IiB0b3RhbD0iMTQzMjc1OTM2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDQxNyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:8712

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:9820

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:1080
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{82338647-182B-47E7-8A8A-1F95183B400B}\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{82338647-182B-47E7-8A8A-1F95183B400B}\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe" /update /sessionid "{A7104CAE-83A0-410E-9768-FFD25375A008}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1560
- - C:\Program Files (x86)\Microsoft\Temp\EUC4D2.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUC4D2.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{A7104CAE-83A0-410E-9768-FFD25375A008}"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    PID:6160
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:5136
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:7136
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:7144
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:7052
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:7864
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTcxMDRDQUUtODNBMC00MTBFLTk3NjgtRkZEMjUzNzVBMDA4fSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OTZCNTA4NTQtRjEyRi00NkUzLTg5NEItQjcxQUI1N0E1QjE1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE3My41NSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTY4MjM2NjYxOCI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQwNzcwODYwMjEiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:6584
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTcxMDRDQUUtODNBMC00MTBFLTk3NjgtRkZEMjUzNzVBMDA4fSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGQjUxMUMyRi1CNjc4LTRCRDQtQTA5RS0xN0FBOTgxNjQxOTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTczLjU1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IlByb2R1Y3RzVG9SZWdpc3Rlcj0lN0JGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzUlN0QiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDMyMjQ1NTQ4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDMyMzY1NjczIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDA0MTYwNTQzNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2ExNDVmZDA2LTNkZTMtNGUxNi1hZTE0LTFjMDhiZjFkNTI3ND9QMT0xNjgyOTY0NzMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVIyY0REeEY4VFBkWjM0UUIlMmJuQ0tuJTJmSExIRGhqRWNFaDZTazh0YmFiJTJmNUpyaXN3dVdZWmhPd01ZdVJLdVk1bUZGV0ZuQktTMzd0bkpleERzM3dYa0NnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQwNDE3NjYwODkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2ExNDVmZDA2LTNkZTMtNGUxNi1hZTE0LTFjMDhiZjFkNTI3ND9QMT0xNjgyOTY0NzMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVIyY0REeEY4VFBkWjM0UUIlMmJuQ0tuJTJmSExIRGhqRWNFaDZTazh0YmFiJTJmNUpyaXN3dVdZWmhPd01ZdVJLdVk1bUZGV0ZuQktTMzd0bkpleERzM3dYa0NnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYxMDE4NCIgdG90YWw9IjE2MTAxODQiIGRvd25sb2FkX3RpbWVfbXM9IjU3NiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDA0MTg1NTg3MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDA0NzI3NjAxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjYyIiByZD0iNTg5NSIgcGluZ19mcmVzaG5lc3M9IntENUIxNDU0Qy1DOEEwLTQyNDUtOEI3NC0xN0NBMjg2QzBFMTN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzI2ODM5ODg0NTE0NTA3MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSI2MiIgYWQ9Ii0xIiByZD0iNTg5NSIgcGluZ19mcmVzaG5lc3M9IntBNzZFMTQ3Mi04NDE3LTQ5OUYtODdEQS00MUMwNjk3N0YyRDl9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjExMi4wLjE3MjIuNTgiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNTk1NyI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0iezJDRjdEQTM3LTY5NzEtNDZCMC05NUU1LUJENDBCRUNFODM1Nn0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:9484

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:7112
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\MicrosoftEdge_X64_112.0.1722.58.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Executes dropped EXE
  PID:9180
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\EDGEMITMP_85015.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\EDGEMITMP_85015.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\MicrosoftEdge_X64_112.0.1722.58.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - System policy modification
    PID:3508
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\EDGEMITMP_85015.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5651E468-33B7-4F70-AAC9-CDA042917396}\EDGEMITMP_85015.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2144
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI0RDc3MzMtMzFEQS00MDc3LUJCREItQkVBRTYwNzFFQzlCfSIgdXNlcmlkPSJ7MzA1RDc2RDItRjYyOS00RDFFLTkyRUEtOTYwMTMyMzZCQ0FEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxMEI5RTc0Mi00MzAyLTQ0RUUtQTdDQy0xQ0QzRkQwNjM2QjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNTUiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iUHJvZHVjdHNUb1JlZ2lzdGVyPSU3QkYzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNSU3RCIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45MCI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNTk1NyIgcGluZ19mcmVzaG5lc3M9Ins4RURGQUI3RC0wRjhGLTQ3MUEtOEZCOS0zQzRBNzE1MjVGODV9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTEyLjAuMTcyMi41OCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzMjY4Mzk4ODQ1MTQ1MDcwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzMxMTQyNTg2NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzMxMTUwNjIwOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzM1ODg5NTkzNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzM3ODExNTQ1MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTc5MTk5MjU3MjMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMjI3IiBkb3dubG9hZGVkPSIxNDMyNzU5MzYiIHRvdGFsPSIxNDMyNzU5MzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjU0MTc1Ii8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNTk1NyIgcGluZ19mcmVzaG5lc3M9Ins2OERGQ0U4MS0xNENDLTRDNTktQUM2MC04QTlCNTUwN0IzMER9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjExMi4wLjE3MjIuNTgiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNTk1NyIgY29ob3J0PSJycmZAMC40MiI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNTk1NyIgcGluZ19mcmVzaG5lc3M9InswRTU1NjVERi0wNTMwLTQ0MUQtODJDOS1DQjMyNDYzQTQyMTZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:5184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.58\Installer\setup.exe

Filesize
3.8MB

MD5
2b84110ac08606630b090cef9cd4dee4

SHA1
e0b302d5c1a506937e97079d08f288b1516d3006

SHA256
3b99363e2843f443bad54974c29c8ab1cc854d9677dac85c3c15cd5505f55971

SHA512
8550177b0f9b68f2a0808c005fc2e27a6e8781a64e8993dd311d3e82375ddbde7389e1b01c90233703cc8781456aca5fa4b56954e6a09cc8e3ddad6b8125de67

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\112.0.1722.58\MicrosoftEdge_X64_112.0.1722.58.exe

Filesize
136.6MB

MD5
64949659b6b1b60032e72d732220ec56

SHA1
ad45d828eccfffe4abd7170cfc50e5a68f477499

SHA256
28ac10eaf69a2c17349b7d69d33d8cf194855894110f87bfae4be9396b8af9d1

SHA512
a10c419dd0b457460dcc427976238ae65c684eaaf35cb0681b4101d72c30006309b5d37b7472c5d9cd9aa39f0957221ffbed779b9b3301105b8741f9f0d035f6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.173.55\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe

Filesize
1.5MB

MD5
b59dd0b3c4a92cdfc4c61c2932d31c40

SHA1
e325e59f569ba97c9a9fecfe64fc202509609589

SHA256
314d3cf516b614d1add7b827a866ae8433dd116773fe633cb3591371d3cf50b7

SHA512
71cb2b7083b9473c48e04a69c1f23f928c8a43d8099e59633a0ae10811d08ab58adf2c015d85eac95f0c6308b043d1b796e299bdb9c78873ee82d272153b9b11

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2EF60444-1889-4B67-81DF-C0FF4E0F6390}\EDGEMITMP_3CD7E.tmp\SETUP.EX_

Filesize
1.5MB

MD5
a35467692ab81bccea821770526e3576

SHA1
4b388a698ca5c82c03bbc00810dae56e5b21aad4

SHA256
0a8a6ae067f7af1d33d9cba00e87b59131072b648990a31ffdfd055fdae4b659

SHA512
8746bc887fcfa16a18e9efee19d2c51902105527a9ef56bb9c2ff0fdb6c5ac1a39793b1b96a9022f3481cccec44ebe573d90648f21924e2c7c07bf98888638a5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
869a00ad6525080f22e06f0a8b5a8fd0

SHA1
053085ba1ef8264f2c030fae52ad7c8fa541bb08

SHA256
b6744e15755e1b1e8ef266aade9330dc61961344e4e1db2cd2041ee81cbe00c0

SHA512
9dffbfc8769581d0d92bf7ede1fbb0d564305360bf73b70c177f101c85708d4ad591235257fb63ba43ea5270f08a2268f89cf81b3d1e7673d9618563299977ce

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
118KB

MD5
3d0bc7144a4a02a88d7f0062ac8da602

SHA1
6b9412cb36a9dfbce8a443f83fcbcf323fa4ef5c

SHA256
15abbff7231cba349a5a770403da9b638f096e972177347ec52e1ff0a37ee81f

SHA512
9a33ebb31e3d0cb03ddea07a69856c86989406db32780ec35e2d6391eeb73e6958a0042f3398bd067fbeedc0f1520c6e972543f3ba80f66af5441543e195842c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e2bf1a0-affc-4722-af15-cec78cb8b880.tmp

Filesize
8KB

MD5
022d989bc85b8324683cf1793ff7a297

SHA1
ae54909534a7992c19a21e2eec66cd4a6875753e

SHA256
daf38cf2428f3c9328381e31b643e5b19240cdfb56f5ac8344cf1103381c7de0

SHA512
93e51edfc1b4162c825a0d2ba1909e697d14c07537c993d7a7c6054323cdc1608e6ebd2561f508ebd57602a2ab00b15a65bc1682f43a756be8ee758cf460a1d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
298KB

MD5
5385cf3b38909ac87add8fcc21b99d1d

SHA1
8ac5fbf87b07f71850de9dbcc31eec042566b7b2

SHA256
4da964eed0c4e6e69c5b73455917ef4f7cfe8ea95c2fa899d1f021e2e9f36b19

SHA512
4f418bfa6e58a0bfb9cb43eed7ef128f384107aeeefd4de5ea70c097d6f633341defac96da6d79c81e7cf69024f30ea4843f50bb5222fd119133b04dae7288f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
58KB

MD5
adbd94ef92cdb93977edf2095a0bf74f

SHA1
02b74f4e62ff2878d69b98d91a9f67dabde5b7ff

SHA256
cb3f2dc0a5a68cb84e3a2c1782466ed5a1bb11bc1a30e0db6da2967d26a2f4db

SHA512
cf1f61830bfbd0b42457fc1657ac3cc089e5991273fe65d0bd1ecefa6ed47339f312f455ce0218224fbbd9f6dc4e8283f585a92d653b378ff0678877c2eb35a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
65KB

MD5
a7b7e7918a12587fee69cc84717f74cc

SHA1
6d002c60853e5c94a48817fb947ac1b3d16f1b6e

SHA256
605b901bc776b2358a2ea914f06c9da0ce5b422b01f764f308c68e9a789ca3e3

SHA512
85b0c4cdc2e67f6125ce2abc45bb934ea14c0c1a27b9bccb9e1fea7638ca7680765c39e15ad64f00f1fe8568c9ea10a57e6f6d96a21c1d10a339991600b7dd2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
183KB

MD5
37970681fa42f324a51a69858d7aad1a

SHA1
086496733df7bc31fbccd0958280c226b1232805

SHA256
23bbccf376b69943147f3654f512b230b9d2c81d5fa4b2b550834a5fe65b1a89

SHA512
b45c10bef8a9e9814a6e969f7ef4948719cf06384c9090d786d0c076229472e4f0d54a8712d60167eb599d9f3864839935dc0c8cc4f3f30abce1898b79b19cb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
204KB

MD5
52cbbe95da238f6937e4abf9ecfe8972

SHA1
2a3f49008725f7facc9fe82612d0b600d5185581

SHA256
c69bdbceedbdba063a8be4abb468a2875fa34111b7e4ac3f196e10e82322e8f1

SHA512
d2e3c6cb37e7705a03d1feaec270f16108bcd20025083b8d205d18dd4a56a8459cfc1e8b0217f474cee725f0e9c2f40d4babeaa6c37a73c1d95a2aa2f532922d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
71KB

MD5
32dec7ab393d3601798464920564e744

SHA1
02313ebb6634f405c3f1710e9eba960d72f01b31

SHA256
4d7844ca2733acb730d05ec27083557b4c43b087581b4afc3fbdadbdd099b7d0

SHA512
6c793d6a64f74bd326da926c4e6c2a6ca1bffd0b8e06fae63d4d5a013140d92048184471341316e7ecdc29618e189a4fd8d2187387917717a75422c28aca3412

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
24KB

MD5
0fcef8a3e9a41269eb9c9df33722bc7f

SHA1
4a9424591aad7b736a082b8f90f27650b0b39514

SHA256
ccb14bba85e3eb77d06819c8c25459071fabf614ec77c69d116982a2d1242032

SHA512
7d4ad8010fbb0cf0ed0f88f408431824cb9fa198bf2d83d3c257ea6074f7747106e35f386d693a4655a5f8e8883fa6339c37dc34536e7d7953a9e09e5cea8158

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
448KB

MD5
2c4a5013355206c9c281c748ea32be01

SHA1
90eeb2ff636d4768adb2b9774657a2190c276f5f

SHA256
eaf88c4f6bd4e8af35fd37790054b3b1d179f2e8cd1974bcbc814b7b89c632da

SHA512
84d6e91f32ae9653ea23dce31a219dcecf2fe0242493964bb70db2891b7a35ce4733c74707fde4218b2b487faaa97d263ca7a6b30f5226994a6fa7d202e1ebef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
61KB

MD5
2ae481e033a753971873e2cce3c32a5b

SHA1
ba2f3adf58b405bb029a855720fbafcc0b591fed

SHA256
1461d2fb9063eef3db5c03a35dea821eb69bb5824a9d1321fcb678f56d46e6e6

SHA512
c5d06f38e7bddca10f1f0639a60753b7985a1b04aaa2054dce773aed90fa5887e3099a913a5f48b46d6c72f0684eb732f4ae73b75cf2509a37c382160729eb9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

Filesize
50KB

MD5
4d5969d9a6a18f7fe070454369cf0bd1

SHA1
5e46f37bf68f780973e32060b7891e0dffdd5440

SHA256
63ff9d59f60ff517b99c303daeed1c94f530ac3a12ebe9a0ed7fba156c5a26e6

SHA512
53db79ca423ef1ebd584f1cbc3f8a077a69b7473683ac47df35030906e66799002f107999620b249a48f041ceb31a30d254b0e1b5c2ebd71daf635a6735aaa3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
109KB

MD5
c725c40ab16e92910f2ab34b29112b36

SHA1
d71218874ecdd5706eff70424151086f4dc4dedf

SHA256
21263c13e09f2381801018650c19cdd5b3d21bed325acca4d511ef5e26abee2b

SHA512
386034e8359ef3b31c9efad4629b35f6bdfb42d470dcdec84efa4e63e71d066d63d4c32b6c9a3d109138afc04b163012d44df9749f33805a1e019e4091f63bc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
621KB

MD5
5e90a44d7b16ce52222a85f562b5e3be

SHA1
b2bef6d62fad2e91a66ffd7f85fb68a039958048

SHA256
2838fb276999092198469c2bdd35cc52fc6954ded445e0f894d5a401b3662a34

SHA512
b0c8e8d0de6893252cacc60670ec336bcd6d1f83c32e4341afc9b96693f0d0858fdd39bad96c0215cf9dc0f5202cc6ec97e4715e56da9f9f47de757a24a0fe2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

Filesize
35KB

MD5
d2474e8b4975d87b81e09f649c5a07c4

SHA1
38caee433a065a332435ad24b6f856845e16be75

SHA256
59429a692d5a9146b23da22d5dd6a3ce552a71e78c2799a464f9902a4f5e2456

SHA512
716bd7b733656f30b54893435476627b3961ff03da3acc14f8e0e6a7413917e2e4142557557d6bda20de1ba33becad92061c2571838298af8aa727656dd1f288

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
69KB

MD5
7c28204617c5ecd822f0ec58fe258f23

SHA1
e4ecdc46c47b26598c9535a91fc19355fa7e7d83

SHA256
63230415cc56da3f073dbdf0d6feaf86a81570ce0048c1240d8cf0bc2a59371b

SHA512
6da8d2dfa34a6946714fde6c918004442934f9cc5d473cc261d546af13d74b322b810eabc0d40f5db2c7e3900f8ccbed31e8350a96ee91a61f1cf5073b009707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
78KB

MD5
843be48e6a286fe32893e2f2a6f3c2a1

SHA1
af4702be9f8e4a74c6ac149f10cd1d9f9a2dc34d

SHA256
a24aad2aadc1c8a7bc24241b2ecb1707fec0e4a0f9d07178ed45933848bd0029

SHA512
5f5efd02633e133ec91e007ebf548412e198e55ae8514c8c508aa56339aefb63d0f75ef411aabf2054665fbc55e53df776e26473688d1c3284733e28d38b7e9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
37KB

MD5
519005befdbc6eedc73862996b59a9f7

SHA1
e9bad4dc75c55f583747dbc4abd80a95d5796528

SHA256
603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44

SHA512
b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009f

Filesize
19KB

MD5
ca7fbbfd120e3e329633044190bbf134

SHA1
d17f81e03dd827554ddd207ea081fb46b3415445

SHA256
847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db

SHA512
ab85f774403008f9f493e5988a66c4f325cbcfcb9205cc3ca23b87d8a99c0e68b9aaa1bf7625b4f191dd557b78ef26bb51fe1c75e95debf236f39d9ed1b4a59f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b2

Filesize
28KB

MD5
d0776eb7cde18b291dc9dee7f9c2ef2e

SHA1
c76bf9b81e051b302086d86cc47df657f4a83820

SHA256
f0763896e139e7869ec8d01fdf448f3adcf9126fdba28462824964fd2d40f766

SHA512
fab23a25f761872558dfcae8742e88d41213ee0a5e353bf570c8e7693d41422461c649d5e26abaef3def37be05cb9716dee9ba28270842b123c3caf3a1665530

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b3

Filesize
60KB

MD5
1544f6312fd46895d4bde1ffb91f1f40

SHA1
dfd162dbe4e2d542913588fa6a1aa4ff245823c8

SHA256
1fbfe884db8daeab0721bcc1660b5282dc0e34d862a0fccb96f9b52c2e055c86

SHA512
c057eaa9fbb9a98a9e415cdf219688cd15f6b6f5ec151c87e185dfd7fd07530aa6fb5c87ad93e488d085bf054e961b679dd6f15a2d461b2e3182b15b65739ad1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c4

Filesize
36KB

MD5
4f9b890a6c4cfbbfd0fb7eff98bf4dde

SHA1
2db204fb0ee448842b40f84463234ea496763130

SHA256
8e0d4c67a688228e1ba10b1e1dc367c078edf7e9bc35be0bd4ae8c0ce980647c

SHA512
ce1df4472eb63a583b4b0437b22cc6b2c87569e2d94fa505adf64d74247bac3e93b02a1a49af8eaa4cfd74ec44d1891e989b98e40a81c37621943f5525645e71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ef

Filesize
96KB

MD5
2639291d875ba670fc8de04562d06173

SHA1
4f98b16e777a0acaf7dfcd51ff9b8fcd555632d6

SHA256
ac405bc669127a8143f60e44d5c94eb2eb1baf5b55b7417e0474892f4d70cc3b

SHA512
5dbd57fbbb7fa0b98a7d0f0929ea93370d7bab142f5e95defc69c0d039d4db4c6f59f6d4bbcd3fd99c215ac23640144fcf05e2a46be6f0945a89173791ff64b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000109

Filesize
124KB

MD5
9d732c3253eb4f8f49f658bada8dec53

SHA1
63ae72003fc62a56cb69c6eca5b06adfe40ad107

SHA256
68295aea539afa049d327fa55b8b8d775978305aadda72f6ab6af68699c82c18

SHA512
5ca89046bd1bafa7637856fb353f951827b2faa4ae14b3628e15ca5966df06035f50934f9668fe6eb6477114d2926d915c5b6051da4aa70ee3ba7113bc567d06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00019a

Filesize
48KB

MD5
2d077a32a6e9b58fa01f9c57fcd88d0a

SHA1
fcf640900bead97bc5e833f4bc3ac15a34bb714b

SHA256
14dd2310b85f0463b175b9a3096bf1e03d58e80b4825d51fd85830713433f6b7

SHA512
69ea14074af556272f3c1ef6cc49da1487421a4807820a732ff61157185573609bcdbfe5b0ea2cf3fe8fc67e5a7f4052ed8bc6dd47509565afc6d99aad9a6a4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001c9

Filesize
27KB

MD5
c7dadc9a9b96ed2e6917e8dc39ea9caa

SHA1
1115cc2f5ba2af0bd6c5306469da6bff5383b01d

SHA256
fdd5270dd316eb0d897b0c222fe7e3dd81457834c162b9cf34f16f1648728549

SHA512
026135b93bb61de9a2b78f8762fbcc10ef792ad8103e6c1175038e038918b7782417ae2783ae7e4507ec895e44be5781c11757d3449652050ac3212c65712b4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\18822cb9f719b32d_0

Filesize
241KB

MD5
b5bc8d9efdafd7d972767de3fe4743ea

SHA1
1890d350e11da56ffde9439da50260d5898d2189

SHA256
8066200df42fb1c8a5f8037e8d75e4ab3e8d1903fab5edb76e8ce4aea298ba92

SHA512
30814cd472a55c4e1da0013170a0b5d4972e3361320702fe139ea56ad42255cb26bc7ea1fbd89f7c59934a776288f18e120530a06508818f3bfbe494d9d938e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\43070d0bf938b467_0

Filesize
56KB

MD5
cf61a6b1d62e792fc75afd247905ceb8

SHA1
a0b93f468071afd4e16fd09b3b2172bd0f28958e

SHA256
d9bb12729426ae5968ea88e190728c5a6964e6e9a8e5ca72da31d345879d45c3

SHA512
2377ce3479c01a5fb196a1a0aa8d4cf0509925cb5b6ef794c25c4334589d97d87b3ebd874eee6c77d6f4cbbfad174f09955b20b6abb96f78ad4fb37e9875c354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\45a924788d299aa5_0

Filesize
208KB

MD5
7eebad6da23be18f6f3702802acbbfdd

SHA1
86c809827f273384f1fbb136643fec23cf7b27eb

SHA256
65133406640d87371be3c4bc7ca6340f1d6fa7db00e25182237dd80163a3a597

SHA512
ea4f8afb17fde5de22fedbfdc34d14212f9c52f5d923f380bad27ef94d187f92aede6e1c56e009d9ef1840093fc484b8ecf7cf9f04f2ee3c5fb708670cf2af4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5b96ad509d65f9d6_0

Filesize
127KB

MD5
e740f3f75b16df2d7ab8f6da8dd3e493

SHA1
0b912f74b1969c1cccc286ea294e3e6f645d5de1

SHA256
5e5aefffc6466c360f73ca49cb9d73dbe9ae077381faec9602cefc986a5354ab

SHA512
69a5db884257a632b79ece3eb273aa9c0b64874ede75a70e9c85c67953f8278a4fdab34419c17b88ff0618d0e7e93894075e44c288c070a4fcd056f0d272cb67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\65e24082aff47c04_0

Filesize
1.3MB

MD5
6b4a5d630b9e52e926273860938eee48

SHA1
4d2d59d13a1a0591301379499d00fd562bbfea33

SHA256
53cae65143c37dfb05a2ba012e26a5e185e31167b4708cb4a0205afbcdc07f75

SHA512
6c536b6ef9ed859e04f2d0dd3bc9fd616b9fb7be71bacb3eb6b9db75e5508b15296666dc8fbeab31810d2f8b4a914bc4e668f6d78a54e42033f30f6530fe183a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6846c1669a092749_0

Filesize
279B

MD5
7e963182cd7ed94931d682b633d7e89b

SHA1
413fe769df786d3fde318f8df79b4941d11d980d

SHA256
dd24bc085d47742bc61cf693666595fdfb96080c44810b31b8353588926b5d85

SHA512
0429cd6b51c45f0a3c2c49118741268ee5b72684662c980bd5822b8eca2636e4629be95d2e7bb62b4be7d3fa4869e89a6441bf6ef3c7756c023a5639877bd06b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8079a824fd1d7d4e_0

Filesize
281B

MD5
a7049dd82f7459eb4d61d6e01ff7f1f2

SHA1
7e2771d12ef9d47b062ebcd9b2135d6b728630e7

SHA256
8ca95ef48f964e3815e3568d3405ed52779aa21eaec6879f7cc24f7917b56b38

SHA512
2d13fead7716572ca3a9ea3610e92caf134ef6cea2cf32334ffd6e471abf9cff498b2311acce86cbb4ec61beebd88df04fe029e302e3ca5587b26a7c3f1a2737

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\83236c4fbd96e4ee_0

Filesize
8KB

MD5
e7c094b0ed9bfccc7c12dad32b469c78

SHA1
34808a58c13ea335a20966e4fc1359ff8b1430c7

SHA256
c038091e9d6f36ec898bd923d57736d37d3b7dd0bba6de0fa2bb86c332549fd4

SHA512
513202266eee6279e064bfa5ffc07f0443a28068af053d8ef3a5cc100fa1ca245c52547d4f1be3602dcc7a86ca615e5d2c03c40faef6f8027186fb9dab8eaeb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\869857100d98e93b_0

Filesize
37KB

MD5
f6fae02dd5de91bf96226439e190e45b

SHA1
188b5249eb64f2271bb991372d592af5187ec4e5

SHA256
ee73dd14f3a688f9074edb2d87c5b244625112ce5ec5fdb0bc6f5b4d1bddb7a2

SHA512
6fab3e83b36b7770a2d957f40e607fdf4a35fda9bfc3d5602d1c10f180d8d7b1139a0027f9de56fe64895dbada66f8f7d2e46f3ecff54842ebf2a5613b1ae53e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8934ecf06914e37e_0

Filesize
137KB

MD5
5c52e18d9209d7d935a4ffdfce310f7e

SHA1
07c7d430871766b82e4b6c41ef038ee7ac60b196

SHA256
0ac8308ea71df0e3dd8e36c6ab69ff5ea4a742fd962954f7ed524edc42820959

SHA512
b3aa32d1258854b18578b5088b92aa50de80fa66d06102258c3de4eba19ce0f70844ada22f705f53b0899b86cd39641774900e2bdeb4faf6ef3b671a94493d46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8aa05b2bea09f81e_0

Filesize
261B

MD5
5e3d6e4d18c1f076a2afaa19572ec898

SHA1
1435575f9018db2c5cd657d72c4e5e601e5fcb8a

SHA256
2c2eeac9d060984b3f0f41965a97f776f19d6478945e332b239dcf669ab03d91

SHA512
ae09b243f35c0aef7c69ec2efde1d7e01fd0a0d45bb208acf7a630b4c943db30a69fdf7b483e9bde3d5eebbb2d6df6b7b898dfb7401409a6e40a685b3bf96f57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9e65cb10bf37475c_0

Filesize
74KB

MD5
a2a8d6c1444636298e79c92084eedab9

SHA1
8c88eb55a7bd78aa95b02ea3688b6d8c9a70e586

SHA256
1a2fe7a1c1ee5c5a5a1e5863af3debc179677ef2b2ee6dd9ac49b3b44854aebf

SHA512
08918c922168b93c701693e3b73843c8019aed86accea7f927381941cb2aa781f1cfe0547f09d1cec28a9e5b644b1cedb7110b496a844b6a74fb14d5929b7562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9f359307eeeeb762_0

Filesize
291B

MD5
e230236e259d54df342a6f806d59fbe1

SHA1
d0150091aa447b395075ed663a71e702bf0b634e

SHA256
db66a46d84d609d82e3a77795aae470739ac1b36fbc01e68cf302691a9a1c09b

SHA512
677f1f1e3cdb41d7a167da724decdf97e74ba6615d360e7399a98cfda042b1d46c4972a21a4cc6ae433435f2d02702412c7482e706a88aec37315a8d93a8630b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ab092c7194aa97c9_0

Filesize
411B

MD5
9112df1a7117a56d6f4308f56159c937

SHA1
6738123ba2ca8dbea83eeaf6ca02d55e94b3053d

SHA256
675d01cce4574abf66f949a2769aaf7c4152763fa18738615ae5ec681be64c0b

SHA512
c07d7078ea2e82b60f4cac2382cf035ee4afeeed25239f2df3a82139ee5574a77113a9ce1807dad8c7cf17a2ee1adaaafac092476d8d5941dfdad55769353dcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ccc676941260fe63_0

Filesize
5KB

MD5
8d761d784cd218b5121961046973c709

SHA1
53e8523f64f835b33d036e093bfb99c695fc2d94

SHA256
6cac319650d6120d9c6412081717ace134150dce7c0795f1609e7058acdbc3dd

SHA512
6bb8a0390dfa53eb0eee163cc1446ebae1275ca4b039d3462e169a9771de6ac2e0952e0a0c1423749cf7a1f910d61bbd395163d4f264f81d15a80f2c32b39534

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\da8288bd7c778d43_0

Filesize
284B

MD5
779f867447abf7e589353a112f5a7906

SHA1
c33c5c321e603574fc6ad192c0798c18bc90d1e9

SHA256
0bf42ad772a51c1d2b2f6355014ce6ad2a1f8cf40b849591ca3b8a16c454f1ba

SHA512
69f1585ccf418bbf12c162d24bce8af321a3c6ebcaa6a4523eb76dc6b1cc58c6d9a6112c2b9acd771ba9be82bb85283449f5a1af0129c6f7bb90df07726a9d97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dc910ed673112ba8_0

Filesize
386B

MD5
d8cf4e666bb79a3b68791245d4c4f2af

SHA1
94400e16ea0625dbb3fcf8a41a19e1a417ffa3be

SHA256
5fa101488f5f3bc0c99ae2eb0acd3d42505af05eb80f6966691de4ee100eb2bb

SHA512
4adb6e7bd383ff39041624a4b78510b8b700b169f6220661fd91d68ce6755194d19e11c82cab963d6456d91687d946eded284622132b510fcfb3082a3aa9ceb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e9700fc86e99548d_0

Filesize
303B

MD5
fb0be2467fb47801e66601996001ee57

SHA1
e5f3562dc51165c613eacef63944b9ccab7eb9be

SHA256
0feb7e0793cc043b393f1de916c59af93ada78fd5a2349452736ecef21e5e122

SHA512
31d64488f29ed6485f8c102dad761ce881495327eec013d1f62287db7c3011527733d1be118c81a1ab7e408b7965d53d3410512acc79dd3fabfafe1e76683339

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
11KB

MD5
51ec948c025bbc4e964289d9ded8d5dd

SHA1
36a8e8abcbad0617343255617bc7ded2bbf31a2b

SHA256
a105c9a550e78a578b53aedb15ed7b10025a5ba3d3a8988fccbd9e002d2e13ff

SHA512
d7166283ab53e164890a02ecef06c057dcd53bf5707adc6c618eea26a52b4f627f3c8b0703812ac93694f0daa9bc86a31e6b856f80f7e9bee5e81e168dc5dfcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d11da698af783f5581ebbb802208c2b7

SHA1
4a036de5f13f047efb8d59ffd95f28101a9f81d6

SHA256
ed13840eb9c582127791a281cbe3c19bf51e6b437ee71b6f4b28300a0263782a

SHA512
492a5e3f1c82ead36a7ac368cc0fc481539faf5b40606ccb8fefd641873997b23da95ab76cc5302a9ea36ae3bdfac1a7f2638408f564b24a096315e2fbe2ad31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
26756c940cf0c021fd79d9e7824e29f4

SHA1
7c05365550d98cf7bb336ed1db393901c52c7f4b

SHA256
b095b78eda44af1bf407927d550a780756a04ba4cf8f34845700e3c78ceda8d5

SHA512
73256bb41011d7aa5fffe68dac312d8e24f605a2b4c488f9d80f376470047502dc6b7c86b8ffb1448d2192123d0fc18ad0860e820da7965a7d00d7fd3c3de034

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
b6e2a44b823d99e3e3ce19b91c3c986a

SHA1
6645278e611d1c47859640c3a1c7a533a1f23a94

SHA256
bedef38fc7e620bf1c0c9ab4dba29720290c023b2956ed24ff2441ecb9df6f3d

SHA512
e6618def9081a43fdd100464fa95ece38bc73ec74e8b80862f3d6d7867c3099b92fbfa0fe10b7a28b7a55a6d9d9fcc69ee7714ab04f5eca7dd72cb83a3a1223e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
4b12ae62238de5788195a75e672f7d3e

SHA1
2040f4a0b899c1103e609b2f4cc61b959239d405

SHA256
b058e4f047790bf55eccae146758c52dc33dd9db58693741c0546c84eb33d660

SHA512
1377886e2e43c0f9c5f52464bcc82f431e5a94fe7cf92c47a489df87e4dc189dfceee246244d547f6da7407d6fda1b06a892d69fb8da07f0a2358850abfb1ab8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
24ed0c7cb741c52e547eeb5ad74ea963

SHA1
66dd83898ee68f053a4af63ea5bfbedc781b82cf

SHA256
3da606ea56315efb496648bba4287a168f416aab05831eb15cc7d41a0af121f6

SHA512
2630488b1fe4c952f33d80861761301c17a23701f1ca4bf30a8577960b9aac1de1a77dc789d02bddedf2fde0f3beb5e9dfc05d872cc44d1fc006bd241d40b063

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\128.png

Filesize
4KB

MD5
913064adaaa4c4fa2a9d011b66b33183

SHA1
99ea751ac2597a080706c690612aeeee43161fc1

SHA256
afb4ce8882ef7ae80976eba7d87f6e07fcddc8e9e84747e8d747d1e996dea8eb

SHA512
162bf69b1ad5122c6154c111816e4b87a8222e6994a72743ed5382d571d293e1467a2ed2fc6cc27789b644943cf617a56da530b6a6142680c5b2497579a632b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\af\messages.json

Filesize
908B

MD5
12403ebcce3ae8287a9e823c0256d205

SHA1
c82d43c501fae24bfe05db8b8f95ed1c9ac54037

SHA256
b40bde5b612cfff936370b32fb0c58cc205fc89937729504c6c0b527b60e2cba

SHA512
153401ecdb13086d2f65f9b9f20acb3cefe5e2aeff1c31ba021be35bf08ab0634812c33d1d34da270e5693a8048fc5e2085e30974f6a703f75ea1622a0ca0ffd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\am\messages.json

Filesize
1KB

MD5
cc785a90811435bc9d87d1ba1966b9bf

SHA1
3d56356434cec87a1eea756ff376e08591bfbc14

SHA256
4e85b78853a4690f3079e0645c0debaaa5b3fa82b6ced27163ecbaddac5f8040

SHA512
27fcdb5e65bca356668ce033c9006df7e46dc25aba3f108691e47bf37894db0a351412042f3068c6a25b636a0a3761cbacf42829f3fb47b1a034b2cc3cb857ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ar\messages.json

Filesize
1KB

MD5
3ec93ea8f8422fda079f8e5b3f386a73

SHA1
24640131ccfb21d9bc3373c0661da02d50350c15

SHA256
abd0919121956ab535e6a235de67764f46cfc944071fcf2302148f5fb0e8c65a

SHA512
f40e879f85bc9b8120a9b7357ed44c22c075bf065f45bea42bd5316af929cbd035d5d6c35734e454aef5b79d378e51a77a71fa23f9ebd0b3754159718fceb95c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\az\messages.json

Filesize
977B

MD5
9a798fd298008074e59ecc253e2f2933

SHA1
1e93da985e880f3d3350fc94f5ccc498efc8c813

SHA256
628145f4281fa825d75f1e332998904466abd050e8b0dc8bb9b6a20488d78a66

SHA512
9094480379f5ab711b3c32c55fd162290cb0031644ea09a145e2ef315da12f2e55369d824af218c3a7c37dd9a276aeec127d8b3627d3ab45a14b0191ed2bbe70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\be\messages.json

Filesize
3KB

MD5
68884dfda320b85f9fc5244c2dd00568

SHA1
fd9c01e03320560cbbb91dc3d1917c96d792a549

SHA256
ddf16859a15f3eb3334d6241975ca3988ac3eafc3d96452ac3a4afd3644c8550

SHA512
7ff0fbd555b1f9a9a4e36b745cbfcad47b33024664f0d99e8c080be541420d1955d35d04b5e973c07725573e592cd0dd84fdbb867c63482baff6929ada27ccde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\bg\messages.json

Filesize
1KB

MD5
2e6423f38e148ac5a5a041b1d5989cc0

SHA1
88966ffe39510c06cd9f710dfac8545672ffdceb

SHA256
ac4a8b5b7c0b0dd1c07910f30dcfbdf1bcb701cfcfd182b6153fd3911d566c0e

SHA512
891fcdc6f07337970518322c69c6026896dd3588f41f1e6c8a1d91204412cae01808f87f9f2dea1754458d70f51c3cef5f12a9e3fc011165a42b0844c75ec683

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\bn\messages.json

Filesize
1KB

MD5
651375c6af22e2bcd228347a45e3c2c9

SHA1
109ac3a912326171d77869854d7300385f6e628c

SHA256
1dbf38e425c5c7fc39e8077a837df0443692463ba1fbe94e288ab5a93242c46e

SHA512
958aa7cf645fab991f2eca0937ba734861b373fb1c8bcc001599be57c65e0917f7833a971d93a7a6423c5f54a4839d3a4d5f100c26efa0d2a068516953989f9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ca\messages.json

Filesize
930B

MD5
d177261ffe5f8ab4b3796d26835f8331

SHA1
4be708e2ffe0f018ac183003b74353ad646c1657

SHA256
d6e65238187a430ff29d4c10cf1c46b3f0fa4b91a5900a17c5dfd16e67ffc9bd

SHA512
e7d730304aed78c0f4a78dadbf835a22b3d8114fb41d67b2b26f4fe938b572763d3e127b7c1c81ebe7d538da976a7a1e7adc40f918f88afadea2201ae8ab47d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\cs\messages.json

Filesize
913B

MD5
ccb00c63e4814f7c46b06e4a142f2de9

SHA1
860936b2a500ce09498b07a457e0cca6b69c5c23

SHA256
21ae66ce537095408d21670585ad12599b0f575ff2cb3ee34e3a48f8cc71cfab

SHA512
35839dac6c985a6ca11c1bff5b8b5e59db501fcb91298e2c41cb0816b6101bf322445b249eaea0cef38f76d73a4e198f2b6e25eea8d8a94ea6007d386d4f1055

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\cy\messages.json

Filesize
806B

MD5
a86407c6f20818972b80b9384acfbbed

SHA1
d1531cd0701371e95d2a6bb5edcb79b949d65e7c

SHA256
a482663292a913b02a9cde4635c7c92270bf3c8726fd274475dc2c490019a7c9

SHA512
d9fbf675514a890e9656f83572208830c6d977e34d5744c298a012515bc7eb5a17726add0d9078501393babd65387c4f4d3ac0cc0f7c60c72e09f336dca88de7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\da\messages.json

Filesize
883B

MD5
b922f7fd0e8ccac31b411fc26542c5ba

SHA1
2d25e153983e311e44a3a348b7d97af9aad21a30

SHA256
48847d57c75af51a44cbf8f7ef1a4496c2007e58ed56d340724fda1604ff9195

SHA512
ad0954deeb17af04858dd5ec3d3b3da12dff7a666af4061deb6fd492992d95db3baf751ab6a59bec7ab22117103a93496e07632c2fc724623bb3acf2ca6093f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\de\messages.json

Filesize
1KB

MD5
d116453277cc860d196887cec6432ffe

SHA1
0ae00288fde696795cc62fd36eabc507ab6f4ea4

SHA256
36ac525fa6e28f18572d71d75293970e0e1ead68f358c20da4fdc643eea2c1c5

SHA512
c788c3202a27ec220e3232ae25e3c855f3fdb8f124848f46a3d89510c564641a2dfea86d5014cea20d3d2d3c1405c96dbeb7ccad910d65c55a32fdca8a33fdd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\el\messages.json

Filesize
1KB

MD5
9aba4337c670c6349ba38fddc27c2106

SHA1
1fc33be9ab4ad99216629bc89fbb30e7aa42b812

SHA256
37ca6ab271d6e7c9b00b846fdb969811c9ce7864a85b5714027050795ea24f00

SHA512
8564f93ad8485c06034a89421ce74a4e719bbac865e33a7ed0b87baa80b7f7e54b240266f2edb595df4e6816144428db8be18a4252cbdcc1e37b9ecc9f9d7897

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\en_GB\messages.json

Filesize
848B

MD5
3734d498fb377cf5e4e2508b8131c0fa

SHA1
aa23e39bfe526b5e3379de04e00eacba89c55ade

SHA256
ab5cda04013dce0195e80af714fbf3a67675283768ffd062cf3cf16edb49f5d4

SHA512
56d9c792954214b0de56558983f7eb7805ac330af00e944e734340be41c68e5dd03eddb17a63bc2ab99bdd9be1f2e2da5be8ba7c43d938a67151082a9041c7ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\es\messages.json

Filesize
961B

MD5
f61916a206ac0e971cdcb63b29e580e3

SHA1
994b8c985dc1e161655d6e553146fb84d0030619

SHA256
2008f4faab71ab8c76a5d8811ad40102c380b6b929ce0bce9c378a7cadfc05eb

SHA512
d9c63b2f99015355aca04d74a27fd6b81170750c4b4be7293390dc81ef4cd920ee9184b05c61dc8979b6c2783528949a4ae7180dbf460a2620dbb0d3fd7a05cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\es_419\messages.json

Filesize
959B

MD5
535331f8fb98894877811b14994fea9d

SHA1
42475e6afb6a8ae41e2fc2b9949189ef9bbe09fb

SHA256
90a560ff82605db7eda26c90331650ff9e42c0b596cedb79b23598dec1b4988f

SHA512
2ce9c69e901ab5f766e6cfc1e592e1af5a07aa78d154ccbb7898519a12e6b42a21c5052a86783abe3e7a05043d4bd41b28960feddb30169ff7f7fe7208c8cfe9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\et\messages.json

Filesize
968B

MD5
64204786e7a7c1ed9c241f1c59b81007

SHA1
586528e87cd670249a44fb9c54b1796e40cdb794

SHA256
cc31b877238da6c1d51d9a6155fde565727a1956572f466c387b7e41c4923a29

SHA512
44fcf93f3fb10a3db68d74f9453995995ab2d16863ec89779db451a4d90f19743b8f51095eec3ecef5bd0c5c60d1bf3dfb0d64df288dccfbe70c129ae350b2c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\eu\messages.json

Filesize
838B

MD5
29a1da4acb4c9d04f080bb101e204e93

SHA1
2d0e4587ddd4bac1c90e79a88af3bd2c140b53b1

SHA256
a41670d52423ba69c7a65e7e153e7b9994e8dd0370c584bda0714bd61c49c578

SHA512
b7b7a5a0aa8f6724b0fa15d65f25286d9c66873f03080cbaba037bdeea6aadc678ac4f083bc52c2db01beb1b41a755ed67bbddb9c0fe4e35a004537a3f7fc458

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\fa\messages.json

Filesize
1KB

MD5
097f3ba8de41a0aaf436c783dcfe7ef3

SHA1
986b8cabd794e08c7ad41f0f35c93e4824ac84df

SHA256
7c4c09d19ac4da30cc0f7f521825f44c4dfbc19482a127fbfb2b74b3468f48f1

SHA512
8114ea7422e3b20ae3f08a3a64a6ffe1517a7579a3243919b8f789eb52c68d6f5a591f7b4d16cee4bd337ff4daf4057d81695732e5f7d9e761d04f859359fadb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\fi\messages.json

Filesize
911B

MD5
b38cbd6c2c5bfaa6ee252d573a0b12a1

SHA1
2e490d5a4942d2455c3e751f96bd9960f93c4b60

SHA256
2d752a5dbe80e34ea9a18c958b4c754f3bc10d63279484e4df5880b8fd1894d2

SHA512
6e65207f4d8212736059cc802c6a7104e71a9cc0935e07bd13d17ec46ea26d10bc87ad923cd84d78781e4f93231a11cb9ed8d3558877b6b0d52c07cb005f1c0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\fil\messages.json

Filesize
939B

MD5
fcea43d62605860fff41be26bad80169

SHA1
f25c2ce893d65666cc46ea267e3d1aa080a25f5b

SHA256
f51eeb7aaf5f2103c1043d520e5a4de0fa75e4dc375e23a2c2c4afd4d9293a72

SHA512
f66f113a26e5bcf54b9aafa69dae3c02c9c59bd5b9a05f829c92af208c06dc8ccc7a1875cbb7b7ce425899e4ba27bfe8ce2cdaf43a00a1b9f95149e855989ee0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\fr\messages.json

Filesize
977B

MD5
a58c0eebd5dc6bb5d91daf923bd3a2aa

SHA1
f169870eeed333363950d0bcd5a46d712231e2ae

SHA256
0518287950a8b010ffc8d52554eb82e5d93b6c3571823b7ceca898906c11abcc

SHA512
b04afd61de490bc838354e8dc6c22be5c7ac6e55386fff78489031acbe2dbf1eaa2652366f7a1e62ce87cfccb75576da3b2645fea1645b0eceb38b1fa3a409e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\fr_CA\messages.json

Filesize
972B

MD5
6cac04bdcc09034981b4ab567b00c296

SHA1
84f4d0e89e30ed7b7acd7644e4867ffdb346d2a5

SHA256
4caa46656ecc46a420aa98d3307731e84f5ac1a89111d2e808a228c436d83834

SHA512
160590b6ec3dcf48f3ea7a5baa11a8f6fa4131059469623e00ad273606b468b3a6e56d199e97daa0ecb6c526260ebae008570223f2822811f441d1c900dc33d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\gl\messages.json

Filesize
927B

MD5
cc31777e68b20f10a394162ee3cee03a

SHA1
969f7a9caf86ebaa82484fbf0837010ad3fd34d7

SHA256
9890710df0fbf1db41bce41fe2f62424a3bd39d755d29e829744ed3da0c2ce1d

SHA512
8215a6e50c6acf8045d97c0d4d422c0caacb7f09d136e73e34dba48903bb4c85a25d6875b56e192993f48a428d3a85ba041e0e61e4277b7d3a70f38d01f68aab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\gu\messages.json

Filesize
1KB

MD5
bc7e1d09028b085b74cb4e04d8a90814

SHA1
e28b2919f000b41b41209e56b7bf3a4448456cfe

SHA256
fe8218df25db54e633927c4a1640b1a41b8e6cb3360fa386b5382f833b0b237c

SHA512
040a8267d67db05bbaa52f1fac3460f58d35c5b73aa76bbf17fa78acc6d3bfb796a870dd44638f9ac3967e35217578a20d6f0b975ceeeedbadfc9f65be7e72c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\hi\messages.json

Filesize
1KB

MD5
98a7fc3e2e05afffc1cfe4a029f47476

SHA1
a17e077d6e6ba1d8a90c1f3faf25d37b0ff5a6ad

SHA256
d2d1afa224cda388ff1dc8fac24cda228d7ce09de5d375947d7207fa4a6c4f8d

SHA512
457e295c760abfd29fc6bbbb7fc7d4959287bca7fb0e3e99eb834087d17eed331def18138838d35c48c6ddc8a0134affff1a5a24033f9b5607b355d3d48fdf88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\hr\messages.json

Filesize
935B

MD5
25cdff9d60c5fc4740a48ef9804bf5c7

SHA1
4fadecc52fb43aec084df9ff86d2d465fbebcdc0

SHA256
73e6e246ceeab9875625cd4889fbf931f93b7b9deaa11288ae1a0f8a6e311e76

SHA512
ef00b08496427feb5a6b9fb3fe2e5404525be7c329d9dd2a417480637fd91885837d134a26980dcf9f61e463e6cb68f09a24402805807e656af16b116a75e02c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\hu\messages.json

Filesize
1KB

MD5
8930a51e3ace3dd897c9e61a2aea1d02

SHA1
4108506500c68c054ba03310c49fa5b8ee246ea4

SHA256
958c0f664fca20855fa84293566b2ddb7f297185619143457d6479e6ac81d240

SHA512
126b80cd3428c0bc459eeaafcbe4b9fde2541a57f19f3ec7346baf449f36dc073a9cf015594a57203255941551b25f6faa6d2c73c57c44725f563883ff902606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\hy\messages.json

Filesize
2KB

MD5
55de859ad778e0aa9d950ef505b29da9

SHA1
4479be637a50c9ee8a2f7690ad362a6a8ffc59b2

SHA256
0b16e3f8bd904a767284345ae86a0a9927c47afe89e05ea2b13ad80009bdf9e4

SHA512
edab2fcc14cabb6d116e9c2907b42cfbc34f1d9035f43e454f1f4d1f3774c100cbadf6b4c81b025810ed90fa91c22f1aefe83056e4543d92527e4fe81c7889a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\id\messages.json

Filesize
858B

MD5
34d6ee258af9429465ae6a078c2fb1f5

SHA1
612cae151984449a4346a66c0a0df4235d64d932

SHA256
e3c86ddd2efebe88eed8484765a9868202546149753e03a61eb7c28fd62cfca1

SHA512
20427807b64a0f79a6349f8a923152d9647da95c05de19ad3a4bf7db817e25227f3b99307c8745dd323a6591b515221bd2f1e92b6f1a1783bdfa7142e84601b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\is\messages.json

Filesize
954B

MD5
1f565fb1c549b18af8bbfed8decd5d94

SHA1
b57f4bdae06ff3dfc1eb3e56b6f2f204d6f63638

SHA256
e16325d1a641ef7421f2bafcd6433d53543c89d498dd96419b03cba60b9c7d60

SHA512
a60b8e042a9bcdcc136b87948e9924a0b24d67c6ca9803904b876f162a0ad82b9619f1316be9ff107dd143b44f7e6f5df604abfe00818deb40a7d62917cda69f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\it\messages.json

Filesize
899B

MD5
0d82b734ef045d5fe7aa680b6a12e711

SHA1
bd04f181e4ee09f02cd53161dcabcef902423092

SHA256
f41862665b13c0b4c4f562ef1743684cce29d4bcf7fe3ea494208df253e33885

SHA512
01f305a280112482884485085494e871c66d40c0b03de710b4e5f49c6a478d541c2c1fda2ceaf4307900485946dee9d905851e98a2eb237642c80d464d1b3ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\iw\messages.json

Filesize
2KB

MD5
26b1533c0852ee4661ec1a27bd87d6bf

SHA1
18234e3abaf702df9330552780c2f33b83a1188a

SHA256
bbb81c32f482ba3216c9b1189c70cef39ca8c2181af3538ffa07b4c6ad52f06a

SHA512
450bfaf0e8159a4fae309737ea69ca8dd91caafd27ef662087c4e7716b2dcad3172555898e75814d6f11487f4f254de8625ef0cfea8df0133fc49e18ec7fd5d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ja\messages.json

Filesize
1KB

MD5
15ec1963fc113d4ad6e7e59ae5de7c0a

SHA1
4017fc6d8b302335469091b91d063b07c9e12109

SHA256
34ac08f3c4f2d42962a3395508818b48ca323d22f498738cc9f09e78cb197d73

SHA512
427251f471fa3b759ca1555e9600c10f755bc023701d058ff661bec605b6ab94cfb3456c1fea68d12b4d815ffbafabceb6c12311dd1199fc783ed6863af97c0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ka\messages.json

Filesize
3KB

MD5
83f81d30913dc4344573d7a58bd20d85

SHA1
5ad0e91ea18045232a8f9df1627007fe506a70e0

SHA256
30898bbf51bdd58db397ff780f061e33431a38ef5cfc288b5177ecf76b399f26

SHA512
85f97f12ad4482b5d9a6166bb2ae3c4458a582cf575190c71c1d8e0fb87c58482f8c0efead56e3a70edd42bed945816db5e07732ad27b8ffc93f4093710dd58f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\kk\messages.json

Filesize
3KB

MD5
2d94a58795f7b1e6e43c9656a147ad3c

SHA1
e377db505c6924b6bfc9d73dc7c02610062f674e

SHA256
548dc6c96e31a16ce355dc55c64833b08ef3fba8bf33149031b4a685959e3af4

SHA512
f51cc857e4cf2d4545c76a2dce7d837381ce59016e250319bf8d39718be79f9f6ee74ea5a56de0e8759e4e586d93430d51651fc902376d8a5698628e54a0f2d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\km\messages.json

Filesize
3KB

MD5
b3699c20a94776a5c2f90aef6eb0dad9

SHA1
1f9b968b0679a20fa097624c9abfa2b96c8c0bea

SHA256
a6118f0a0de329e07c01f53cd6fb4fed43e54c5f53db4cd1c7f5b2b4d9fb10e6

SHA512
1e8d15b8bff1d289434a244172f9ed42b4bb6bcb6372c1f300b01acea5a88167e97fedaba0a7ae3beb5e24763d1b09046ae8e30745b80e2e2fe785c94df362f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\kn\messages.json

Filesize
1KB

MD5
8e16966e815c3c274eeb8492b1ea6648

SHA1
7482ed9f1c9fd9f6f9ba91ab15921b19f64c9687

SHA256
418ff53fca505d54268413c796e4df80e947a09f399ab222a90b81e93113d5b5

SHA512
85b28202e874b1cf45b37ba05b87b3d8d6fe38e89c6011c4240cf6b563ea6da60181d712cce20d07c364f4a266a4ec90c4934cc8b7bb2013cb3b22d755796e38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ko\messages.json

Filesize
1KB

MD5
f3e59eeeb007144ea26306c20e04c292

SHA1
83e7bdfa1f18f4c7534208493c3ff6b1f2f57d90

SHA256
c52d9b955d229373725a6e713334bbb31ea72efa9b5cf4fbd76a566417b12cac

SHA512
7808cb5ff041b002cbd78171ec5a0b4dba3e017e21f7e8039084c2790f395b839bee04ad6c942eed47ccb53e90f6de818a725d1450bf81ba2990154afd3763af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\lo\messages.json

Filesize
2KB

MD5
e20d6c27840b406555e2f5091b118fc5

SHA1
0dcecc1a58ceb4936e255a64a2830956bfa6ec14

SHA256
89082fb05229826bc222f5d22c158235f025f0e6df67ff135a18bd899e13bb8f

SHA512
ad53fc0b153005f47f9f4344df6c4804049fac94932d895fd02eebe75222cfe77eedd9cd3fdc4c88376d18c5972055b00190507aa896488499d64e884f84f093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\lt\messages.json

Filesize
1KB

MD5
970544ab4622701ffdf66dc556847652

SHA1
14bee2b77ee74c5e38ebd1db09e8d8104cf75317

SHA256
5dfcbd4dfeaec3abe973a78277d3bd02cd77ae635d5c8cd1f816446c61808f59

SHA512
cc12d00c10b970189e90d47390eeb142359a8d6f3a9174c2ef3ae0118f09c88ab9b689d9773028834839a7dfaf3aac6747bc1dcb23794a9f067281e20b8dc6ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\lv\messages.json

Filesize
994B

MD5
a568a58817375590007d1b8abcaebf82

SHA1
b0f51fe6927bb4975fc6eda7d8a631bf0c1ab597

SHA256
0621de9161748f45d53052ed8a430962139d7f19074c7ffe7223ecb06b0b87db

SHA512
fcfbadec9f73975301ab404db6b09d31457fac7ccad2fa5be348e1cad6800f87cb5b56de50880c55bbadb3c40423351a6b5c2d03f6a327d898e35f517b1c628c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ml\messages.json

Filesize
2KB

MD5
a342d579532474f5b77b2dfadc690eaa

SHA1
ec5c287519ac7de608a8b155a2c91e5d6a21c23f

SHA256
d974d4fda9c8ee85bdbb43634497b41007801fcaa579d0c4e5bc347063d25975

SHA512
0be5c0243a3ce378afa14d033d4049e38f0c5a1e4d30d45edd784efbb95d445f6c4f29e4cc2e28134ea4b04ecee9632ee8682810d9dbe9d5dd186671a508eaa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\mn\messages.json

Filesize
2KB

MD5
83e7a14b7fc60d4c66bf313c8a2bef0b

SHA1
1ccf1d79cded5d65439266db58480089cc110b18

SHA256
613d8751f6cc9d3fa319f4b7ea8b2bd3bed37fd077482ca825929dd7c12a69a8

SHA512
3742e24ffc4b5283e6ee496813c1bdc6835630d006e8647d427c3de8b8e7bf814201adf9a27bfab3abd130b6fec64ebb102ac0eb8dedfe7b63d82d3e1233305d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\mr\messages.json

Filesize
1KB

MD5
3b98c4ed8874a160c3789fead5553cfa

SHA1
5550d0ec548335293d962aaa96b6443dd8abb9f6

SHA256
adeb082a9c754dfd5a9d47340a3ddcc19bf9c7efa6e629a2f1796305f1c9a66f

SHA512
5139b6c6df9459c7b5cdc08a98348891499408cd75b46519ba3ac29e99aaafcc5911a1dee6c3a57e3413dbd0fae72d7cbc676027248dce6364377982b5ce4151

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ms\messages.json

Filesize
945B

MD5
dda32b1db8a11b1f48fb0169e999da91

SHA1
9902fbe38ac5dff4b56ff01d621d30bb58c32d55

SHA256
0135a4da8e41564af36f711b05ed0c9146e6192812b8120a5eb4cc3e6b108c36

SHA512
a88798f264b1c9f8d08e2222ccd1cb21b07f4ef79a9cdccdab42e5741ff4cbeb463caa707afac5bf14cc03ddbf54f55102b67266c0ba75d84b59c101ad95c626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\my\messages.json

Filesize
3KB

MD5
342335a22f1886b8bc92008597326b24

SHA1
2cb04f892e430dcd7705c02bf0a8619354515513

SHA256
243befbd6b67a21433dcc97dc1a728896d3a070dc20055eb04d644e1bb955fe7

SHA512
cd344d060e30242e5a4705547e807ce3ce2231ee983bb9a8ad22b3e7598a7ec87399094b04a80245ad51d039370f09d74fe54c0b0738583884a73f0c7e888ad8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ne\messages.json

Filesize
3KB

MD5
065eb4de2319a4094f7c1c381ac753a0

SHA1
6324108a1ad968cb3aec83316c6f12d51456c464

SHA256
160e1cd593c901c7291ea4ecba735191d793ddfd7e9646a0560498627f61da6f

SHA512
8b3e970a2beb8b6b193ad6ab9baa0fd8e1147cb5b9e64d76a6d3f104d636481621be52c2d72c588adf444e136a9b1350ac767255d2e680df44e9a1fb75e4c898

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\nl\messages.json

Filesize
914B

MD5
32df72f14be59a9bc9777113a8b21de6

SHA1
2a8d9b9a998453144307dd0b700a76e783062ad0

SHA256
f3fe1ffcb182183b76e1b46c4463168c746a38e461fd25ca91ff2a40846f1d61

SHA512
e0966f5cca5a8a6d91c58d716e662e892d1c3441daa5d632e5e843839bb989f620d8ac33ed3edbafe18d7306b40cd0c4639e5a4e04da2c598331dacec2112aad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\no\messages.json

Filesize
878B

MD5
a1744b0f53ccf889955b95108367f9c8

SHA1
6a5a6771dff13dcb4fd425ed839ba100b7123de0

SHA256
21ceff02b45a4bfd60d144879dfa9f427949a027dd49a3eb0e9e345bd0b7c9a8

SHA512
f55e43f14514eecb89f6727a0d3c234149609020a516b193542b5964d2536d192f40cc12d377e70c683c269a1bdcde1c6a0e634aa84a164775cffe776536a961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\pa\messages.json

Filesize
2KB

MD5
97f769f51b83d35c260d1f8cfd7990af

SHA1
0d59a76564b0aee31d0a074305905472f740ceca

SHA256
bbd37d41b7de6f93948fa2437a7699d4c30a3c39e736179702f212cb36a3133c

SHA512
d91f5e2d22fc2d7f73c1f1c4af79db98fcfd1c7804069ae9b2348cbc729a6d2dff7fb6f44d152b0bdaba6e0d05dff54987e8472c081c4d39315cec2cbc593816

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\pl\messages.json

Filesize
978B

MD5
b8d55e4e3b9619784aeca61ba15c9c0f

SHA1
b4a9c9885fbeb78635957296fddd12579fefa033

SHA256
e00ff20437599a5c184ca0c79546cb6500171a95e5f24b9b5535e89a89d3ec3d

SHA512
266589116eee223056391c65808255edae10eb6dc5c26655d96f8178a41e283b06360ab8e08ac3857d172023c4f616ef073d0bea770a3b3dd3ee74f5ffb2296b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\pt_BR\messages.json

Filesize
907B

MD5
608551f7026e6ba8c0cf85d9ac11f8e3

SHA1
87b017b2d4da17e322af6384f82b57b807628617

SHA256
a73eea087164620fa2260d3910d3fbe302ed85f454edb1493a4f287d42fc882f

SHA512
82f52f8591db3c0469cc16d7cbfdbf9116f6d5b5d2ad02a3d8fa39ce1378c64c0ea80ab8509519027f71a89eb8bbf38a8702d9ad26c8e6e0f499bf7da18bf747

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\pt_PT\messages.json

Filesize
914B

MD5
0963f2f3641a62a78b02825f6fa3941c

SHA1
7e6972beab3d18e49857079a24fb9336bc4d2d48

SHA256
e93b8e7fb86d2f7dfae57416bb1fb6ee0eea25629b972a5922940f0023c85f90

SHA512
22dd42d967124da5a2209dd05fb6ad3f5d0d2687ea956a22ba1e31c56ec09deb53f0711cd5b24d672405358502e9d1c502659bb36ced66caf83923b021ca0286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ro\messages.json

Filesize
937B

MD5
bed8332ab788098d276b448ec2b33351

SHA1
6084124a2b32f386967da980cbe79dd86742859e

SHA256
085787999d78fadff9600c9dc5e3ff4fb4eb9be06d6bb19df2eef8c284be7b20

SHA512
22596584d10707cc1c8179ed3abe46ef2c314cf9c3d0685921475944b8855aab660590f8fa1cfdce7976b4bb3bd9abbbf053f61f1249a325fd0094e1c95692ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ru\messages.json

Filesize
1KB

MD5
51d34fe303d0c90ee409a2397fca437d

SHA1
b4b9a7b19c62d0aa95d1f10640a5fba628ccca12

SHA256
be733625acd03158103d62bc0eef272ca3f265ac30c87a6a03467481a177dae3

SHA512
e8670ded44dc6ee30e5f41c8b2040cf8a463cd9a60fc31fa70eb1d4c9ac1a3558369792b5b86fa761a21f5266d5a35e5c2c39297f367daa84159585c19ec492a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\si\messages.json

Filesize
2KB

MD5
b8a4fd612534a171a9a03c1984bb4bdd

SHA1
f513f7300827fe352e8ecb5bd4bb1729f3a0e22a

SHA256
54241ebe651a8344235cc47afd274c080abaebc8c3a25afb95d8373b6a5670a2

SHA512
c03e35bfde546aeb3245024ef721e7e606327581efe9eaf8c5b11989d9033bdb58437041a5cb6d567baa05466b6aaf054c47f976fd940eeedf69fdf80d79095b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\sk\messages.json

Filesize
934B

MD5
8e55817bf7a87052f11fe554a61c52d5

SHA1
9abdc0725fe27967f6f6be0df5d6c46e2957f455

SHA256
903060ec9e76040b46deb47bbb041d0b28a6816cb9b892d7342fc7dc6782f87c

SHA512
eff9ec7e72b272dde5f29123653bc056a4bc2c3c662ae3c448f8cb6a4d1865a0679b7e74c1b3189f3e262109ed6bc8f8d2bde14aefc8e87e0f785ae4837d01c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\sl\messages.json

Filesize
963B

MD5
bfaefeff32813df91c56b71b79ec2af4

SHA1
f8eda2b632610972b581724d6b2f9782ac37377b

SHA256
aab9cf9098294a46dc0f2fa468afff7ca7c323a1a0efa70c9db1e3a4da05d1d4

SHA512
971f2bbf5e9c84de3d31e5f2a4d1a00d891a2504f8af6d3f75fc19056bfd059a270c4c9836af35258aba586a1888133fb22b484f260c1cbc2d1d17bc3b4451aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\sr\messages.json

Filesize
1KB

MD5
7f5f8933d2d078618496c67526a2b066

SHA1
b7050e3efa4d39548577cf47cb119fa0e246b7a4

SHA256
4e8b69e864f57cddd4dc4e4faf2c28d496874d06016bc22e8d39e0cb69552769

SHA512
0fbab56629368eef87deef2977ca51831beb7deae98e02504e564218425c751853c4fdeaa40f51ecfe75c633128b56ae105a6eb308fd5b4a2e983013197f5dba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\sv\messages.json

Filesize
884B

MD5
90d8fb448ce9c0b9ba3d07fb8de6d7ee

SHA1
d8688cac0245fd7b886d0deb51394f5df8ae7e84

SHA256
64b1e422b346ab77c5d1c77142685b3ff7661d498767d104b0c24cb36d0eb859

SHA512
6d58f49ee3ef0d3186ea036b868b2203fe936ce30dc8e246c32e90b58d9b18c624825419346b62af8f7d61767dbe9721957280aa3c524d3a5dfb1a3a76c00742

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\sw\messages.json

Filesize
980B

MD5
d0579209686889e079d87c23817eddd5

SHA1
c4f99e66a5891973315d7f2bc9c1daa524cb30dc

SHA256
0d20680b74af10ef8c754fcde259124a438dce3848305b0caf994d98e787d263

SHA512
d59911f91ed6c8ff78fd158389b4d326daf4c031b940c399569fe210f6985e23897e7f404b7014fc7b0acec086c01cc5f76354f7e5d3a1e0dedef788c23c2978

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ta\messages.json

Filesize
1KB

MD5
dcc0d1725aeaeaaf1690ef8053529601

SHA1
bb9d31859469760ac93e84b70b57909dcc02ea65

SHA256
6282bf9df12ad453858b0b531c8999d5fd6251eb855234546a1b30858462231a

SHA512
6243982d764026d342b3c47c706d822bb2b0caffa51f0591d8c878f981eef2a7fc68b76d012630b1c1eb394af90eb782e2b49329eb6538dd5608a7f0791fdcf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\te\messages.json

Filesize
1KB

MD5
385e65ef723f1c4018eee6e4e56bc03f

SHA1
0cea195638a403fd99baef88a360bd746c21df42

SHA256
026c164bae27dbb36a564888a796aa3f188aad9e0c37176d48910395cf772cea

SHA512
e55167cb5638e04df3543d57c8027b86b9483bfcafa8e7c148eded66454aebf554b4c1cf3c33e93ec63d73e43800d6a6e7b9b1a1b0798b6bdb2f699d3989b052

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\th\messages.json

Filesize
1KB

MD5
64077e3d186e585a8bea86ff415aa19d

SHA1
73a861ac810dabb4ce63ad052e6e1834f8ca0e65

SHA256
d147631b2334a25b8aa4519e4a30fb3a1a85b6a0396bc688c68dc124ec387d58

SHA512
56dd389eb9dd335a6214e206b3bf5d63562584394d1de1928b67d369e548477004146e6cb2ad19d291cb06564676e2b2ac078162356f6bc9278b04d29825ef0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\tr\messages.json

Filesize
1KB

MD5
76b59aaacc7b469792694cf3855d3f4c

SHA1
7c04a2c1c808fa57057a4cceee66855251a3c231

SHA256
b9066a162bee00fd50dc48c71b32b69dffa362a01f84b45698b017a624f46824

SHA512
2e507ca6874de8028dc769f3d9dfd9e5494c268432ba41b51568d56f7426f8a5f2e5b111ddd04259eb8d9a036bb4e3333863a8fc65aab793bcef39edfe41403b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\uk\messages.json

Filesize
1KB

MD5
970963c25c2cef16bb6f60952e103105

SHA1
bbddacfeee60e22fb1c130e1ee8efda75ea600aa

SHA256
9fa26ff09f6acde2457ed366c0c4124b6cac1435d0c4fd8a870a0c090417da19

SHA512
1bed9fe4d4adeed3d0bc8258d9f2fd72c6a177c713c3b03fc6f5452b6d6c2cb2236c54ea972ece7dbfd756733805eb2352cae44bab93aa8ea73bb80460349504

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\ur\messages.json

Filesize
1KB

MD5
8b4df6a9281333341c939c244ddb7648

SHA1
382c80cad29bcf8aaf52d9a24ca5a6ecf1941c6b

SHA256
5da836224d0f3a96f1c5eb5063061aad837ca9fc6fed15d19c66da25cf56f8ac

SHA512
fa1c015d4ea349f73468c78fdb798d462eef0f73c1a762298798e19f825e968383b0a133e0a2ce3b3df95f24c71992235bfc872c69dc98166b44d3183bf8a9e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\vi\messages.json

Filesize
1KB

MD5
773a3b9e708d052d6cbaa6d55c8a5438

SHA1
5617235844595d5c73961a2c0a4ac66d8ea5f90f

SHA256
597c5f32bc999746bc5c2ed1e5115c523b7eb1d33f81b042203e1c1df4bbcafe

SHA512
e5f906729e38b23f64d7f146fa48f3abf6baed9aafc0e5f6fa59f369dc47829dbb4bfa94448580bd61a34e844241f590b8d7aec7091861105d8ebb2590a3bee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\zh_CN\messages.json

Filesize
879B

MD5
3e76788e17e62fb49fb5ed5f4e7a3dce

SHA1
6904ffa0d13d45496f126e58c886c35366efcc11

SHA256
e72d0bb08cc3005556e95a498bd737e7783bb0e56dcc202e7d27a536616f5ee0

SHA512
f431e570ab5973c54275c9eef05e49e6fe2d6c17000f98d672dd31f9a1fad98e0d50b5b0b9cf85d5bbd3b655b93fd69768c194c8c1688cb962aa75ff1af9bdb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\zh_HK\messages.json

Filesize
1KB

MD5
524e1b2a370d0e71342d05dde3d3e774

SHA1
60d1f59714f9e8f90ef34138d33fbff6dd39e85a

SHA256
30f44cfad052d73d86d12fa20cfc111563a3b2e4523b43f7d66d934ba8dace91

SHA512
d2225cf2fa94b01a7b0f70a933e1fdcf69cdf92f76c424ce4f9fcc86510c481c9a87a7b71f907c836cbb1ca41a8bebbd08f68dbc90710984ca738d293f905272

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\zh_TW\messages.json

Filesize
843B

MD5
0e60627acfd18f44d4df469d8dce6d30

SHA1
2bfcb0c3ca6b50d69ad5745fa692baf0708db4b5

SHA256
f94c6ddedf067642a1af18d629778ec65e02b6097a8532b7e794502747aeb008

SHA512
6ff517eed4381a61075ac7c8e80c73fafae7c0583ba4fa7f4951dd7dbe183c253702dee44b3276efc566f295dac1592271be5e0ac0c7d2c9f6062054418c7c27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_locales\zu\messages.json

Filesize
912B

MD5
71f916a64f98b6d1b5d1f62d297fdec1

SHA1
9386e8f723c3f42da5b3f7e0b9970d2664ea0baa

SHA256
ec78ddd4ccf32b5d76ec701a20167c3fbd146d79a505e4fb0421fc1e5cf4aa63

SHA512
30fa4e02120af1be6e7cc7dbb15fae5d50825bd6b3cf28ef21d2f2e217b14af5b76cfcc165685c3edc1d09536bfcb10ca07e1e2cc0da891cec05e19394ad7144

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\_metadata\verified_contents.json

Filesize
18KB

MD5
4caf0842b05eed2901158557c86b9a85

SHA1
789062049adf0fc5bbaa61e83e76194a28737b76

SHA256
bdee000b3487443b951aa6f6a0a50eeb81caf0fe943977d987e5acda16c5812c

SHA512
c9c7ddc1007a50f2d0445b9e1400fad79c20eb41b6f6e7832c4bc5462adcfe38cfb0020028da1472b7e0f2a83091166ef950d581a1d0f68bf90d7f57226b919a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\eventpage_bin_prod.js

Filesize
77KB

MD5
a03d289fcfab28005ecb9d577944c888

SHA1
3a390c3afd10125e4ecd820bf5e5177589dee696

SHA256
4b36137c70513d476e5c7e86c2bddfa6eeefa0b77092f22f72217cb8f6863c11

SHA512
9182b41c2d4a443f7ec6167601fb280e339638f32b663a46a9afa7546d41591f985ba010d47635119048073f77c8ac496182f94239d1d342c3247a3f89d2fc1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\manifest.json

Filesize
2KB

MD5
c5f9ca95f25d11c8cb46ad8ad121e34d

SHA1
4183e6899a2011a33d429fd0af9770fc26b297ae

SHA256
5e4edb7d56beacfa752e2ba806c31743b0276fd9a752d937645b2246aa4e7612

SHA512
e2606a971cc80851fa5f3be392eaeb2dbcc3567a1d58eee53bae1f05677f0456fc873569078304e3a7c1fd5f7e7aa832bd2fa2f90ddf28f428eaf4e9f9727775

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4100_1668640579\CRX_INSTALL\page_embed_script.js

Filesize
291B

MD5
62fda4fa9cc5866797295daf242ec144

SHA1
b0fd59acfe000541753d0cb3cb38eb04e833f603

SHA256
cae608555363a5ffe6940574ac6ecd03c9ac24c329484598b78ee463554bc591

SHA512
f6a324ad4372387adc9f5b66e4bca678e22b16ca621e6ca8a57b7dd84bc9636f9c6fc3e07251d526ffde03200357c074762cc5d7b707b0a303f9c9a195d98f58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_afceb641a276f97d8b1f7a3947a44686.safeframe.googlesyndication.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_afceb641a276f97d8b1f7a3947a44686.safeframe.googlesyndication.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4911c23b-e709-4ba7-85b0-f01fbcfb970f.tmp

Filesize
8KB

MD5
a719229cd667d06adc0266dc416b0539

SHA1
80aaab759cbd85c09d59f5526cbc8495728452ef

SHA256
af26011b1ddecf5b1da08aa52d83580595cd8349cb361933fa51b577160d3b87

SHA512
184ba3fbc0bb8e2946bb722b7caab7a36c5605c102aa6e0096cebf6385212d409de7deaeffeb8e34e3fa4cceb80e59be0b16e9e170a7f38144afa3b5f523f7c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
c8b1aa5d69c578a32bac82f0218e60ed

SHA1
b4eea39164df109977cb1fbfb596695f4ea21144

SHA256
49582c3d81681fcb9febf8592103d83223c556eb976d5d70657b7794d04706b1

SHA512
0d5a078b07c758a3ad976cefb9bfba92d7082b2ce2e6f6be84de64e50d4346b9ef5b5aa11dc5669e52fc54c1fa5266e0c706e23048a7f3dc20ad65bff269aed3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
22KB

MD5
2a3b0818babaaa2db5af4e7ac942cd4f

SHA1
584b1fe8ac8eab4297189f831b1e0c95e14fbb25

SHA256
4df4a6cffbdb8f2fdb1766f346cc31c77050269ae94a3f1769869ef0444d7bac

SHA512
bd40feeecf2df9d12bfa330c1d3f376e6a563dc8c16b46f588711e736141bca55a3cb0024f368e467ab1806a881e328bba335905a25f71ccd8de8148e6423d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
25KB

MD5
b70d5949d7be795b01bbea41be6febb2

SHA1
82c615954d6bc2bb6b8a3d06e6056f614e3c60cb

SHA256
f9095d69f9fe5e39bedf43935bb840011409a0cf5dbf76537e583d265df36c59

SHA512
3f05a5ee140e45edc1417fd8d990ffafec1b995b8ec64ae73c33f2c03982eadaf579acefdd88a48d15734885e9aca83cc46efddbae9c00891f78c4f7d9e0ba30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
28KB

MD5
68bef54d5e65683eae934d4c1b2a742b

SHA1
e40c7cf99efd8901d0682310de3e780a92175baf

SHA256
f1ed1747e9b456d25529ebbd13a7b0714c255ca3be633e50a21deb1b7840203e

SHA512
0a5b9ea215df7423f874d918078de93ebf3c86131519d773940fc281ddaa889e70a04971f6019f26fd1dabe0d6fb4fda4c2151777848b6bcf97c14993188d684

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
31KB

MD5
8d49fdb61b48757fa6b590d40ffa692e

SHA1
31107995273cc91c1040d53cd3f2cb897a7c600d

SHA256
59c874c873fd66f32beeca3b47ee1f3c70fc105aaf8865532e2f04f3f894d164

SHA512
5283d224d57c2eef15d6944d1fc97291b7779162a4e85d466a06452b5662f4634164a975c9eec53e9a1845f581efb0b18e72cc032c020454a7ed6a65f13a9d31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
33KB

MD5
ae22b3f7607a76bd6865644d73b9f256

SHA1
c86b0f523561b6fb6b4ca6973942cc59a94eac84

SHA256
1ac1af247a4046a94be309ede78b7399ebdd0cb040a48e67bf0921ebe7195d94

SHA512
dc9f318eb560729a8de25347efcc18748edc4d7216a04d8a9e346d35034bb3c8b1c823448e2005040e57b4d38114dc7d85dd81585b57ddc3fdf404d77c654032

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
29KB

MD5
b6bff40f2a6a081cb10a195d7def36dc

SHA1
e383445e8fedd9366daced7d253b90f15d57e283

SHA256
9aa29178b0c03a478d93bb0b1f218056b1120cf232eb32f104482e18dcf0b543

SHA512
52955866be01e440a0787fe94c56831c82399262803c69fff2b4c9f192082f8641e1e5c1d72bcc683f7da5871082e1e3a81d0286c72e1e58261e10239fcf78b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
cc143503bc968fcb9abd9d3aabff63b6

SHA1
255009d7c41e85593f67492f1767d72747be6e46

SHA256
5b26004c61b470874cdb0db912ecc7e8b0a24f9f3ccd5f542911ab982b76272b

SHA512
e38b35e451750d8b9b2de0098776448b5bcefde3d35c7343081d8ee309385b900aa96befa8fbc5da13630ca56f05d7776b5a91730eb74b32f1c80500435e900d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
79190c5b92f904b1c6afb6ba46d5d81f

SHA1
791b55bb4f6f5db391f31cba9ec0e5ffb775b717

SHA256
c380faeaca08ac7535b24253578395f6afa16558e1b42d0baf904881213f2bef

SHA512
28ed280d5d4707e86839f36acc82e69940315facd3adec47cefd7d5f3769022c813ddc3d9413399d802b18b7df265f38b2d71e7ff303686fb3bc5ef8246cfbdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
0dab6d06744f73911121a521e7ac1ba6

SHA1
5fdf5f35fa76700f958fbe1f28b6e4f6c9f72d76

SHA256
726e354f70049e4c91ab941de8bb920b4a09dd78a1d19a1cd2c8725d46732e5d

SHA512
e27e8e17eec9fd0092aaac80e1ee9679a281ffcf8346833a4fc806386f06e2fb42d76e18be5f046d24589eff5afdbd40a4b83827ff379259f5962324b37e2687

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
d59fc3e21caaa57771b87e8598963abe

SHA1
6eb329499db3a7497bb9e99879b1e3f6e44b7404

SHA256
c5b64594093ee396be2e8aab7ba25daacf1091fffec4252c731a0dc04494403d

SHA512
b267594ad4f1817e04ed0f5b785f3f62bc7b65bb5e07cc9214d71f23fb3f0428e4a6de796aeca057de3655b8848323034291e278d45f426c39dbf2e6a0ce2658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
ec25b423461914840ae111562ed21606

SHA1
2e6bbb5ed2abe338f89a3f154416430f45dc103b

SHA256
a114238b95c234bd7398b677c0dc3cebf61367c5f563846b3545f0c872516b4d

SHA512
5c3e02e09e8cc1abd5d1b3ff09f587bbb39b65370971e53580ea8cd1fc02a3b235190877776843689ba9346ae378e4f5a861df8bd3d6d5ecdfc8b6ea573ece85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
39ce0a864b61bc338a05c809a46fd98d

SHA1
639736ed74fded5930b591aa906302bbbc90bc1d

SHA256
e82f065a6ad0b213390bee49d365a6c47292bafe4677625581c0b8281d2f1b89

SHA512
87bfe272c342acf82c77693badac475cef1a190098adb7e30929b93124823ca90ac83ad428ea20e6b055019b41f0fc96122fdcd85c0abc494f6c29466ecac618

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
522c4d861c20972daca8ab5a0b7ae5ff

SHA1
28ba2274628e56de7c5ef4c0f8b4509d8990484b

SHA256
8a90fb2eacff1e4e2ded4e608d30cf70d3316d82f1ebb448bc10fc0badfaa30f

SHA512
27359dfe07b669fa782ca8182f5a075067344b2508a6a44046c9b911ee25b869ba223247583a9a79fed69a3b76e7b3da7b5b2c702df73ae9a6bc69fa1ff167d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
8b66ba013741bd63c7f5f2cde6dce1bd

SHA1
d81c602b3cfe0d35430fbd93ce49d6c182b3b2d7

SHA256
c1e36500a70fc35f5ca37b4a2d9d1fa30d33e72960097169b5e81fffc170ddb8

SHA512
510afaf850b6526adb26e1c16f85f219318a39e6949518d866148d50cbbb0b275c34a8a19bc2b6fedd97efc060b8b81a3550926071e309bb74dd78c01e83c12b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
0ef17b81c37a21c0b62c929744574812

SHA1
ef5e7445d2320429c1c823c2a30da135a8b96a0b

SHA256
00c17bf41dd4f576fa62bd4905f00bf13c1ad2a892a9539054dfa47579497468

SHA512
8ba2e9b95b0eb5982102f17d39a0878e42c615e643fa62b1b9d6f8feb814b313c74c0228ffe1b905a0af683a998f23ffec82ea87df371c280953e1141917e983

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
3b7d094772066ec0fcc1136f399dd4c9

SHA1
bd45dde1cd2a6d408842b153d9215a40d56723fb

SHA256
b15581e6d47f21dc4b6fdb520dc993f092c235f7f8b7cfde2660ce8e6bdb7b64

SHA512
0880dfd4a602c4081338a3788c124396f87c982689eff86f1de654731fb9e383a67c2bc5100f119bd876ede68d9c7d315a5a4566f52f1752d6486b240f00384b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
4b88af5b5c1761f882ccbfafec9be694

SHA1
0e0df9a8ba2254821233a87f54d09c42ac83d33e

SHA256
ed3407cf523572f4670f4f40cc1be83a809c6e7a4510d7faa6a877a518d0b320

SHA512
e1f3870fa652eb8e341a379819d3b8b565ee73c66cfb38f827420c2a571508e71a53fb62185ca2b6ae1c5d7860ce8919d429c071f2464d06cd92407cd73db639

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
07206294435208fc50fb40dcad208d8d

SHA1
79e8857efc0395f0a083f68fcfaf5c09b33c707c

SHA256
97acf27f5e752e486f586303a27d71ec75feeb9c83915af2bed8cf7fbd126eac

SHA512
fda03a53556d0fed2e9365ffdbb976cf6562b8671a358592fd16a8d3bb06babd1cc8fa1f5aaf36c3339f739afd0b0babb4e4d36939d47db60a063d42a0663b28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
eaa6ec16754439e6a87b7979e442f3ba

SHA1
3e9b61f7d32455544fc9255fa26ab304838e4579

SHA256
acdab6eee32e39a5d7392ec8bc6ee818ede68a5122fd82fb3e4c5af7bd78a555

SHA512
cedaec849f5a7db1d2cece8b81ba890b02f57b6935b6ea3031c0eb3e5c180446dc4bd161505e5cae31ea1f3f141ea61da6b23eee5df0f3668e7234c55bfda9a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
61eee90822dde93073e804cc0d61195d

SHA1
a3cb8b988021a786a2683583c84f7be840ff03f2

SHA256
2634084c6a14ba70b83804f5c71cf32ada0694af40951feac71b441f69f39016

SHA512
ae57e5240318db45437db442e7bfefeea1ea5c4fa7c699c390d3555265fc6c3fe4c2d33b50d3d8a92ddfbd7b3b90295a9d763b4ac0fa8aa5a9acfd12eecc2731

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
b9c3fff289fe9dc1581fc8edf46dfa3a

SHA1
e1f367d98cbe3450d86c2395855bc107789fe8c5

SHA256
7088889973dcc956518cdf153496411b5a5c9365e143204091dd1fd1761057d7

SHA512
671ddd1247ee96a881f480922cd80ff1f1d4dfac2d944582b06ae1906730b0f3a2b447efa081a0778edb4dd6ebf2779575740d6cc9b3a8dfa280ef1c0fa41ca0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
c3312ad674e24e388b5b3548d92794b7

SHA1
9b19e83e3bf464c3e8d4f3f1420eec667e36e23e

SHA256
0ecc52ff9f03b989e98bd891b5c14893fb3cbc2f331301c138b38554f50892c8

SHA512
61e6705fd74a5151d87fe4e151f38cf8093024bfbb0f3220161f222b6e15296f8255a809825fa863ec370203e00c086505e74492da1378e00554ae4464ec2f79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
c85615486cf7c806c780d113b496ca73

SHA1
d481ac4292997cee17b9607ca2730863608c8a70

SHA256
e1db6826de19ddf294729f98f2cd42d2bb3a13fee3d1dffcfe25cc0e45b8aac4

SHA512
cbe30f60742bd020d4b77a58143af4bfa91fb4548701c0148886bf1e34061421ce4296e65281e7a50750b9f4821870f797cfb5af16f133c7e091ea7ac9c66a12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
b502b843d484fbc717c4cf46d2c99b75

SHA1
cdbf1a59bad8dadb4f4c669026f9eae9aa700c8d

SHA256
34bfd5940f9de6b5f259517f878fce0a7797f44982b62ceb4bc169b2a01f6fe1

SHA512
c3b5116ea67484a847830a6b196366c0fec408c93d0fda4a06f1c9210950f26d17961387f1d39969ce28722020744b3ca7b49a8cea67dc367fee53430582ced1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
d21b510b7862b1f1839f1e491d718d34

SHA1
dead626087777cb2ac2b2e2b8541edfc1a993fcc

SHA256
0d94174ba6605e717384dbf7901af727c8560714c675881fc5a3a587f542f1e1

SHA512
fb69eef240964224580b4a8c994c15197676ff98dc21112ce347efbb2a9282112370287db5ac5c361f2a83ba842a155d569d0e5755d3786ca2c8e323a4ef5d4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
7c2e086c03b7d62e875ac4692187bbbf

SHA1
db18b38f44b358591fe96c0be86df2b2b01a5d18

SHA256
deb2c9f3af80e33234f9b05f7c28e0e3f9598b71800a754a91e3cc7fc3d05775

SHA512
1701cbaa1a504ae5c87821669eba6f8e0803e5e35832cd1b04122f87b0866b11a32965ff074e0cd5570ee9b85ef8407477ebe7cdc5d5444e9e2e137afb20b5dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
7f07c4e33d37e3e4b41a90980dff16fa

SHA1
cc3fefa6174422f262026fb5780304401b1a4b63

SHA256
da2f3e41973f68ba3d816e77535044b72f17789d483a9efff768e03354e255c5

SHA512
26ec8b3def399f04c55fe2ef8b0affbd76e974286a2c4663a9e337153bed8b01d61d0cd6fa5e76039cc14e92c7b767f89ebe90384b774cdd595db90c414d24cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
c39b0af310d07bfe1084bbf8281d5401

SHA1
a0cbfaab3e4f00bc77da366246fa3cec50c4eb3d

SHA256
cc9e930e0cdd941dcae562952c1bbff7725d895631a649711a99dcd53970de1f

SHA512
81f9bcb4cfc67823741532523e9b393a5f60d436bde5e5e4bd01e170b0e8b42b8804bbd7a471341085c2ce99ef4d427b84f17b1886e428e1e4b2b9e5a87ec0f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
c04587e39b26b756e4606bd3919e5d7b

SHA1
3c249106f1e3a335f10b7b06eb520d6fe31f6c59

SHA256
4122d9430c00363688794fe00dbd8cd574a1012430a0dcb0e6857be6c1c7aee4

SHA512
98a45004e4a9d8b8010af68eced13ab65436d03d702f421e2d50fe6b7e09e41a3eadc68c1900692c163a8934bfd6986b9044e864ed94001966571b87ccb0db25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
98643d26a5faa430a5fd8bccec2409f8

SHA1
d511560996d4b6cec5926df87992caed1885318d

SHA256
f9dfa4c92ae8adba4fe86eb735b921af502fa244a9e14bb5ac1e70538f159aa6

SHA512
75107278764d1720ab2efa9b4e87af25b268d6ce712b22dfbf76b7803d01975aa724baf428fced81ad52b61a1d97f49b0e4cab07df8abb6617d1eecbaa1e2ff6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
f1751992f52bd432c7942838e5e2ba74

SHA1
ba544f80769751d1c0f50bed3f93891cd8d101e6

SHA256
d35d1529ff3131c978e21a03dc51856e31c8e903a8f03108ec39e59b893392c7

SHA512
804092732da511c52eb86607d5ccd73c81f26ef83db5e34005aebdacc6d33329944b0319b8ee43f40f89be4b2ee47e7fa8a072fad2ccf188a502047946b4b939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
2cb98a736193251f6d12b267efb8f048

SHA1
7003f309cb2e65d8a0e3f772ec9d649fa3c0dafc

SHA256
8d24392ca7bb0b267fc7e46389f99455a9ee53f306cc997f8bd8ea98dee9018b

SHA512
7ce66da441b4b21b051329cbdd8753b7f181415c2715c31084312a75e5e6d7cc27240f388b7c56c0f897843a00a5222ee9f7f961dac37cf0123c5870cf0ef201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
7c24f28df7c1750801ceae2181420326

SHA1
b34e7cbb26c1a5691a1d772e3a06617249169d15

SHA256
ef4a0928446d4eea4b58b01adee6a8a92f5a7b76865eeccee3827a3bba2c4451

SHA512
5e9704aa69457a209ab73f560a503785a05b9ce22721e3ac3153023b97776821ce4e887b2f08eb0b89ee4b9a7b5578df7eb4cb39a8532bf74cefe4ded0628761

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
d4428e18576b352097ef1209e0855e14

SHA1
b6212085548a92fb0d20a02222e617c1737694b2

SHA256
4b910ddba14eda56b3ed85934b9452c35e8d671273f066b6dc2ee870ad09dcb4

SHA512
61fa3ed3238c255026935445b38d18a3cdcee63f03d04a0e9401bdc5de7df182bb18618fa08428a33b9885e20837309b9e16467e638034df3717cbe7b4d88266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
12KB

MD5
fc6ed1c21f7d5a7d404f16529d6544b6

SHA1
eb5a25be0caea9ea674c710fca0878351d89d597

SHA256
a1088ed8872648841e6164c41a5050aea5dee3c320a45c1b2a817f5d5b68d59a

SHA512
4d407a656415f98c36db5d83e14ee1dc9d6a34a2b8963d4330fb388bb400e9baa0eb4fd5ef42838f840a770070a9351d07011fd768c017d34b3b262ac2971033

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
59a7aa16742519c195acb66f1a8eb080

SHA1
65d19b57622cf6d563628b88c3f12a71d46c5ab4

SHA256
f5f1a4a1a47324d923fc12af32311c66b59a9dbf87ee1b403aae1febb05797d2

SHA512
bfca65562067b02582a6487b3168ef6a15b404c1cc2f7902699f373f89b2a1b2b7aa210a412eb86b6acf90e26e4dd9218521c3b5f05acbda09a465057ee46f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
12beb55ff1f1360a3743abb84f3a0916

SHA1
5f619c3a4c087ac4e91c95f4c68e51fa1a37517f

SHA256
726db40e543229e05dd7d34c8d90d136881da65f9167a86acd2aa31d0c937c04

SHA512
6f1152c98455086d3390ac60d9d064130f23daf343a5c3edba04da2844c07e6e4c0178d90da62e67c99d3d9d551f4a5550673203bd496afbd4b6ccded1d32de5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
49b71b6db02ca84ec2f450ca4ed7c0a0

SHA1
22b9ed2d2811779641731e9670b0024c9f4918aa

SHA256
6e2672a3dfbf645ad5a93a6beea60c1f4cfaa1033b389b454516f89b7fb2673e

SHA512
051c38ab547b56c272a9e390d3f2748bc7b16417d1db086e45deb86ca57ab3051f762bbd89d93b2711dd0a4b6c1a132029d4dba3e4a7530e8fd67bafc64ae421

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a81b26f7c749270af78902a5b64118d4

SHA1
56871b0003232854e6943824fa4118f4ea851fbc

SHA256
76975b08b880aa84b1b8d62a3050e5861e83080a2ed590fd07da2b20f30751c5

SHA512
f322c0618edc5e3a16d73b4266268fd33339f974c045023841d0cc1d6ae60b87835fe8c3ad8ef6c37816e6f54f0da99656d88c5af7c2b1b1cf8043a2f4a6adfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f5473cd0c3d0cf06660275cacd7c4eac

SHA1
96aa9284b76e3d0472c0f921a42b87ef602ac812

SHA256
2b676d9ed8d165cc532354e4863d1288b0a93f412cf97b2ffb79c7e4a57d5a0f

SHA512
30cc772bcc0fe99cdcd54ca3bac9b77828ea7bf546b0f479da0b15346c3936dfa5764e554874a8b7bbb850b70c2363665e798b4bbb3c71f177e2b2ddbc32d9d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9b28a4f4fa4948383273a9b84ed09869

SHA1
9c32522933931e06c006c7c80feac47ec9a9e6ae

SHA256
e2a1d78b0d46edb8df2700318660ecfd6534436280e66b5fd31078085cb49de1

SHA512
6692805bdb24eaaa166dc3c584348428b705f9c4381958c5cff7944e65af74ae9a92d94fc9829e380e914cea4e90389bce6dab8de5f3581c8bb6ce77a7ddeb6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
4eb0b88acdebac46aebc457e3be0473d

SHA1
b082cdfeb26a69ac4b655679da5857e27dd79645

SHA256
889b7bb64de13b94c7aad94031f4b30c9327d1154b3598764d4f37f433ee460b

SHA512
0d69800188dc2ed27a07a60d7710cdb4b480f112c94dcf150772110d46cceeff295fa488dfe5f2b91f4b2a0f8382b9a076b94d1bf6f89c778952894a18cdf16c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2165a589bc0cd5eba5a458909d606f0b

SHA1
2ae1b416c21fb746dc11ef76943d37a3b1b975af

SHA256
a051340bf69973d7743695f838073163aba45a554919d8ef8dd51a10b77800c7

SHA512
967b474cbc94ac4424adacaf6c4d4e12ea3d74783524e600b5010ceab6d00aa1cf53c14752d018b6a4fd1060c91473f30a0ae686251c75e8b672159271107259

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
cf5579c3aa28597043c5f0ddaaf592a7

SHA1
b86a345e62e42ca7c7c904c462100abdc06a2e7a

SHA256
c856a32092e558841e437cfb34935c3bcdc2a44db129c23087293e90c0190328

SHA512
1b6a5126e3c826cc1d89fcd9d35fdea46b6a49a9514e6e8e549c28b4b9e6d322dc8fdeda6788418f870c73b5d6cbe374c3410556a37c09fd72d520b16f12d87e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d5d6bfd10f258d617e913093869c0e01

SHA1
429c915e31147d8b2dad33d8a4854ccb5c845dcf

SHA256
1c2452610e2f2ca84c6a533c270912f0c0a2b00e35a0e4fb140be4cceaf62973

SHA512
45d9343781b5f9849df1a2cb5d2745f63d8c6f241dacf2f45f987d0f6acf93161808f27afcd42f8b862adb5ec52fa5ef8ee73f88b365cd95d8ec91c3137178b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
52574815684693706e65a05cb3879940

SHA1
e4c26d963e1da03c9f3e253e48eb83056defbe66

SHA256
3ea82b746ad9461a5a916c37f60ff17ac306a878517d0c1500e4c8b2ace2707d

SHA512
d8715be72e60ee65f45b21345534cd91247911f208fc0adb35f9645960b5cc0173ec2d0b41b6078a62e8a9510867e3fbae9f3ab64d6c6e4d875eec933e24e8bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bba415c39e729a8d64e05b4b06d9a285

SHA1
6bde112685ffb753d9fcdc7ba73f2f441ddc2bea

SHA256
188bf9fa7531ecabd2453042d12f65d937a4cdc2f6c54fe0ec04ea95febf766c

SHA512
8f6c554e22b464a87ee9a206ba92eadb111d8141bc9c79478ee4c5f3e5ac890df45606af9a70bbef30be670568d4f3dbac8a5100fabab19c3a22b8481d6625b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
15bcd9e07d2c78b829f1652bc180bdc8

SHA1
cc10d86c7f1f40e23c6efcad1a5853aab794f194

SHA256
c40336a164efeba37daadf981127948caca213388716e1a92f98b9a230798048

SHA512
86ebb52c503956ceb2e63a721946a194568ebfb8c6de7a65df3a863af265f4b30ca1de4b0aa3fa03e3334ebcf4499ab7fc7692952c86a7fdbd1259b348404275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d2e2d7a03be2949f25d292e63dccba02

SHA1
becece71e66fc3c024447c10e94b965a4010fbe2

SHA256
b9036324e3f753f407a5d4e44ab90ee32e57cff6b9f6fc63df5d453a64ad7e3b

SHA512
eb7b975d115b411c14cbd2ea85bcfd2f13de492d5d661a305b962e922b1bc7d4260eea69fe9dae5cd3ca50aae4e12f34e202e1a2ad5d6911eb43019def4b8e0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bb9fed33695b9209f1553931b184bd12

SHA1
5497a36440715a1e2d399a5fea9fc5aabe505ee5

SHA256
2ea294c6d3ed8e5d7045b3cd535719e51a5c50d847ef631ed78b1bf50d5934b5

SHA512
fea76f11f9ba1842d54e12cb67e6a7b9da6fc24ab2fbcfb3c312174a978e5232d56d3bdbf508fc1f33aef65be6e5d8f6fdf55f23eab4bf37e2aec28c526c9a39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7a80b9932673bde855cb79425979c414

SHA1
11fb2f2041d39f4764eb31fd6c6531f41c29213e

SHA256
1e4a724863bc7d0632ed4888bf270427f5c52f3a45d5a42aeb87547ff0be7cf6

SHA512
f18e261e1a1392d83e0efa946c7201fd55382929b98aa57fce18f77afacf0b945d796cf1447b214e7db553207781cda845c7f251a5e3a50a035d6f50ddaf2f5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f4cb2f6cb90dd6d9040c90600e33f9d3

SHA1
4f3be22bd2808c0d8f058c9f20e8bcb5e20bec19

SHA256
2958c9856303ddab3c5986c90bb7d3ec6a5e43b1707865e11587d2849e1c3f23

SHA512
33303b9d5814c97290b1147c7f4a1e7530bff4a14fb301a44ac4f4239d8ae3799b2744fb1f89012d64bfe124bdc75e27565a2a18a5dc72ea9e3061ad3e2fb854

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
179edfb3241c3f00f2c12d6aa7cf1aa6

SHA1
2f0a72e590cb95c4daeba87667799f6f1d2b2b7f

SHA256
edf84755a3b588591e48e7e77173bb41d52a765cbe9f9d752fc6b7cdf92a1e78

SHA512
be9d032e8ddf0afe6b5b8bcdebbf5fd41b1ecf24b687dd4991483e3b0255dc9ed4a1e85c0b3ec895ddc965dc8046e16cf98e6f865fa9dd2910d6c5101b1ae286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\44520d15-4c07-40f3-b6dd-8d154deadf64\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
f47b3062036626c19c6e44303a9141d7

SHA1
2baa28b120775c993ee72f07171f091a53344380

SHA256
8d257d65924ad0dc0a1e950ccdf8140bd80e75b13dd0835798536403c50f27c8

SHA512
a4f46056d90734382090938bfec36f4e3fb424bbd31d8638c5d9184deab3bb6124c43b0c3738877898a217f23fdbc36825acbf9734e9638770723514261a36ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
f39aed1ea2787825a53ac1a95034a588

SHA1
c6529dd08a5ab6a6471c3b9cf6abe302a07ef925

SHA256
3c8b9183a8500844be00667640a64fb41a49e6c891fdb066ff02645d0ce3cb15

SHA512
af58227bfb3ca6e4183dc12c947d5c41d7f18f5d255ea2811ddeb3797adee8549a026704f0b25d21ead040d3c8f512c0684307876d2f8254bee062381ad14f7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
3f43bb7829acc66d4ab1321e849cb49e

SHA1
190c0d29d665513c097df0cf2209aa9c1dc70968

SHA256
5205a8a5d70884c33f50cb8fc7621b01a8f1cf1889863bc5821186eca8dff1d8

SHA512
1fa8f5efa3d9ae61262e7aee262770d49da4bd4dd25f5f6b5e720d50075dac16e06da4081c9b5f3feecf7e377c2752d6e8c86a04b210a0f6538184fa079bbff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
ea53b6e60c31be58db95b5937b60cd2f

SHA1
4415aab4246c3492fa35c7cc88502100ac8371ea

SHA256
9c5d76eb7e4175bd42798a2adc03fe4908cba17189a14ef4f86caf1c28c8c435

SHA512
4a9b8bc2e89f1a009cc5ef0f761059853584c6ea83da9c8f45b7d96596fff9b2c63e0f36ddc3cf457ed4fc73f87444e27ae9eef24373f2fa3cc769b09f46961e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
974faa66bafe20b764d6f8c433f0afd7

SHA1
1d41fd4c3dfa896e2cc088a301f158b19fad7bb6

SHA256
22acd0c3ae7e63e8de1636cf9a16332793068f7a4344f0ed5db825f826752cae

SHA512
500e907799c813580649aee0983246400ffdffcbd1e03df51fe6c20b8afb78ffb5c9c99b9af21da49eb2f26219bdf94f9455baebe8179c472297cc693d571dbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57851e.TMP

Filesize
120B

MD5
7f95cfaa23eeb9bbffb14adb54eee1db

SHA1
d6ab738bfa6669475f26da82eb52286b30121fa6

SHA256
e8a37fe2afab2f23b5c3e28fc1cebaffb001de2af153883fca805acd3eacfaa0

SHA512
cab8c2021b439f58beb94c21b99bd72dbcbb50f7e9cf38aa5583829c815d47944ae2349299b82138071b28573266d78159f83d2e6d5b6d9a71c379eca0ce40f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f8a99199-3818-4cf9-a3be-e8347fd6e985.tmp

Filesize
6KB

MD5
9879ab1bf52c39e087ee99b9e625386a

SHA1
4718dc68ed030f6707b56545b9c8ed3cfed77079

SHA256
6d9095b87c547b5025fd4aec8ce3c377c5f1bb51e5b55c9ccebe46428b6a64c6

SHA512
d6ca5a636dd019d5852c9e8f74251126f874f9e47889d9e2d653b7cf599ac647804ceaed9264f9f2e84b2f0dfab4d401fab1aa1f2bd2e73c8ca069300c373bcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
d3ee97a4e28d0eae6cc1ca8e938cfb6f

SHA1
8ac43c152938361379f5721496c6b1a6c37e82e1

SHA256
5680c975ea8fbfc0e9928893b8b7d3e4c7a6be075219bf687515a151cd4c6d5f

SHA512
e03c7c8dce8f05dab2fafeefe216761b56da6214fa19f4ac6218be37450976146921c62e4dd54c1be54d43a6a957120906c7b06f8b6c115c74ccf13e975e9bd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
8e55f36e5b82a710b544dfcd574c3d1f

SHA1
ddb77bd19d68d2cfeca60e3c239a458e0b8a279d

SHA256
cfb3dd566dd7931a562c6c7daf1ad567b493ed7e227d11d1a79b586873a0463e

SHA512
ab97e861d10d2a188e4b9c3da55a05efebb5e0e55b6131bf97ec111746eae7490e0628fde60553236e2c15a15f25a19784313c470b1c18ce65c112eb8e90cf17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
b5f74f8804b216c892de1c06830a09bc

SHA1
d9e56a1bf2c41706b7504d184a7182aef62c9b08

SHA256
32a0c3f60ca27866dbbd7c2433798d071a8cfeb1c7e1cd6c1d3c583fd4552a77

SHA512
159827bf9bbc3000b6442a17e2e908ccbdf7bc64349e64cdacced2b81819ef4a8713610e4273e0be788e74464789e8c99702c54d7e0ebde5f79116f5f04b99a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
8a8aa71268b0f5a71e1e8ad544630668

SHA1
408c4ed88decb46a6aa8237700a121a52433bd6c

SHA256
73e61005f274526501c97c33d96a571d945cbca19c874ec7b7063e599a4a87b2

SHA512
2332a09f101cd2ab1d1d5d58a355d74a385d7919ff26e7ddc8b828f0602da7212a975729fafb9c476fe4c484c5d14737b94901c1d4caee141045d4d6fe89eb7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
38cfd3b6369833458c43ef4d58372a31

SHA1
d4f59c11b9caf432f8ac9fda59a305af63533546

SHA256
d0a9a5af456d4b68df17f48b464f2aa525a0fb793e91f7858c753c55db4e5563

SHA512
2e325ebb3a84ef7a5d154eb7f54e276c2a75492a6bf65e7335f18b2995c02ed45205260b3e5fd7131c931ae6b765716fc848f6893577271ad6993520ee804091

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
91463a3e4f6e28ce8a3a1801cf62a846

SHA1
ea04725eddcc001596b193f367f627f2a8543fe0

SHA256
0cca33b11db8c4906b356507b4b680c3518180a92ccade52271a99f3b1a0c583

SHA512
9633f26076cf3d261a40fd72d7c2ab22989a24e7501538d468de85f064c29b3b42f605282b5bf01c66cbce196cad9e4ff37a5ed867d7600df9926f81cadac999

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
0b9b83ef1f1972149f5d29b30ec6473f

SHA1
c8cc51ef2aa4516d9a02b577404e1067e33c7b49

SHA256
aaf4856c617ce3c34ffe08f2156dc42194cba65ecfadec66105f6f52c4cdf359

SHA512
8d1b9221a0cb4c9320b6d1c1a05fd9f5146b153eb65fb472731678d6a1835a4e51b3efd8a4710490f553b1afc4d3d3e22c8a1bafae055a81ea54b0c76841c681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
9b687d4acecd18c91e258428686856ca

SHA1
7c7a616b63562d956dc5a3f7803938baf99b3c5a

SHA256
693d96142cdefa1a7e272adc990904d07431f541803612136f15fa1d1a176947

SHA512
af3bab56047b57f7aa48090b840c0d21e021bfd9b99da03cf6988d76520515c05ab13bfad248199b97b5d9f06a271776bcf1c28ec9ad7090b2a34818ee035653

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
120KB

MD5
0f7acade30a1719460aac227714ebf7e

SHA1
3b94fbe5219c3e8d727f1c2f9a8be0f275812450

SHA256
8b8c9b9a2857cc7cb74fe0927a06731c8fbc67f76538b5abf138108bb5de1e14

SHA512
ded39a19576d840e9c6f769fd736e9f8cbbba022980ae0e5804a54e79c7afb401fa3000c7f7b44eb5116172454eb12ee679edad388d69a2cb9bac55877164acc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
121KB

MD5
b2d5bd33b27453b7062ae7eb3d32bd41

SHA1
8831667d3b249944c291afc08ace9426c345ad16

SHA256
d4d3eda8beb1de87ff3bf5b8f30cbba9cbc30db7713e3800016962a68e25f1da

SHA512
214c7d2aae7f62b5ea962bc67223dfec46b1fb88a85b2ca36769361a46b914936fe96c0d55006b3c4a6509bf2cc6585a347d2383b2f73fed60d15b56f1968160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
121KB

MD5
2545b076362fce66857aab203e4bd20f

SHA1
dd342cb84d1d427b67bcab58c698255670d9f83f

SHA256
88501b66a1a3d30acece6252c136c832952f4a64fdb6ef81ec183bb3d50861bf

SHA512
e30b9e851c1efb2a86bea9b5e47b6021deb9c2554f07b559c8655b20890aaab617608172f77d6df6961a9827b2d8fa74e62d82d289d17ce081cde05061fd7bc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585167.TMP

Filesize
97KB

MD5
9b8b77ff6440b7423c6a2a5aa85f8325

SHA1
615156f5a3e556d8e94aa1ad94444ac92d5e6cca

SHA256
56f81605d16ead19bb9ed4559729d2c6850716cf37cacf6fe284e9b619a3e69b

SHA512
8d02db5d9b78515254e3bccd93be078f3267b0a404ecf2a8200898bd8fa162243e0e3198566d972ca9186685a54124e3c3cc4bc2700c96d71a2ba6f38acd66b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b07fd091cda021c0cc95978ef7e888b

SHA1
7e160fa827baa58ce7111c5a3a2c7c6c5b559b30

SHA256
06e15fab22c8fe07159200598e90d6829e857c472e47d69c3934841e0949c4a6

SHA512
095c076fee85ece368b25b6a89bfce48e0430073950d94540eee8a16e2bf3cd73101697e8b58e366857a71d7762b44a92bc0f37c6533415090f0028fd2a45080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbfd8a342119fd41a99a7d48d4770c1a

SHA1
e05dcb68d76b85585053307c872a3a73c8c7c9f9

SHA256
46c0c71ade52f8281ea8dbfc743b04776872d16fb66ae8d62f8b26d4f0296970

SHA512
d1595999c295be2dca4fbf49cf75d6f1277e2d2300a2b5efddb89112d7a0754941739fa42e0081d6b44b7c2219345c751ac7170b500aa6c77eed6b07fe53e14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
20KB

MD5
2084d061a7365e85f081bab5aa1e5615

SHA1
6530888b2ecdef516539e65e04a29c579b2b0082

SHA256
82637f0cb7fb13c023b1b2acdd8a9c7551ae653dc6ecd5679f06b0986a88507f

SHA512
a087d7d71b26a50b3a146550d5d8da015c7c6453489941930ba472042867a1177e3b233c7ae64edd97d45a69a702ce5a64d927fe582ed52ad98ec86268f11154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
31KB

MD5
facbe21a444be3fc099345d86d823d70

SHA1
bb29f5d4a1660cc1f06aafcfe2da4ce9e2ba53c6

SHA256
e027d3b5a075c318e25262b0398682bde5144046c76f922b6313a6f91a606271

SHA512
0ab3c74e729dfb05edcc5d8ccc9913a89aee049819ac8bfdb6c4d394170572bdccd5a7a1dcfc5e8e20e7569f8449a61dcc8c3c1ca9387b4253976bef0e5b0401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
30cf0913e92b9264aa9461f4b17d488b

SHA1
c84281ba9bf31f81264a530130659523fe20058c

SHA256
3880564b1eea6e4f586ef0ce14d74a266e73b96ca1344009826a353d1564cec3

SHA512
f6660289729c9a674af84789cf7702e0533b509add1b14ae557042d109f371bf8d366ddce895676a6ccdde4c0268d67090c3c073b3e33394546a5e192aa28599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
99KB

MD5
771a20e40a9e0160c8e82f9f163947b4

SHA1
985492c573346a146170030fc9fad615ef4ccd64

SHA256
b41b82c2ab107006da8db0ace8e07d406c43cbba31cce2416bd8aa1523f11806

SHA512
4c7b55289af4a7c01ec47ec0a9f922a5c54907c432104c88b0d64dd50cb3a4ed4702e374829fae6e575976615d9d89d9383a64510fa03b8475f71ca58863922a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
ecfa10498298f92152afdde42e8284ee

SHA1
161e6251029a20b225445960d7be3b8d87627f9f

SHA256
62b30d5bff257e57063684ebb1c296b11591f202cf76ef91463da4537d407de2

SHA512
f589905b993a4d4d9591e5cb27c2e18a02f6b15cbc79b20de623708322cf916ba98236c3b1ff353b55cb6aedefb0f1015fe2c7a03e50a64b7bccbebc24568d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
145e4257100c2efc7cc08a74da9b62a3

SHA1
6406e13d5712c2f506908e32a70648df2e6d5613

SHA256
f321b3f46e4e658bc7d216c6adc4b86426bf99922773b60acddcc7f2993aa3f3

SHA512
b20372bdd6243864abbc3232fcd7a643c6584b40685340439a4fbd9502aace167aa8f85079c24811b9563e700b8c53c601ea9c91e6614433fa60550e5dae414b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c2be.TMP

Filesize
48B

MD5
fcf093c91d70338e08eb6f121e1db058

SHA1
9869524618444059c71d24c07ddbafdc81b73789

SHA256
3b54837e4cdef45a8556cb272a5a6ad1842c222563da8b1a627a78b204384901

SHA512
52a154c7c129dea1fca5bca3b440de645318d8c352e8be677a64df7628b2bf35770760268adde5683eedca89178f8268c183b4af84b80dfb34ddc3e443147b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
1452e56f7f05a988e78bf50fb6f06d41

SHA1
b272ba4c853c6b94f15bfd93f6a6b8eea49b8ec9

SHA256
f2df319bd9cb9afec5caf63404876604a416b5479f4ff3644608bd42787febad

SHA512
7a38b40122832aee2dc701ec552bb79640a3757bb02f78786137ca637e979cb2b00d125d6ee080b6340554d8d99bbe07e9ccd0413302b12b2f5945cb560d6cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a88d333b3ea18fbaebd0d9ec775c7d4b

SHA1
15618c3396173c7ed5c7a294cc2758ed3118981c

SHA256
ad7f02bdce49863f27b942e0846060669ab42a2837d980e2e98588b8f78f8655

SHA512
325d8960c4fffcf4edce1659b92dfeb125d21ca244a7533f299eb48c14ba7bceaed621e190de1365e1d553e1c359f249fcc7e5e4f969c2a4e86ab709bd0b49ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f158a159608f840b89a2283e3515d6bf

SHA1
eb587f35d44d6136b2cffb0730493e53e0ff6a70

SHA256
8e50389c69eb519ba82f7791d9d06376f233b0bdb69ccba5bca24aa24787e415

SHA512
ba5dba2573c1cdcafb63f65b8631a4cd54aba0b01628743002188783e784e969bf6e189368e3d7bb8ea33b7b801f362dc3dfc2d92fdbc0699773897c238b3ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
9638300727c43fc9ebd3d6d820f3a576

SHA1
f7a7b8deb10c400ff6e63477e5ad02e50fbe07a9

SHA256
8295a3777f1f63545eb14e327b45e79a5e9f8a85d943ff2d5a4c2afc4ee76a14

SHA512
815b6576b4087c04e2262f8ef3cf5246ffa46ab55967f1bc0def4a54d4ce52857c7aafc5506355890d14fc403cc0304e51b55ca38b5e668c55a1407099a6f0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
204519b4feee1a28e45a3839f0cf8ec2

SHA1
af08995a3a11f3a9ace415c557a464c0e7fa8098

SHA256
04504584e2c213157d25de5c06d948ec5cc6a9d501b594aeabdec703ea2f4d43

SHA512
02b7aacf4acf59b8e422ba2ab4a6909d1a6902f40e32ceeda3c9946d53d26a803ad8a1c85f1888f49c75d2489b0489dc634ba8b3a9ee356a813d579d77cd17b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0c8f4dcd345396fc734f58d47fb1aed

SHA1
4762c2b3ffe8ec347d4e0ce87019b93e33ee4559

SHA256
27533744f25a5ac3f581c8ec2581a11b8e8a9667bfabac284d020b61d4427b31

SHA512
8c9beab6855408d44d8986d1d3bed785ec9bc6f374e3c38bbffe821321a13f4efeaba670fc725c326c8ea6386bea6153a15cf8371e013a0d4c4f3465711b8af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4bf3ef4f30968ec1f1c10bebb0776d94

SHA1
9e7447e0aa23500bb721d97f648b422785ae8d6d

SHA256
44cd41464e902900d6c2ba6cb0fb30c0f40ce7cf1d5092ef4fbb657793816576

SHA512
4a603b926a6cbb983d45ba8065cf6c938b848f884baed7e28a6f722c173ac1707cea74601199eba2cbea15ec621144c4b972828d243ad91460d8f51e474ca0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a5d2f5e86d377dac3eb484b1f7d731f

SHA1
27e37ea35cde5ac22eaaaa36acd331418586c3b9

SHA256
cbdc16447d1b36df44f56fa784b7b5b15ac35638096fd5fe7ef6402d58eda80c

SHA512
e62a3b565d588491c9d2550a02df16fbf83871c111bb23473f9186a35d81149889e3ea55131b722dc77b406cd499d8aa9e77b4c3033cbc599cb6985490e1de92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f71b6127-cd04-4848-9a67-21b5c773dabd.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
e70750904afb2ebd2aa4fe9e52aa7e05

SHA1
5f4c61a447c0943ce8ef8dd8238e50b864e1d863

SHA256
d1657f4647ab01d9915b0d739201cdca747de88eb89ebd1b636144c8c0445feb

SHA512
b7088d24dfb9a3814bb5fc3d40291428a4e8b7a1cffb2e960ec060e3c81cf0ac1ebb31a461a909d19cf1c8146f6e87e362282a86c49bfcc5967d29f55ddb563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
70de41f9193610f4c81800f8c7e6fff2

SHA1
5dd974612f889df60ecf71f430a28540dfa8f146

SHA256
5ed6f937e4696f2bdec2860cb35cef91e9423e90303d500745d67bcae1ad9660

SHA512
707fc7aeae887ef631b954b429c2ec7feed9762a4781705a59d0e08d0d72aa964ad3796e85ffd337f63d459dbc6ca8093eb4deb6746e3f8515525b4471de57c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\BatchIncrement[1].json

Filesize
163B

MD5
bedbf7d7d69748886e9b48f45c75fbbe

SHA1
aa0789d89bfbd44ca1bffe83851af95b6afb012c

SHA256
b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

SHA512
7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\WindowsPlayer[1].json

Filesize
119B

MD5
736d17708542d925b6f452959c1f66fb

SHA1
a9b945171638bf1060836ef5f80599ec4b6e9779

SHA256
94f30c730a6d89740ffd189f1b42e7b5f3cc21973d8129b9a52efbb394b59180

SHA512
f4035fd5dfda49ffd16577c40d9ce955d5fc6fd81d7f2407a0e8c0a4b0094f0d5d34efb106e20900f7bee8eaad55abe573deba50c712d3f87725b308661a9c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\88b879c2-3ca7-4d1b-a783-2d43c53a11eb.tmp

Filesize
88KB

MD5
9caa8c614bab0c667ec308c2fc7268d0

SHA1
118810cb2e84e9fb58b45786809e1062c1032658

SHA256
3474c2e016e2e6558afa52729659a90e014e7437be68f8606f9f152f1ba2f8fa

SHA512
85111e6075bd5b5a260684cdcb30718f6b0ea295faeeb5e8e406848597a3e35b62a15cd0977c6a13c62537021db00d0bb2317bfe3773e40028495f4e19bf7369

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_480260212\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_480260212\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_480260212\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
7240b792fd5e92db6667bf3a6fff1bed

SHA1
de97171576bab34227c117eeb75d76238c9b0d60

SHA256
b43626289c91e9d8f889cbf1bce00f6d168614e743a74fd8297fa853b9e8c57c

SHA512
fe0b0c14d920321996a9c6c5c1af4d30ef8a2b330437ce36f2446d4be4a89f6edd4bec9e0bbf3bb0c2bbfc283993a9c12af4d382152b3c78741313b1b47aa869

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
30ece0dca40fdc36f726dc16fa94de09

SHA1
b794af416bc37f01d7ace8cec6ed19d543995cbd

SHA256
2f168e383bc9363e1b5310a3dd2b36813db05f0ba25f7fdf2126167ff9df43df

SHA512
72ea2c5f85db3010f21d0019d4384b51c482cb713dc95e04ac7611d9416b09e59ae83284b4f04b4ebd80dfede5a5abb23b71f27a10b9871be562418a29c82887

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
f7442a025f3d2e2ca9cb6b667e972db2

SHA1
bd34710f0236da0f119c93052e6bee951f45ab5b

SHA256
541d1e1acd56695eee9946d8c2e2b3c6980c9d333ab44989995dcac1b2cd4901

SHA512
54471805418b9b1e4fffdd6379feb74deddb2012eae75e327f47b2127db093b0642a3e5f14462cfecb9f54bd58e563b003a854c6a93d392845f83f4abb94b622

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
633B

MD5
c2c63c243a07779a22dcd6809b64b734

SHA1
de108f7b673e1ad2341207771145ccd0f1cc8818

SHA256
396c70f1aaf0ac83e52b86c96121658d5bad92235ad3bde21669056030352bbf

SHA512
384be7cbf2948280198e06b1d28da5c991bbea6da057f3c21bb15cd669ef8149b9c49ef7edeebfa33ac4232676da468ff12d19f3d780496d424d826e5f0ec21c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
633B

MD5
21e6b06180ab597b1646df822293d244

SHA1
896ab2386a56a880e2f140491a3412ca2125a5ef

SHA256
438f407be5d1454f9df90bf5c190828b4f5fdec34e72a7fd38eaa44c9f0b3e86

SHA512
610c973102de4c843a2731551bc3957982638f53a25bfb9d42a1006bd73990fc581a0f39bca5e4223c8caceba42b87cc69f11fe4afc03c73c49b766eafb1ddab

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
b3b8b05781cdcb9292c665f5bb9735c3

SHA1
2c88fd561959501a7412903c2ab81cd16ad4e5f4

SHA256
cb1cfb4a4f7118ec7ee695578c055c2bf4937a5eec63a6a4b73a07ca6b403645

SHA512
f8ede40a8c52746a303de80fb99f4bab054fe5b9fff40a81f7d405e653fbee7e0d0f823e355f331a5117e99193dc4b581adb98029996632229745e5579b8f6a2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
dde6e6e3037a3c83f9db2a991affd0ed

SHA1
ec301d9e59e31b821b2f9a985835f461f531e14b

SHA256
aa41d54af9867b37bb237b440028cadbac6f955fa3a616fdd2544475a539a51a

SHA512
19c28fec5d18b07ce0881221b1829b68cee7a1cec8585fed1b380897547ce05633980452b8fc529222f4f454fc47d8be1cbb72a470e4af0a3f15ea9a45775e1f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
19930bae3473e68ecad80e749b51dfff

SHA1
8b7ac8571e3d21a6067c831bb9e94af6f1b7c2cc

SHA256
1f8784122ebc8ff760354ceb3a58c5b7c257a61fba57fa6de165d662b6d0ce45

SHA512
f6a1f7c10d86046e6e0a96e2a23b48c0176662dad94897fd2525f3275f229696df205cce3c8ac6098790edb253bfe11f974d63440fb8a8b6028086572bbb1c8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
928403523926baeda50320fc6677fa7f

SHA1
9bfbea043b58fcddb98273f1f46e0a45b4d0e196

SHA256
1d7c2f29102921aaddc49d1d565d29036d127587ebe6146f4ce0b100108c7c78

SHA512
255b92167edfe470befd515b483871a154cfb770936724e45277060d8477b69f2afe5b20be2898507e31071e309b1dd6f01e6c63bf06edf43cca4a4d6c4d1976

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
12KB

MD5
6a8cd79b78944b1b342b4c11876f4025

SHA1
c4f246078a41f62cb795f4853c5ada7d439673fb

SHA256
53b38b203b7a41e92a5f68ddfe88af34b44bde0e206bf3f01652b3b74f1076dc

SHA512
b236857c9199436c63ea827eed0e676257aeff2c789cf45ec708182dfe6bd2609e33cd50f06f64b00b8b5443f451784e5e605ddd3b981e2cc476c101a26024c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
44b118917c08337e15cfc405afe47fc9

SHA1
efe3d4f1bb87c4bc5ac0635cb9ff498a74fe3722

SHA256
2dc0e9454a304acb64f9503ba1b10b2870e66566f1afa46fdfda290f0a1b26d2

SHA512
2656abbd398046609832862f3f2515a1e898c72f27935d2d0601e4ba00c15429932ab13a1075028fad3edeccb564211281836131f306b9acdb62a05f63dac80f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
def0df8c0277dd5945ba969c1a37d734

SHA1
6557c6b87b3bf87038d76f86c1d361bc9c9a687f

SHA256
e7fd1cd9ea490b45841a370a285d41debb21bca2245ca2676b1ea25ace525335

SHA512
aeb5687c489f171d372679fc7138de7545dee9af1083f78b32f659edab5c8a2bcda83715535dc8d4ae2a90888ee8dc9a9026fdc90db6b7f5e1b1ec3535540858

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
fa60496ea389d326004356e755e36249

SHA1
ec7b0a76c4f1eb9f45771f36c4d4fa60e1f4be31

SHA256
62f04d6e0f4023ea7531d84f55a1e22c8df48f8bc26095b4cd18b595abd8bacc

SHA512
44fa11761663be581e2e00fce6da6bd837b45132bb44ace3ea2b8e41bbe9c378575f9900a767a43536d0585a4e600149d1d74e7e097a4cb4a667f0b3eeed4db1

Download Submit
C:\Users\Admin\Desktop\ClearDisable.M2TS

Filesize
358KB

MD5
bdf2d007546413d9eee15e99d50d4a2a

SHA1
ca2b0a8b944619a66a2505975c278cc5c9d8e6b5

SHA256
a271451e05d97f7c1602e8931d62ee7995ec7340438c3e72c42f806626fde4f1

SHA512
e2d08c27e8222780b5f5abc90276a50cd167c327d7681d55e3e1f356676537ff806affb6c61562c2561fcf0ba640d6339f1367411673e5d187620f95a286c7ec

Download Submit
C:\Users\Admin\Desktop\ConvertSubmit.3gp

Filesize
532KB

MD5
1b16f7f9c7b5961199f28bc6a359fb61

SHA1
31ac16fa9a7852d279382743a9e3d402e197c8d2

SHA256
28782a75ab67301af1d78c0c2aac13d674b74a0f7de34814e80a1cfae3fa1757

SHA512
d6b13c7fb4963b8023f34f22c39e896b9f5fceb20c370f71b3851cff07b01cab5b98c3b42bbeeb0d23e6148d2c5d0f46494db222f6d6fc046100cda83b3d1ab3

Download Submit
C:\Users\Admin\Desktop\DisconnectRegister.xps

Filesize
629KB

MD5
0992c3e996925bd49c21129f2ba4ab54

SHA1
406cf8d0aa169ade4cf8a364604b7e53cc58780a

SHA256
0725c5e3af57123efe4d554bc54686aaf94f0cd423442ee18fd54c4bd8d5743c

SHA512
8c495a6861ba83396271c04dcb4f5623447037991c1b9815d3003e41fb09793dd442975157adddb7daaeb6c9e9dc4e6de81986f3a5444adcfc279e7abc60c8a3

Download Submit
C:\Users\Admin\Desktop\GrantUpdate.3gp2

Filesize
319KB

MD5
81379e448b8eb597c230e546862c77b3

SHA1
4e9ab7e10e55b6b1c73d51a20d832f92f1a34331

SHA256
d7aee823dd92f49d32be7e2185a557c0c08ef40539f36aaabe3fa61d324f1556

SHA512
9a0b0cfcc43ae6ef50d6eff360f1ba633eb5fa4ec385c387168e5e5dbc0b7f63425cf2a58d75fed932c60aba39b8528d8f4d825db308fad9d305ae4112189b83

Download Submit
C:\Users\Admin\Desktop\LockCopy.lock

Filesize
261KB

MD5
291d4e9460e7f63a35e7edd47e675946

SHA1
649d513f3f127ae0191b1284f1c6f59586a1af92

SHA256
fa8bcbff3c9675a06688f623f10c29a58367ba0a45c2cbbc3a5c05321f2090aa

SHA512
61813400ca8a2a2c8143e7f920ad1dac7309f8325f144202415514261dd39d2377d1beb79990064e3c0d26b4a55cbe1a58888fb1adbb974e62b7fa2541a441fc

Download Submit
C:\Users\Admin\Desktop\NewWait.ram

Filesize
300KB

MD5
214d775ecd27a096ab180269f6d01876

SHA1
3b7d2a20b358c31cf2100aae6fcfe33e5693f47a

SHA256
ebda50589acc7b1755bdc1546fdc41fae64ea20a59373579da0d55ba17925235

SHA512
5c1e3e6937afa85d5ee8906d7b59e49e4ad94ab26019135325a398d3bcfac49c55bc70e533cb693f1e78a07d4b6f0c7b0a48d350d194d2ade654c70a8d0b5651

Download Submit
C:\Users\Admin\Desktop\PopEnable.svgz

Filesize
377KB

MD5
65a48b21faaddcea6a1871a312401af2

SHA1
0f15f97ad5ca80bab818fc7e653f49c2e132c334

SHA256
89554bc999dd33a1bdca8599c51b3052fad3824c17540ab68e4ee4b5498ed94a

SHA512
91f54044811591b253df037d0ce31f467308baa4bbb1fdef1a7e2bd6c6fb88229e5fdd57c49e0600948161b289b29ec28f13e8b747c01cf1c039a7427da04fc7

Download Submit
C:\Users\Admin\Desktop\PublishGet.xltm

Filesize
571KB

MD5
6e7f02fa59dcfecfffb6a8a404209355

SHA1
fbb2d34d55144ac9ca0a4a29f1c5b226a1018e87

SHA256
7d714d4348b334066699f10647befe29bbe8569a45e36063a10325d52cd97951

SHA512
6dd791cb45eb5e5275161e95f93ba2d79e169f2c99e27c2416b744a4df8134b1c71824ee8776afc4132b0db78318f76d7b5ef5c93d11735189d84508c5d0e2fc

Download Submit
C:\Users\Admin\Desktop\ResolveOpen.vssm

Filesize
241KB

MD5
31d5c3d45cd4cb4635f65572983710d3

SHA1
7937d92f46901a75ff6dd42c184b4d7b8f1df16f

SHA256
0d2deac05d3659c4dce7c437efd62013beff19b5d54d8771a1b94b3c281a6d20

SHA512
473973106548b4d526c06c90ed948fa78b70409f6ebb7f14f557fa82b060fa0646dc555b6daba31c28c1bc957774552842f801d20e83b33aee9c5aa7be299211

Download Submit
C:\Users\Admin\Desktop\SaveAdd.xla

Filesize
222KB

MD5
441e1275c6b04b7c4381f4683a9c7c2c

SHA1
0b83879e1d4aaadcaad3291285563b54cd05d14c

SHA256
e32f688c5046cc72833b9e06caf98cfe013c2620a49335dedb8a942e3a16994a

SHA512
0a9f7493b23de35b0d5da79594481a5e01793254636017dc9b4c3630c604f7b2a2f2ff788138ffd003c25c72163bdafd8b3f7b7659d8627bfac44a35d248a6f3

Download Submit
C:\Users\Admin\Desktop\SaveRegister.xlt

Filesize
551KB

MD5
b747846495f2ad0f499e0825d2cc3f4e

SHA1
4f50c8985d6528448973780b6f73834789bc68c6

SHA256
1e55b501ce5a77767359eda7298b1f67591305256943183a5612873e4009eafc

SHA512
b7368a0f59be5652dff8bb7cc7f9b542a2df5b2d5c14b54788fcdef339a872a6632f8a51fb686d4028e0196efdf73468f27dd80b9f25c982a62ce0fe45384654

Download Submit
C:\Users\Admin\Desktop\SaveUpdate.ps1xml

Filesize
454KB

MD5
61f0d472587444a4a695db50690e713b

SHA1
a643c7e0386a2be7af04fd7c012f3953c37458be

SHA256
ff5e999a3305a977717d0abdd9d0de93505820d36be341306d0202a139625a82

SHA512
26e745ba081952801f46e77d1940cfa2c49f16d45e1861edde7111a356485b6ec8a2fd7c43f0bcd26238266a34a6093aa447ff02db267668e9cec425a8094cb6

Download Submit
C:\Users\Admin\Desktop\SelectMount.wmf

Filesize
590KB

MD5
97b5ee645bbcdf192aab38e8299d3750

SHA1
04e4c5b64e43d4246f833d94579fde7e97467734

SHA256
c093f022d36d419a770fb4e29693f3e956a7ec5a09415266eca0cea92b7b6897

SHA512
41d3a8c643a2120a5af6c78d769ee34d775fd575fc7a00b78a3175c2c510a9a5519a9558caa6a87de85f8f2866515c7f8f192c9ea1a17fd253517ffd05898f71

Download Submit
C:\Users\Admin\Desktop\SendRename.midi

Filesize
609KB

MD5
b3da9305143233dedf637497bde500ec

SHA1
a20a12b9bb4521d34085c7c8b2857e2a70da2371

SHA256
73a11817e75ce23f52448b772ae992e1dc66344b0c4fb2dbf6cb4183a926b787

SHA512
b968c7065d875513f995b24d99c519846a5f0ef12938de77997474cd4bc80c39f4793e09c664787fac0b1a0fbf58003ec8dfd98f6ac7cf01c10d780c94069be3

Download Submit
C:\Users\Admin\Desktop\SyncAssert.png

Filesize
871KB

MD5
684a3b188b2deb83c2758d9066ebedc5

SHA1
b6c3c01ae4975fccf990031b82e4c56c1ab0a940

SHA256
79d89659f522318612d7ee9acee1cc106523b30ee70c12c73a2ee770eae74d15

SHA512
e3bf8f2fb05d68f10805ad7bfcb6c0e5e4cead6a4734d13200d0f39e1ad02311e8e1120c8035c8dffe696d2555dbe6235229349df43588e74d5da5a21b4e1468

Download Submit
C:\Users\Admin\Desktop\TraceGroup.MTS

Filesize
416KB

MD5
7ee186f539d27473e76c19320fcecea3

SHA1
0ec482cb08222dc6b23b613339c5a0c4b866a426

SHA256
61cc09a3123f3ad2977cf08e5528cb0fc94761160b7c50b9bd31d3f03f981c98

SHA512
f34519fbcff7284bc00fbf17801635fcb95fb89fe7899ca7c05b4ab9a668718b54dc57e8d320f63e16cd05ed190b5fd3a95c746ffb8bd5201e3c18c416497f04

Download Submit
C:\Users\Admin\Desktop\TraceUpdate.pptm

Filesize
396KB

MD5
3716505db2ba5cdb82ea9965f079d71d

SHA1
72569363834212fa519ba19eb1e1acaa2104ef47

SHA256
63a88600e5704ee4c1b5085689d700d0b8f24d810c7c5e600e9ef39d71646835

SHA512
2c4befc94309b8024b488e92e760ce478226d1e0998ef87d488ec093cd523d51b9beb3613a58029e07c066971cec3d67e568deb3c20ff94a634cc27e2cb6f471

Download Submit
C:\Users\Admin\Desktop\UnlockRepair.bat

Filesize
493KB

MD5
388e574a77f78b3c8e9f1696109abc27

SHA1
421dd7fd18ef8ff59bf27a7b34e741b12270c333

SHA256
1275cf9a9d25e305d6322b57e5e35256a85f1c14529038e08e240b98f370b2b6

SHA512
afb7082aaaae51ed9749af55a3a465e3bd58a6eee0b7a5a0690062f7e370f139969e4af253982cec7edd46f592b786e392a97619f6759453cc4b5e4aa56b8e79

Download Submit
C:\Users\Admin\Desktop\UnlockUnregister.rar

Filesize
474KB

MD5
cf067a929d030d74f2c7f59d0e3fb93e

SHA1
6a4c2884351dbf2d443cde60b30dd06408efd1ad

SHA256
cca7325a37805323b63ac419224c22680aa4b9e621673714067c9d16e8743778

SHA512
82de37e176423eca9c18210a960a9c966a7678d3a58da94ba486eac6ff892f7bdb6db7d3d45a28243bc62557be339a7bea5d63abe458f54eef6868eea916656e

Download Submit
C:\Users\Admin\Desktop\UnprotectSet.asf

Filesize
512KB

MD5
0c1ec3d4c7ef995831de747b17ee5d88

SHA1
e7138a7d2939c322608e3a6b5956870857fccceb

SHA256
98ec442f8fe7f23b03118c76a25b19a4f40b78842540755ded4c37ac72a10567

SHA512
a04fbdf9ba261be65683d3ef7070722616521e2e832a314cbeea9f3ec860bc3f890a1f7c975dd3c5345b8c2dbbf47f732fe2c3eccc11cda8d1806560162fed09

Download Submit
C:\Users\Admin\Desktop\UnpublishSave.mpv2

Filesize
435KB

MD5
e19a83bfb4b0f0df6ce401891409743c

SHA1
ce6ae6e55f5a6d0eba1fa1a7bffaf33b36d4af3b

SHA256
5da12a5c4a80c4a0758024ab36a1becc6fc7a54dda395f56c5deda9c6665f68e

SHA512
3c1c2eca444e5c70d825a1c530115b42d1e2bf975a784f4af42cdf59b27c526a081d064d210668332347bc49fe1c359d18a2f642646288f5b6652664f4240d24

Download Submit
C:\Users\Admin\Desktop\UpdateClose.vsx

Filesize
338KB

MD5
b16b91e71c962a5054ae49457197e5c3

SHA1
43fe62fedbdf89a60702e16b57b205dbe1f9b5b3

SHA256
62d8d01b6da44d439478a9af33a4beb34691c788f1fe7290e2a4aa0466f551d5

SHA512
6803d77e40fc24112257c4ceb391ccaab4a08b09a7582532aa0b19d0ae9ecef9d32167cee8a9a04f6b0d1fecad92723445de52dc4b6739159470f25b6b1321e3

Download Submit
C:\Users\Admin\Desktop\WriteStop.zip

Filesize
280KB

MD5
e656ec908ccf51545f9c26debd65fa8b

SHA1
70ced0f9c95ff5125dd156b5313d0d5e322f2c2d

SHA256
a13c548b49602cec33d566e7c5d52ec1447443ce70165d4e4ce2aaa62e2652e8

SHA512
dde1593b1429c3646f23a83fe53e861099c2e38a2c33e41b35ff70fdb6bcae7a6df7ba788bc19a3c8067049f44162c37bd8edded14a73d00a157c2626460441b

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
0d27f9cb1e48cb0dd24a3c7563bb56f9

SHA1
f174179176a400842251a38009ea194c1cf5751b

SHA256
0dd0117aa603ef82d810ec10ca4ee6cf1fcbf8b7d9e9c0bb9562d8ad5954fb56

SHA512
3e81fc5790f8244a0065f06b88772a9ea51c03698ed210dae987e3e8e475277cc121055fae771807d62bc37aa80899b216e0262459ad59bb5a84ea591d7f9aa9

Download Submit
C:\Users\Admin\Downloads\Tower Of Hell NEW GUI JULY 2020.txt

Filesize
72B

MD5
b79d4acc7cf1067b933d638d5ac43ac3

SHA1
572613c28411a26fa7b234e5182cc79485262447

SHA256
6047980827900126b3191ccf9c19e97a0d11387bd979f991c8c63993f6c0a6c2

SHA512
57da31e246cd481e6f129c3bf23a49d69592e50c999a99a2c2affc8f6fc144c27912c147f4b316b305d7990bb88a13d1dcbd3f166a47c37094d43d20b5706d89

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 528289.crdownload

Filesize
3.9MB

MD5
d9f15227fefb98ba69d98542fbe7e568

SHA1
248795453ceb95e39db633285651f7204813ea3a

SHA256
5b70972c72bf8af098350f8a53ec830ddbd5c2c7809c71649c93f32a8a3f1371

SHA512
76f8fb624bdf303f7ce7db234775b30385146734aa5e94830efc0601aa7a056d30f37d59c6f86a6ed0ab59da3134bd3a2a07402d08474e4e34a2000e6eea27aa

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
b3032895ca5ca5b83813b678637dca57

SHA1
72eb4c8af8d788183efc41d3c56841051211fc3c

SHA256
c8d9627879ee9bfdb515233c11a86f79bd17874625b3d9ef680362534dbd8042

SHA512
c10d38ea7a5e08893cfe8ccb14afb6a58df784a378ce267587678d1a5e26ecf8c4600552b519d7cbaacb0fe39f332f0c85a76beee7ad3886e67bfd2ed10930a8

Download Submit
memory/4236-1239-0x0000015FE5000000-0x0000015FE5128000-memory.dmp

Filesize
1.2MB

Download
memory/4236-4412-0x0000015FE5000000-0x0000015FE5128000-memory.dmp

Filesize
1.2MB

Download
memory/4236-1267-0x0000015FE5000000-0x0000015FE5128000-memory.dmp

Filesize
1.2MB

Download
memory/7956-2131-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/7956-2119-0x0000000001A00000-0x0000000001A01000-memory.dmp

Filesize
4KB

Download
memory/7956-2106-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download
memory/7956-2132-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/7956-3303-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download
memory/8364-3491-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download
memory/8364-2141-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download
memory/8372-2149-0x0000000001900000-0x0000000001901000-memory.dmp

Filesize
4KB

Download
memory/8372-3506-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download
memory/8372-2138-0x00000000001C0000-0x0000000001244000-memory.dmp

Filesize
16.5MB

Download