a2cb0e7359dfc56f8b8e043d20383c60867f0dcfb808cca56318a1a36d3f8d66

Resubmissions

09/05/2023, 18:41

230509-xbr8tadd33 1

09/05/2023, 18:40

09/05/2023, 18:22

09/05/2023, 18:18

09/05/2023, 18:14

Analysis

max time kernel
906s
max time network
1051s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

pete.svg
Size

13KB
MD5

41e8b14ea397af921e8c0c7856324f7b
SHA1

af831d8dab0472e5b9275b19b464002f879a9399
SHA256

a2cb0e7359dfc56f8b8e043d20383c60867f0dcfb808cca56318a1a36d3f8d66
SHA512

1536da8cb02c917065cc538318a36bed80b782fc51ffa2ed1e3a563b4fda5ed0c31290c6b92efd30ad275aa14e3666ec208288eadbae770d0a61aa9aa5d18854
SSDEEP

384:LKuyWu/uK2BlW5P2Zu0zyignTeNS1YlPPC3BTpDH:LKubu/uK2BlWjoSSlnCRTpz

Score

8^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Executes dropped EXE 15 IoCs

pid	Process
1512	RobloxPlayerLauncher.exe
944	RobloxPlayerLauncher.exe
1956	MicrosoftEdgeWebview2Setup.exe
2020	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2180	MicrosoftEdgeUpdateComRegisterShell64.exe
2604	MicrosoftEdgeUpdateComRegisterShell64.exe
2040	MicrosoftEdgeUpdateComRegisterShell64.exe
2584	MicrosoftEdgeUpdate.exe
2520	MicrosoftEdgeUpdate.exe
2096	MicrosoftEdgeUpdate.exe
1224	MicrosoftEdgeUpdate.exe
1040	MicrosoftEdge_X64_109.0.1518.100.exe
2632	setup.exe

Loads dropped DLL 36 IoCs

pid	Process
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
1956	MicrosoftEdgeWebview2Setup.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2180	MicrosoftEdgeUpdateComRegisterShell64.exe
2252	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2604	MicrosoftEdgeUpdateComRegisterShell64.exe
2252	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
2040	MicrosoftEdgeUpdateComRegisterShell64.exe
2252	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe
2096	MicrosoftEdgeUpdate.exe
2520	MicrosoftEdgeUpdate.exe
2096	MicrosoftEdgeUpdate.exe
2096	MicrosoftEdgeUpdate.exe
1040	MicrosoftEdge_X64_109.0.1518.100.exe
2632	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.100\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\fonts\NotoSansGeorgian-Regular.ttf	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\RoactStudioWidgets\slider_handle_dark.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\TerrainTools\sliderbar_grey.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_2.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaApp\graphic\playBtnBackground.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\msedge.dll.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.100\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\fonts\Guru-Regular.otf	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\AvatarEditorImages\Catalog.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\DeveloperInspector\Inspect.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\StudioToolbox\AssetConfig\public.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\identity_proxy\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\TerrainTools\icon_terrain_big.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\SelectionBox.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\PlatformContent\pc\textures\sky\sky512_up.tex	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\ErrorPrompt\PrimaryButton.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Controls\TouchTapIcon.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Controls\xboxLB.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Emotes\ErrorIcon.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\StudioUIEditor\resizeHandleDropShadow.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Input\TouchControlsSheetV2.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\PlatformContent\pc\textures\grass\normaldetail.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\VoiceChat\MicLight\Connecting.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ViewSelector\left_zh_cn.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\DarkThemeLoadingCircle.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\9SliceEditor\Dragger2OutlinedRight.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\MenuBar\icon_leave.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\AnimationEditor\img_eventMarker_border.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\PlatformContent\pc\textures\sand\reflection.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Locales\cs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\AnimationEditor\button_zoom.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\MaterialGenerator\Materials\Basalt.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\LegacyRbxGui\popup_greenCheckCircle.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\MaterialGenerator\Materials\Concrete.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\VR\edgeBlur.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ViewSelector\right_hover_zh_cn.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Locales\ka.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Trust Protection Lists\Mu\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\SearchIcon.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ViewSelector\front.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaApp\graphic\EducationalBackground.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Emotes\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\Settings\Slider\BarLeft.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\triangle.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\AnimationEditor\img_eventMarker_border_selected.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ui\scrollbuttonUp.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\content\textures\ManageCollaborators\FriendIcon_light.png	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a40000000002000000000010660000000100002000000022974e12e310330e2f180995c1290824afba2dd5f9aa4bb0f7f4be4daa5b094d000000000e800000000200002000000046a08e2d84a7292c933e43a85e290a08509eb645c4afe176b3d1bca56cde39f020000000ed36b2598e030b4b4c41407c2c15cecb0a2425b239c5d13607234a514e1438bd40000000b42bf2230bd6b4b24de53095a54dc8b5e1dcd9c55fe736c0b7161489b0cfbca8fa20e3f2b166ae17685c321ded3aa6104a45d98a93d22a5286adb0277f3d0eff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FC3E5B1-EEA7-11ED-8645-C29C0423A1DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390428711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a400000000020000000000106600000001000020000000f82245776a2352a5f106dd120a5d0d03b5e02c325e22e3c57752090d11a45757000000000e8000000002000020000000f27e645d96c20abf5c0db78e1f8ad853aa3e5647dc7c6f6368006b7d92d716f790000000f20d3626ce804c6f6c644d49428667d02301d4ec985c8fe1ae3df0abd596926aca5483ccd225cfe2aad4a33f6ff0f5cbcddbf6bfc4d131df9f5d3cee6fd3047639371043fc7ed08a0947bf2241d25753cb2a5387eaaf0d4534f68496d971e298a33d26061b75dc215b5fc2ad8865e54a85294d036f561a1e354a41dcc823e441597f2e4f7a547f5430d614b4011533fc400000000316b18e9d09d80f223f4857ab3765bba28eb8af01fb753a9d5a8087983e015f53b3d588ea7866f0aa3850e2888c8e3179746a269dc2b9a7162335c855921c11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f5fb06b482d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BB12E08-C7FE-4347-95AD-FAC37198F203}\WpadDecisionTime = 40e21582b582d901	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BB12E08-C7FE-4347-95AD-FAC37198F203}\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BB12E08-C7FE-4347-95AD-FAC37198F203}\b2-83-fe-98-30-4f	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-83-fe-98-30-4f\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-83-fe-98-30-4f	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BB12E08-C7FE-4347-95AD-FAC37198F203}\WpadNetworkName = "Network 3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BB12E08-C7FE-4347-95AD-FAC37198F203}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-83-fe-98-30-4f\WpadDecisionTime = 40e21582b582d901	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CurVer\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
1512	RobloxPlayerLauncher.exe
1512	RobloxPlayerLauncher.exe
2020	MicrosoftEdgeUpdate.exe
2020	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe
Token: SeShutdownPrivilege	108	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
912	iexplore.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe
108	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
912	iexplore.exe
912	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1968	912	iexplore.exe	28
PID 912 wrote to memory of 1968	912	iexplore.exe	28
PID 912 wrote to memory of 1968	912	iexplore.exe	28
PID 912 wrote to memory of 1968	912	iexplore.exe	28
PID 108 wrote to memory of 1004	108	chrome.exe	32
PID 108 wrote to memory of 1004	108	chrome.exe	32
PID 108 wrote to memory of 1004	108	chrome.exe	32
PID 1416 wrote to memory of 964	1416	chrome.exe	33
PID 1416 wrote to memory of 964	1416	chrome.exe	33
PID 1416 wrote to memory of 964	1416	chrome.exe	33
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 108 wrote to memory of 1080	108	chrome.exe	35
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37
PID 1416 wrote to memory of 572	1416	chrome.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\pete.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6709758,0x7fef6709768,0x7fef6709778
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1240,i,16246609073317580204,5117106094009874641,131072 /prefetch:2
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1240,i,16246609073317580204,5117106094009874641,131072 /prefetch:8
  2⤵
  PID:912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6709758,0x7fef6709768,0x7fef6709778
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2120 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2164 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1420 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3632 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3704 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3904 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4032 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4044 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4352 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3944 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4308 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1124 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1688 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3984 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4464 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4000 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3600 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3392 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1228,i,4056738512265245634,7234762886049685274,131072 /prefetch:8
  2⤵
  PID:956
- C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
  "C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- - C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
    C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=6f090470c7ac493ef88cf9d686298b0dca19572a --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5dc,0x5e0,0x5e4,0x5d8,0x5ec,0x11a578c,0x11a579c,0x11a57ac
    3⤵
    - Executes dropped EXE
    PID:944
- - C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:1956
  - - C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2020
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2252
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2180
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2604
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2040
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTVCNjlDRjUtOUJDRC00QjYxLUEwNDgtQjdFRjE3QzQ2NUQ1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0QTZBNUMxQy03MDU3LTRBRDQtOTZGMy0xMTdEMTg3NEYxQjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNzE5NjczMDAwIiBpbnN0YWxsX3RpbWVfbXM9IjE0NTgiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Checks system information in the registry
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{95B69CF5-9BCD-4B61-A048-B7EF17C465D5}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2520

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2272

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:2096
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTVCNjlDRjUtOUJDRC00QjYxLUEwNDgtQjdFRjE3QzQ2NUQ1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFNDJFQUYyMy1BNTQyLTQ3NTEtOThBNy0wNTFEMzlFNkIxQjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjczMDA1MzAwMCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF32A299-FCBB-4F0E-A449-D5A97F8B2C09}\MicrosoftEdge_X64_109.0.1518.100.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF32A299-FCBB-4F0E-A449-D5A97F8B2C09}\MicrosoftEdge_X64_109.0.1518.100.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1040
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF32A299-FCBB-4F0E-A449-D5A97F8B2C09}\EDGEMITMP_9BE94.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF32A299-FCBB-4F0E-A449-D5A97F8B2C09}\EDGEMITMP_9BE94.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF32A299-FCBB-4F0E-A449-D5A97F8B2C09}\MicrosoftEdge_X64_109.0.1518.100.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2632
  - - C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2632" "496"
      4⤵
      PID:936

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {AE1ADDBF-64C0-4BE5-9C63-35F3D2729D95} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2356
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
  2⤵
  PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\109.0.1518.100\MicrosoftEdge_X64_109.0.1518.100.exe

Filesize
134.2MB

MD5
1bbdafda28065802d7f55126a53dc1dd

SHA1
ea8830a2fbe7169a313c4ccc50849c87efc4e697

SHA256
9d261496ecbdd22cd2e61c7a2fe362cccc354cc3c1166c5737ca77c063bc5565

SHA512
3fd57efc476377b5544f51e0ca11cf528ab6bed1bc1e7508b855570016e74e6da2cbe773ee7dd7723b3a2d558c5d2f55c948c7cf34f5b5a94814513f36c45079

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Installer\msedge_7z.data

Filesize
3KB

MD5
6e3009aa8be4f29b3ecb643220ea9c5c

SHA1
eb2f4c98e20caeacd95236b25725cbb6252df7dd

SHA256
40d7c7127d15e04e5145ca35d514a49256344e53722bd52dd5ea3dc95331b7b1

SHA512
6b9363d44664045d6a121f9638d94561f1cdc4563f105894e80c76d2e917e3df0d42e57c10431024be700ac40abd698cfeff124429f7eec1989f9c9358e62d7c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2632_1745675010\109.0.1518.100\Installer\setup.exe

Filesize
3.8MB

MD5
ced2abbb0f3b81ae5432e751ddb94b70

SHA1
3918c7afc8b82453da6f64b697373473e7b53fbd

SHA256
e9df92567aedbebb4e059f161dbe144e3326c26938edca614613fda6dce80a85

SHA512
310dcc316eb3175414526f957e20407e3110d89805d03740b6ff80fc2169136f104447d7c2cf768355c9a30a2cea5d6e4a92bbfdf79ed62f3db4250a19696575

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3583.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
95b5b81915323f8b91ad2cf6161c71f0

SHA1
424e60bd550fc3736fcdc7e19ea3b49dfaa261ac

SHA256
a114e6f865e407b6296ac00acd3b1e1e79953f589078eb6acdebdf1b763543e2

SHA512
2a3e60c77d18717d418f67d47063aadab35a65ad75d9bc8852830a1f36f499bea3e27bb0701bd61517b24a2d9d21e97aae28ed552869af51545cb865d6a76479

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
cac6ddfbb30fa87f2b7f417384d9faa6

SHA1
f3137108150c046323d0e9ba35ec124eead3cfa2

SHA256
560cd9857cbbe9931fa9c04a7228df3d4477795087c2a4c7f7a2b6c0d1b1cb5a

SHA512
a90cc44bceeba8ebda62f041f0f85acdadad112f49a5eaf7d9310f5ccbc68248096d63e231cdda115c48db60a1a57487b51aef0e90ba92ed7ee9e9bbcd4a9ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
f9da6d6459ab709b11d42be0785811b1

SHA1
70749fc308746278cb644ae2e2f4723227f49bb7

SHA256
ddd0b032d0d42dbb2c8a3333f38d55c71169e322eab365b558232ce81c35c040

SHA512
43a9e373b7649b42123d9e7315ac34d9ebe95135decbbff0fbafd1e8beef773bf55a5946c75b85190e3e46f996ebdfaf7ab18d70c13487dd48ec81e69ea0c7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
49a8144c859a3ae7497d8b902e4c9d2e

SHA1
e080791f76c3dfdd0aa3904e5d8e122306a0be6f

SHA256
7ec1fbfa4984803720235c778a471bebdd01d835eabf66d2026a189b08276cde

SHA512
686a6963af8ac1166ccc836f9d6d42d8ff2ae190d0f702e554666411361f04bf6c278a792db526c219f97f449e76ba9108554fd1a192f466b0a62c1583e94b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
73ee12e72c496c94d0ab237a68b7d29b

SHA1
c98f7fc9348c0238114a8e5c847429bc45386e6f

SHA256
37df96a2785c8259617a997d3022c1b8e90a4b3317ddf590cf7b62d591aad683

SHA512
ba05ae7dfd02ffe5cc3390b25a59587f7a2711c3fffd99f7f436bae6ebc15d353c86f53b801eb0877dd5241786a2da1d6f700605c9e19998bb52edb68c04d118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a904f166e11b1aeb165de4213c030b2

SHA1
b4bb251b7f13745ed0fba5cf505f451d91a268b6

SHA256
fe50f5ac545d07952a2bbf85ca22c21421c871994c333527c40ad2bad71fbc85

SHA512
e1fe2acdf315fbced62f29f126ad9f804aab23467b90138b1333d484ee5000f88ce221c6fdaad9425f517ee5d9cb28bb40d0f17e94b66244a876c79a358b5a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5307e33146ad45fed5a8ad475d5ad34

SHA1
4fef86a60ce375511dfe108389cd82d55d6334d7

SHA256
dccb24392422c5a2d4c27eea94cf7c0df4ff5eadefdbb2a84f84bfed0ade48d5

SHA512
af5d65ca45beb7eca947724646c46e5223142bc0e441fd051340229f43da654256b9baeb65b9c40e848eb6114217e29705076d3fcae18baa9378a23cf22e28cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700ce1b21da0b21014c80f6e69a301af

SHA1
b34212a35084d342dc84e21987f4870f392edcc6

SHA256
06ba384226ffdca98c14a505b1cb3faae2ad97aa918f816f0076bfa26264937f

SHA512
0fba8b0d1e016d117e59399846c3caf257f0e8fd88a0682d743ed3aaf7db3089ede2edb50ef5b49311c0bf80fd37b008629667daa76c8483e541e873ea3095c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f8dfebc6fea80a3689a32f7c48857a

SHA1
a1dbf96706b2a4ed9be67e9d388c92043ec8f8f5

SHA256
a53460b517778eb1fcc00b7afeb54986319a7a13c0164654d66dd8a1d7ef0598

SHA512
6da42fe66ca5cf2ca13a0faa36a3af59d691bc58c83ce1d9a4011fefe495d5f1ee1d5a03e255c11803423e4a3bc5fe7b253b3dba49044c50eaeca45a9872b21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab901f780218e52566ff59052ac8691

SHA1
6b3d31f51cd5058f18c57493e25eccd9a57512d8

SHA256
0c0739d0cb48cea1579ffef5b7b981015a5a49aedb8357cf688b87f60cb49fab

SHA512
51bb0af88d3d585d2faba4dfe38f1aa1f8c596ede1d1c13ea81199e603786fb9cb44da77d2c1c4239e5ca541c74e4ff13ac020f4fa8f6cebd59b599c741bdc97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18ff973f9a14a69e00af3369382f3ed

SHA1
c93556b20e8baca66ae71c7c3b4fbc2db03e52fc

SHA256
f49a82577ccb36227777717c4496996bce8d8b707b9e85c5af07cd07d1f2b7ff

SHA512
01e7b0051e205f258d6bb9110893ab197eba4ea98239a6be70982e3d284784d1385bb5b1932eb419e2fc01fed5fda1e4c41ebef67ae8690146d8dc952840e0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311674bf988ac9bd48c6ff52d3cebcd3

SHA1
8f7e55d6ba40a7bcf889ad79196be369f47cdff2

SHA256
0952e1eb591cf83d7066ae69ea6f7712d71394c5173d038a00b35b371f3b453c

SHA512
e5f2995abce21acf70f9c04ee1dc6b8eb6b769527a4887fa63bb01ffd7d79eea40623f5d97e0fbab5a7043129a0d4e9e17cb89e4c3b244beea9cd9c6dc8f3da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2afb1bb9c211223d908f232066974a3

SHA1
52cc71cdec4d9cd02673f7baefbd1b43cba83203

SHA256
03604055578524923b6a20af45c0fbad92fa3990f2c78b4fb81a98b837dbde69

SHA512
dcd03403ca5486e5825c72ffda68050f070ffbeb93bac0d0ddb4b3abed71b05b9723c13b8ea18188b47af56e109924def7c3fae6dbcc9ba717f85e06e7a9cf3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c6ba0065adac13cb52d901222ecf9f9

SHA1
dea73d7ba50d091f31058ab41f462e927e034fc6

SHA256
798b08ce9edfdbc40f42200423f1cb7b6c45788f4c5203505d5685d072d2cb29

SHA512
527a04d4d7b8c65f0e89a880241410cd34eb7d9e4a9d8f28d536167a799b3ce60cbcbeebe7af7f3cc848149fdf2e06043e5d4d52cb5500569c2b5a932cb5a150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb648e8f93ced48a36e2b00d07dc6862

SHA1
a42d5ae079cb8975cdea15905c16fd2caf697c50

SHA256
d7b3f0602244d926633c7eefd041abd239f11b91b93fb2c08f23834e9892bda8

SHA512
a94c658d81fa125f8e59ab1e6b96bf3173b2c7f8bb98a569523c55d4b70f6204c79f5d8ce4817168e24988b800ced41a85227224897028ba88a21839151ebbbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c6ba0065adac13cb52d901222ecf9f9

SHA1
dea73d7ba50d091f31058ab41f462e927e034fc6

SHA256
798b08ce9edfdbc40f42200423f1cb7b6c45788f4c5203505d5685d072d2cb29

SHA512
527a04d4d7b8c65f0e89a880241410cd34eb7d9e4a9d8f28d536167a799b3ce60cbcbeebe7af7f3cc848149fdf2e06043e5d4d52cb5500569c2b5a932cb5a150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bcefe559d85b03b6ac0095c740fc5f6

SHA1
f9f1aec9b00bd4bf471d9d9572051393a258e81c

SHA256
b1260baa2299c64971cacf72fd1346dbde17afd6a78fbf20661ca83b58155d77

SHA512
bb53a5b0323d02f9476ce194cb18ca537d52ea08da48700efdba670c9b9eca0c124e400ade3bd99d8652cf082de6872628f3953c8cf0fdf2e5dad5c13260a1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecae7d8efb22f72eb3263d2cc56d3417

SHA1
a184bfe2f39e73e7f670ba5e1a00f5f5052088c5

SHA256
688c0485906627d9d662978ee15188b27aa867553426c392e6b94263399a8dbc

SHA512
c4f6e4841dd5bf6637c807232b82ffa40512e02714f0afb3e3baa2340057c2cc1470a1623964959ea9d41dd40673f144248d8bd37c4fef3a135e126d032249b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9225e3b48facdf94c5a6bd2ac3dfc908

SHA1
f42aa85582485222dc47090b1d8efc8416e99f0e

SHA256
ad04674f5895336855599a47c8e0c7c6f3ffd825507094e9d4246671ae206389

SHA512
05c5e261e04a5c32d711a9c69fa5805582b99eec390f4f0aadb6f39c54317d66442ecffcffac5d6a802c39046cb361ebab322d318ab14f0a283f2ddec94d0f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d2c1dbe5d593c691d04b53804878de5

SHA1
962179a2b0f5819de79a32a4015c644a3335c13a

SHA256
a27632165e903c2c78c1b266a963bd524d6e3db307bcc88e4b0c1de0ca29b936

SHA512
e38863e223264df8197e2bb2b5044b19a3d52aa05b179f8a9156ec638f202e0eedba7c858f3d90562c676f805bceef392ea030522cbc1f35c2727dcb42977bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a76791aec92b866574226148a53b083

SHA1
ce90ef503c83effe60b64daec1d13c16558712d8

SHA256
4efc7a4e70fac217aaf33949a813121cac2401e6fad31886e21ace93d2b58166

SHA512
20ae21416e7f169e9c148041947c16a430b73cdf6036d653f1ec93cfdbe919889f8041229cbcd244dec25f7e5bd7b88350747a1ee91cf3ba44b30b224698812e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf1b91be9179e67f06c79bdcf15366c

SHA1
5b290c0e68fcce10619738fe7d843163f3af1489

SHA256
a7350a97889f91977e440c90ecde53e651e4de0d9da6bc1952210c928fc692d1

SHA512
f7dd9368776913d623b2871475b932e546508c9785242d88e4c6e2ae2f95aa4d1145c649f74c670bce3bf15c278926860f9b7bc55e51d58d9d473b15a4633845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
430B

MD5
25f4b184e83602981d4f63166eee1ea4

SHA1
c15cd8120ab4869ed5cc8e8331e0f7fc011a3d17

SHA256
0cc1ff39ebf7ae46aa45e2e350a9b335cf4b8c8abe6abb1c5f4b2dda3a6db8e5

SHA512
80704a8d53ae03f7ca21e450ad50e3e0ac7555627b9b3c827041f65f5d47ad3eef34b5bedd8f1ef6dc6d071869fad38ef64570710371ec14e9b3a80c3ff5b8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c998c29ad957f18c667bc3193f803f5b

SHA1
61a4bb93edfbd5b5e94d3cbdbbdd74d129760115

SHA256
d6f5653be6ef6699d1b7fe47680484f80b213876403bf5e4e6d1244e69caf8f9

SHA512
e749c1930725ae83addc27521928aaa936cacda6a1a32269428e83156bce2b1913ddb18013d8a37cfd9dbb7b01466b5fece5aaaff362015ec0cea10f7f4a21a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c998c29ad957f18c667bc3193f803f5b

SHA1
61a4bb93edfbd5b5e94d3cbdbbdd74d129760115

SHA256
d6f5653be6ef6699d1b7fe47680484f80b213876403bf5e4e6d1244e69caf8f9

SHA512
e749c1930725ae83addc27521928aaa936cacda6a1a32269428e83156bce2b1913ddb18013d8a37cfd9dbb7b01466b5fece5aaaff362015ec0cea10f7f4a21a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ce02c3a1c2e2258c20b1dd34b4a59138

SHA1
90b58959a14186809ae02b948820e46c5725bc13

SHA256
9a2beec3fa05d9df01bdc7e7fadf883071062497bfeae892ab0337f263813d12

SHA512
f23196fa06d28b33455db7be66cca56ea5fcd110c4344725a19a7625ade33b39df1fee7150aa977f6e6ec08c8f5fc8cbff1772b2cb4e43737b6fbf74b964358d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ce02c3a1c2e2258c20b1dd34b4a59138

SHA1
90b58959a14186809ae02b948820e46c5725bc13

SHA256
9a2beec3fa05d9df01bdc7e7fadf883071062497bfeae892ab0337f263813d12

SHA512
f23196fa06d28b33455db7be66cca56ea5fcd110c4344725a19a7625ade33b39df1fee7150aa977f6e6ec08c8f5fc8cbff1772b2cb4e43737b6fbf74b964358d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ce02c3a1c2e2258c20b1dd34b4a59138

SHA1
90b58959a14186809ae02b948820e46c5725bc13

SHA256
9a2beec3fa05d9df01bdc7e7fadf883071062497bfeae892ab0337f263813d12

SHA512
f23196fa06d28b33455db7be66cca56ea5fcd110c4344725a19a7625ade33b39df1fee7150aa977f6e6ec08c8f5fc8cbff1772b2cb4e43737b6fbf74b964358d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ce02c3a1c2e2258c20b1dd34b4a59138

SHA1
90b58959a14186809ae02b948820e46c5725bc13

SHA256
9a2beec3fa05d9df01bdc7e7fadf883071062497bfeae892ab0337f263813d12

SHA512
f23196fa06d28b33455db7be66cca56ea5fcd110c4344725a19a7625ade33b39df1fee7150aa977f6e6ec08c8f5fc8cbff1772b2cb4e43737b6fbf74b964358d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ce02c3a1c2e2258c20b1dd34b4a59138

SHA1
90b58959a14186809ae02b948820e46c5725bc13

SHA256
9a2beec3fa05d9df01bdc7e7fadf883071062497bfeae892ab0337f263813d12

SHA512
f23196fa06d28b33455db7be66cca56ea5fcd110c4344725a19a7625ade33b39df1fee7150aa977f6e6ec08c8f5fc8cbff1772b2cb4e43737b6fbf74b964358d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4af11de7-83f6-4d17-a3af-31e47d6cb243.tmp

Filesize
4KB

MD5
d9faaefa148362c020d0b817e76419dd

SHA1
9e3f7266db328dace795e5dd0b16b490f382b60f

SHA256
923d9f676cc569d3fe45444d26048a7b28b1671d99668f1f28b17bd96abd2e02

SHA512
6bc9583698d40f1277fc12f446ca682ab5f583e04c3f664051b3b9b297c17a794f57f307fb152b7872f1b4010aa4a1457a5446a629eb5a85b231d0de02c7029d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
97KB

MD5
34b97f8b9e4296af5238fc8f67586b72

SHA1
e6c4b92901c1a9d8aa6a7247143c2560a90efaba

SHA256
70c158c98bf7abf5e0bb3167edf6ed0d378f9380fabcf281cf0fe59623a0c774

SHA512
0df677459ce64c61aa109aeabcf8f91e5a19a98ddc3426818d5cb256e05abab604b2455296e83fd4687798f6f241d470af431ac9e153df95283186c28c3ab4d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
67KB

MD5
20bb196a90942c4d5346198cd82d0527

SHA1
02e240abdebd81ad528db8c22b3c3f7243c78965

SHA256
1aa70a7dbb2508ba6aada0904c7b2dd3a6277c7a847d734a0695fc3ff0cbe897

SHA512
b1295610708eebc6c4d53241e013929348c93d28f89a36c525949acd1257a1491eadc7626a9309eea2cb231f9f8bc603cece8c29393b94ae30f2720f89fb535a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b5de8aa177cc63a4c190d6aadfbe4d44

SHA1
5a8e19839cb5fb5adb875fd1b2d72052b83d397d

SHA256
dfed84733beabf53dc9e22078acf9353ab4a7fe2de668ed7701ce35a807d6ddb

SHA512
7470b906b09be0de1b8894eed210ad473a2d9fa826f3c8a50b84dc62ab4fb7eeba9ecf0e162e33c9b1a46b923a6744c181f8e4ceaf36a5f1fd3c859e6f180bae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e354a355750aee2f1f6e6d5d1b6b5fa7

SHA1
fff82ad706d19a80c57f9fd7e4857207b298ee0a

SHA256
c1b23688d5d0a13920e0af1fe20300df37be7d388aece2bc463132736ad978f0

SHA512
905b414b3c51938eae40b9dc5fe2f63a6b9a95529008d72b1edd57c2c215ba09ea37f406369a34d32c432243a9a4ce483d90334b47aa5c5c8a9e434aa74ba724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RF75561d.TMP

Filesize
4KB

MD5
4eb2ebd837e9ebcfff6e70128d70d058

SHA1
b5be0c671d135d76c8955fe16737c45b03b89362

SHA256
5150525dd69a90ed9cda7d14c3b880713a437bb1e914fa85a951efe41ec53691

SHA512
9091476d886cecf28fb0ff3b74513c59e15df7bd3bfb41ca531811ea7a051cb88b82ad4f319669e0176b5ec8a46ae0235dfcd9134456d60cdc70a920e487f56d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF721dfd.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2688015b116d2404a3fec727a96c51ec

SHA1
c263a72668a00c3d432dbbce2eff0bb85ff477de

SHA256
a483964c8ef15c51b275d08ccb77485d7d87be9e3dd03476edf32ff8bee963ea

SHA512
a6fac205c8fbb5cf39bb0b9616ecbcbe7e8c3ac691ce06493d0a5e176517ed56995d16f41081fd672668b808a263f4ce60b0ea9597b0ff60fabc61aa469e8407

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e1e454de412ba327d7d7ca423f308c75

SHA1
b3b73a44b3a1bf1093578ec806a22ea306711009

SHA256
0a7ed7d6454cccb6cd7d79342ae1bc7cd74ba139bd5fb3b9c0afb619d91a072c

SHA512
7bbf085bc63f5fc62df51640a8477b2a77608931b4e43ea1751120cbe7bba74d0811045ac1bbdd12bfe1e00c773281eb09e5bf563abf974cb0110babc73b8fbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
09f44dc65b3eac9f6e3c6971bc7b761d

SHA1
2a9c7c4f41220b98e2a46eb007bba6b1201cea06

SHA256
00f2bbcae88dc0d5047449bd6ecfd3e1a5f5da626bca8e0b6bc41fbe61aff300

SHA512
b11fa0ddc613b25a8c6ee39bc0ff7e3385b02c8dbf1523de892839d939c3327b7b9d67bc4eda790a2e21cf3768182759174ca14f663d70aa8c2fde25a6231fa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
d6007a0b6fb37e435c6f0ebadc228acb

SHA1
be2abe28229921714fe33c5d69b6185608296e41

SHA256
9a14ff6a8a5d3d6fbe7b6ec4b6459e02475210bcb0de1fe87aa9aff943ac441e

SHA512
80d542bbf6ae0d67138ae61a5c8b668da0c0a4658334a500189586c9821b1f342dbe7cee215ee6dba85775aedf2a70ae05154acea5e2b789d9e9d92d0d6f14ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
b58746f5d5658a6177989097ed4bcbd6

SHA1
67ccb217a8bcc4a8aefa4a52dfd4297a7665b51e

SHA256
d4e5395bb3ddfd882c6ed117b1c119322ba38cedef77bd7d2fa5cfcfa1107267

SHA512
b9650e981ff0ce2f9fe14a25cd0cfba3743c8e016de60a88fd0f747fee115e60b87e83ec65609ec2782dcb0f48938376dce9216cff967cbca7d5e2e4beacc0a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
357dd625949ce305d031ec24c8aab8c6

SHA1
a53bf15751338bbbbaeaac6096e011b44e2168b6

SHA256
8b3bcb36b4b83774b56ebd08d5333d5d4c00d88d181b6a381a9db2b83ebd710a

SHA512
5ab29ff1dbfd85a6968b39383938d2979ad87606169518406119371d6e3b9835f569fecba58f01a610b6ea972c60be231010a7c0dac9edcbdfbe0f78d7dfd42b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
c0519d32e5d0ec374ed80f88b32d0f73

SHA1
0132f2fa0864bf75a24a9b8c0be2d97fa9584ba5

SHA256
0d7ccde1e975c320f2a00d57743a70f787ddd102cb2b7d3636d8a3ae9e3afca0

SHA512
ef55d73fca6afe039e05fee2d9090871130ce8798cf16c2748f4657888aa7a589dc38ef26e556da4c0d023071add51a27a1223af1263e4d88c072b90706333c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
15d1b9cd7a9870d1a3d2733c3ef50eff

SHA1
d12ced4cbe3866165956815d369e38a71629c8fe

SHA256
8a2b9be87f3e3a53eb0a3ab18308a3f88e63a4119bdddd403093adb7f639ffd4

SHA512
741a7086063e533a50b89c8a3f3a0f175d9b0d5bbccb1a52a19baaee3a2078fa1ad5ccad59c65d41bdb7368ed0a21fae1ac4a38a75c97f5a6a84b8d9819a685d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
55d9b609764dac457e123a5cbaadfc26

SHA1
4586375e346eaf802365ee08b8076af008bb16a3

SHA256
05b5fc9382c71b95cb966bb6f30b761344abf278ae2778065165c5efe3dc8b99

SHA512
aff050aa23d6020b9373cbabd0052bc22fee897082270bd44b20da4eac65f6a45ecd53838aeac2b97a415ab440cf507cacdc17c1adc49e476e63c88ba4a9434f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
5752f9cbf3d593885c7f24061f98af97

SHA1
6a0873871807e7ef750f53a3935e83f737f656bf

SHA256
9da8a4337e912dc786a1353124249521eb6928daeaf0aa819b46d01b9775b549

SHA512
a570795f7c23167a503f1efdc3e0102dfa8cb120b83c32ca27d8d8b025975a6455e4a56ebe343a40fe3c869b4f70d02f1df31a9207656d929f469344ff8b8922

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
33b089489a81db44d8bfe346adce2c2b

SHA1
642d99ad6acf81d96976a12b00905401be7f973a

SHA256
94b1977441cca8a139c8992c8117396403ad7f432545457eb2a6b3a5db96ae07

SHA512
302d6442e6a2bba4cdebfb20d0938f3c7400c0ec918a374bf982ee6ea64639f2c498ad7e244b5712c97bc0fe8e116ef810403201ed42549addb465053078e9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
ed80c152be912c896145551790f2a7ff

SHA1
a1d7256493672c94823da5514d9ad2f1f8121e5a

SHA256
97401a1716eb19bdafd776fa14f0e44e81d7f88352993224d155dd0c3aaaabab

SHA512
4fa377c96fe06d38ada08a62d0bc8f737213dd496895b0f78b7a482a37cb3dc44bed5fdc44d30c32cc8c8dd618d4469453f264735a5c82d63b81c971854c93b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
9f7995033a9a5f7a45f5b3bcfcc14643

SHA1
426be41881de9d612dbfd190cc8d1d6fe6781330

SHA256
4d6184b3703cd2a8109b0747eb6b0cefcfae97b163542e5dddbaf3b2f362fcb5

SHA512
32e34829c2105aff4a19d3fde551a14b79e57e5f6b5962991c5768522a25e559a0ea373ac8fd9306f5e681517e5fc4fe8741443d29d073e2ddf44d218982513d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
201efb6414d92f235641f1bc767e4a4c

SHA1
9a666716c08cadbb9d045af8664fa69fa3c66682

SHA256
dde57b46f137091ae76ab9ed85a17825d30feb22a9050e0e497090e5a46ab71f

SHA512
9fdf36d8631a9f5d3ac07352dc390883f616c055be84b6ac9c2edd44e892db5c9839190723fb57bd0b668e5c6f262649b5bbef3e6e4c3a675572b66a263ce755

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
f89264a56e167d09e12a0fe9a9d20c96

SHA1
fec4eca0951f1ad80b72785eabbbf0a043680ed6

SHA256
c23f2e38e8e693a8c6fbd2c60c2d679bf1f4ab91ac2fc0f87c539db8af478f99

SHA512
c354a306024ca6d182e039e5af7d0c14cc0647bacaf42b8a02e7554090fdd7e691b4bd9eb0b86347fabf9837a839537415ab7a5b03386fe8342b1774c2316cb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
76259aa22a2d880b73e34d8aacff3f1b

SHA1
e1c4e8eff4d1604658a3e04b38c1a5d8a40ddc8c

SHA256
36973a77b66b5a0d7c9facb56c7160f8efab9a67ef3e35befc4b056b38f27a47

SHA512
4075ef7d4b83910c9670464c77ee733ce385f7812317e1a6db3a9e609b021a405bbde637259739605e8feeaf814e5a026513135908885563e8206294b972a1b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
8d9bc0e83583fe842af38807bc8a4fae

SHA1
6a89a37db45b669b73d2f2aacea06c32b25007c6

SHA256
1c1349dde881b49689d362610a0e065cd81634abf4692d0bf1db023e6285b60b

SHA512
05caba8c169ecd390d2bcf9f2266a2ff60fe18350390836f0a28fd191653cc4ee3ff47d828f893c6562dd731b2025d238726feef623ec11db950f31ee2f2d12a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
93c9ae0c69a1781a3b66645125f961d9

SHA1
18814bf79012cd1292356e558746fefe461ed522

SHA256
f599c54cbc64cc068127dd0bcba70dc99f97c4e12104f563dff9252c3aba2fbc

SHA512
3253c1a0fde5922f6a4f81d04870aa6942cd3798c709684307be4c0ee1d98ba7be4827ce99e48367855dbdf65311882a501bb0e5e842db6b8356ddb0962176e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
e4d7160c4aefe8ebed1c42f126660fd3

SHA1
cfe50de907e52e65a4efbd539db547299cb73519

SHA256
8a979659c1f12ebb02244f9c7114c9c8df5da298ecc5568c1970c2f21b87ef04

SHA512
cd3e139a167f2919328921b32be0087b25a57eebb1da45f490ebde993a3ff62cdf448647764c44d19afd81db936ebb0ed6e4fb98a06acfd3820b2491431492d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
dba62444b5b6e921efaec9e971792e6f

SHA1
d6c70956103c3a711f2a6cceecd43686b5cda4be

SHA256
cfa5ca90fdaa0ee311f8aaa322377a9e8612f25ab15fcbe10027c0aafc07d98b

SHA512
a28b4942f350c0fd826f96e143b4254d61702db04d2a182eeec980cdcf9c7c57795319b17899fd74318074a55d81e1c9693fe408896d205bf0ea06a221fea216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
971275fdc0879646a58a7ff36cdadee9

SHA1
42eda5251cbcfda223f4b0e4cad823d410227620

SHA256
d3b99ba6417c5aac227bbac0ba65c55d61d409acf66124d39375f6693cd1d04f

SHA512
0789af3e8bac7a78bb0e35a5d22b65612865526f1ce9f657fb121838884ec95a3fa692949b3b33712da5904f6048d2431a2c6f3e3ea4599158dcbda840147ea1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
2f4c39d27cd517d208b85906cc3fbf65

SHA1
c52dcc9665d05cafd72b65ab23e1183dd91fd613

SHA256
daca507dfba73539f01754ecb00ff173b539734b415a89d9afe9b4077312c610

SHA512
dbcd7e85bdba64a72c96c9cd670b43d970b87801b486f2d5ad4ae3f5039ee0e0ede2eddd251bf3079ad177d15c73c90b23179371030f8070af41b00a53dbf997

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ee7f9c8fde4a3d439f32af6893c49978

SHA1
abbab3f3bd467eb5a0d02a52ecc04e80d979dd68

SHA256
da4d4cb8425a79cd560795e27f925efb7865093e7195683af1565d76978b82fe

SHA512
caa8cf75021fd3222d82b495b5194c16b84f5db584c4c40f47217901ceb46a22f3a031b8e51b31f9d096172a721e19929dec37346f99dc0b62f36f859bc94e5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
84c148ae33860fb74f503b6e96babb0b

SHA1
881c018433805c77b04fbd0e0a2a6c6d32239737

SHA256
9411f2967de08af0df0894cf07a0d6963c70740a3fa66bdfb70cd2f19ec3b2a3

SHA512
59a344c4e276a6f999ca45018d8056db4cc47d75b8bda39455f3880af1ffce9e3848bd6c4bf1447d191b8b86fb6541b3fc6e554c71c1445a510de042bf2c7bf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e16120fddd9f38c78836f0782e1ad389

SHA1
9dd1aee6365254bb29ae5facc2db213a90053f4d

SHA256
43de6565e92b939b2ce0aa377d3e318b390e6e2a6eb4b92ea54cf796b95e53d4

SHA512
cb5962698e5fa1af5597aa0eb6e98a682adb19f1a27daae50ba869a3942dcc44ea0400dc0f001f0be2f4d112bcd7efd5f33622b284304f77e2a4063b241c02da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
6ec1823f8a7bad8dabccdd8feb808b4d

SHA1
ea923f7b3b014a52bde2f37c4c3c02a14f1c0e15

SHA256
01ce8a33d865121f4c8f0351d4c1bf7d0a586d5d9d0d2caa5d8fed23d067db0f

SHA512
d8fa6c589da67e26c40476c21e2e5c293bd46a154978de0f37dd1b906b9be61414f180e2a63fd2e50894f2e3ef6d42f2991cc19e37ebc3f2f5d4db19a3b75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
8b7933b598adcc2d88fe684b43ed87bd

SHA1
c48f53f86c54af033dbf17ec170e4ea73857591d

SHA256
c6d8d2067e51e99345f01803a2542c8b3989b09e5b0ebd698a0ad055a120d005

SHA512
584018a7b2f747b59811c723a27f3afc9b5c79c20db087e5f9a0722717109f442598eedf677dfd5c896cf4e26146d80694977ff9b9c1a84a4d3d2d2b917a65ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
cf85dcb365cd63f7bf4bcbc0e99ad12a

SHA1
567067cfdbee14c2f346a69503f5c69c9fbc5c75

SHA256
5e17ea9670ef1716039f394727fb2f5807cc52dfc93d9f1d2a6b8f0db127e394

SHA512
66da955b698939c4de2d1d0246e23cadca73c7d722680b606cf6952723729acfc7e125660f4855b290d6133667eca1201eebda58d4cc98fa4bb3bec19387bba2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
a43a1382ba981debd993c6f120b65b9b

SHA1
adb6b9ab9d288ea1042d844081f3f043c83ab8bd

SHA256
6b32d0281b37e836a0677ce4ac5fbcfe26d0ea88f5dc4fb8f5dc2a45e3fa079b

SHA512
c697e26657a10a4c18c4f4d7b6cb2c56f35ed835e7e08f0488c46997c915170a3f6824155eea3e8733fd2fc422ef363a0d135cd6963c8ab82234438334b17c10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
543ba51c4e0d68e9450c7af6a50a91ac

SHA1
bbc9d33d527ac051181ece761800ff4ae4fc49f6

SHA256
eb1ac9ac173cadd004666a6615088ecf4bb8c4957e25d17476add5261d75c1fe

SHA512
3083a6fe68143f66f8d4200c0ca14f2b11bd7b0431ed6150dd948e21ce0f546d246fba8b043536d0e3f86c4b9bd5576425590761d58cba22cca19597c3dedc0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
f60b61bae864f08c1ad23bcf4d67655d

SHA1
d8c8bb0bb32f73d4699dc07f13eca6a4fbd34763

SHA256
5cbca2a857271912a801c4d2a05d3c5ab433e44935afa7065053ea679237d13e

SHA512
c2ffe5b9a689f41f7068854fb6e774a5cdcacf976eba77b73e25074250f21279d2d03142fa12fa998c0b57060bb509c8120a40c57e26f38243607183912608e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
327ccf3e76354bd95a55bd9f62b5712d

SHA1
a601cdc444d2c216019f6bb6bdd33f22d80ffe07

SHA256
6042f73a30ce953e8cf5965d7f7db9d180d9380efc9cbebd73d74688d2473472

SHA512
b6b74040d4d969c30071baa3eb8b1ce5b1ae51de38f8ef482fac18b36dd15cf7daee528008b03ac4d19ec441deaa0d9af3dca992f11790c82446479f495a014a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
71eb09372424d2c70f06d9025687ee25

SHA1
7fe3d27939ffb9722d04b6f8003b878ca23167b7

SHA256
13a801a56fd46914eed0efb74e6a115aed9b0b7d8f2e10e115de24650aa84528

SHA512
8d12fd69bf1f46a0468ec73e1d4b96d9a8b83789cb814339f33e14909d40bf8206af808cc2a051788418477f15f0a861b9a1b2a07dbd7790d61fe8c700b18c3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
30432198df66a22a41062ffcbc5b4867

SHA1
715b57d905496098be567b051d60ab14c4dad383

SHA256
6ae9ff86f621aa4ac2bc22884b1576ba001a5c563273c4b4d56873b51399e69f

SHA512
e6d12bbda1db7ea0665c89e6c396d69caeba55f4db0dcea48f19090715edd1a3a178c02fab588f932addccf30f433d89bd97f514adccbdc9c175be8990dc1550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
c56608c57f6c7360b1fee7bb49288415

SHA1
e2b7d5f65dc9600780b551a241d040520d6bc3b5

SHA256
2b74fbc926c8a5efbcbafa871f0a600bc61e7aa0764b3f73d77231cfcb33d510

SHA512
e2c4e3528100828517f4aae8f08166acdb830170e48f1165e9dd1e0221b31d361b34d8f3737506882b63443e958f13df32dec0f2e2a622458fe8bb8152a6609b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
bd58e5701af09edb67bfd613510e3389

SHA1
c58751a59391bec49916942287447644aa6e1db7

SHA256
f201546e1445a8c967cabf9734664c504d8015974291718415149fa2cd24dcc8

SHA512
86d12dad7d1c59284495a69955c45f63f04b3f542653f998fdccf89619fff9b23c6d57219d4dce66948deca00b3067ebb93eddd25edf4cfa60309b828c676f87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
be98a6ac67c53b143103625aa275a310

SHA1
92f3a44f384344e28ed1c2dc1cd45cce3c9842e0

SHA256
8414aab973b1a0f1b58546d3fc8669ff5613bbfc8573631e58cc0496c3bacc15

SHA512
e45244cece448253b8186fcfa1ac17cd476201666123dc42d135a0d3aff36c53d0a0f51e3e7eeac6b6c111b239894ddb823b4a68f60329263e8af8fcd2de6eed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
c30a123f9cb4549afdbcf3f521ca85e6

SHA1
bef250fa8c4545cebf1b298465b3427e429301d4

SHA256
f53383a4b15c48f3e774065e0fefa925673e284b87214cdd2bb1624aabd277d5

SHA512
a4a9cb78e184c9f598692f03bce4cb2de0dbbd2d89f75b6e8e4dd50f95886ec3514a6e6f7c5c673aff19815d64993df828fb4d3e60a79ee1977dbe94919ab148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
d8169e89a67c759125a168b514f26ee7

SHA1
4705f5d7e39d5a0b365ddac73084401c719e17b1

SHA256
8cffe5c3348071831be431cc1ee333a8a4bad2da201ea79f76c6234f41086076

SHA512
81cd747591d16d67bdcf48b224c734469edd6baa1ae4149f80d6871df9b1287dcf9eb1b8313962ce6d14d70ded5d425e033f4fe256062b65dddb960a3e0de753

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
5de628dfa6db323f9a5c8182d59f48ea

SHA1
71f8eb5a5461148fdf2a25839abeca7eb277ef82

SHA256
148b95f343d742d6b489749afcdea948204d24a70e497bfc320e06f35c332018

SHA512
3cfdb9f1f751499b247ad2a13cb7bf3995ac0167ffc3621262ca2cf4c45bb50f280aca17923d395fca85d6feeaf69547f344aca43d053038a8c45a883a503824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
df0d0746ae01c7a79675ee03fa24b6d5

SHA1
c14644b295be988c8d64dc0369d547c4e012cd0f

SHA256
25db574d1d799ccb4e4b57b1e9b9a8e238352163ab428ab014c9f2d94be9f6c3

SHA512
eee54bf0c0abdda7b3f2cbfc0134be1b9e712217dd836775f912ef530cf91776508414121870de73543768c5b308d99c56a1c5d24748c03725d7086a82a6e331

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
07b9291b7b2f0b04cd91512e7ffd0c86

SHA1
403d70760c2616f8350f1d0d7997645b87f753fb

SHA256
881b5c29769daefa8be346e9e4df44b645d4a294c248d019d47f089a46ed580d

SHA512
6f9d76ba743725481a5209b27595e7a543920933ea1d19be06ea5f0b159ecbdaf0d840b99c2626ff6b5245990a25caac30ca2bae000fcd3dca336eaa72244d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8f3057c9fe0071bd4a2230f9e6609229

SHA1
73429832551afe6ed52a4357b9795fa4ea484240

SHA256
b19e78e34e02451557f15e1c2a87048005187e4867c9f37f5844d1aa658077e0

SHA512
8576ec8b13bb34c9af5a4ee39e69e7cffc2e1e1f4c9bae7728f2e9b1351de4806ea766111dda3212264ee859b9606e088304f7820003d10594a8b33172fe7070

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
19a3a70178b58dc6d6a39e6b6bd8c610

SHA1
2fda67e4874a41ffe0919fede85b78c7accf8bfb

SHA256
44ef48c033c31a963bf345354d6e75a3b07500d6d9c29194679a59aea9913c15

SHA512
04c9a28ffab0b57c34d886f0ad8781fa0679cf11779c8782d337c0818863d06261c0190a04db863dbbb67ec18b1aaf713ed2d21dffa3a05b82711fbf84414219

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
59d55af0fa48ca1f3705da879165a508

SHA1
f2e0c313ed3cb27af692f8abf710459f60fe8295

SHA256
d5bbc19a4b99c151839900058e20b528ed261e7f20c6474eb75f9d7a5bc6fcd1

SHA512
3a05e87b5b80a62b60428cc0c530576076d9f606a86b001c4da34fca2761b4417931499c3ddd832d600e9b7859f62dbf05ef01728e9a5b6016fe8eee5c657439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
99d7120eb1ebceff5c79410d4cf2e19a

SHA1
bc4ae01ea482936540201bbf95a56cd08325c7bd

SHA256
d21c48cabaf8fc4d5c8811f591a4348b54deaa521c47a560f3002a55c3493ea6

SHA512
f73816c882481211cc9764bd087a1c3f2e05e7a107cb836f723942d36565a10e548d29ff4e83c2c481b1f26b098a59861e06363907390cab4956563cd4827a59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
527B

MD5
a20def205e52ada5d0bc4b016a838052

SHA1
8c1149026c078b6df4506e89532b59c325b1f656

SHA256
f945dc00ae2e2d2772b50b07fa052ed00581fbf12e3b931745acfee2045dbcfa

SHA512
b8d58113f4defc139034732a0e70480b119fca0670d99788644f26ca6aac27cfff21a1821e9b0ca267a7ee50819d7fa3ab41636ffe94c14a4b7fc94174836d05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
07f3fd4108dade0c0f3719a7bd4986cf

SHA1
43e55d75ced679bf9024ef57bfe6d8bb37f178d5

SHA256
9e95e4a02bcc46931122366190a7076c46f0c18eaaf584a6930b8d5dac8b3c9e

SHA512
b10bf0d4414784ffa5e746e9af2cd1770348f68e70b3f440946e9c2293349b9b1757e63e9c6d51b16e1653d112fe82cf8e5c7fb33c54642cb1ef7c3a4a303a23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
04d2a3cb7f6b2b0d24c1e4d36a8ed851

SHA1
1cef9e48528a12717336a1dea760d7d5416050bb

SHA256
8b872d0758193573b96dc47e6172a35bedee3229272459ed4246b0fa05952174

SHA512
ae7efafe0e59768c6e80cdb340d994c3603d3ec4578ffda6cd4113a5ed6ddc13d75dfbbdcda7fb430a65d222a6d851a2ddc04ad1a9b77bcb06d9b20cf9bfa435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d0ea99d01d2e294241f53f420aa7f95b

SHA1
de469504e7b191c625add3cde423ebef3f1d7873

SHA256
7350489387cba44ece146fedfde87853684bf82a9abdf8f0c66102d693d692aa

SHA512
4611ea606043d14c8c1f48a7799e813cc922bee8b2545ec41c84c46e49b57c478dae049c0e86b5a9ffa2e2da6c01a423722583eb336770df3daa892dc461bcfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d2887a34-f2d6-4368-a959-a81e53386de2.tmp

Filesize
6KB

MD5
bebd75522f3c88febc4cf945be7b6d4b

SHA1
28fbb54f36185276e725b8b81947f66ecfa34bd9

SHA256
469bc9e5ca4dec59858d303a5e63d258fce2e2318b7b3ce34d029c40255b9564

SHA512
0d8db8c1544349bb689fa66c3e03522d27c7080c0efd242c8c05c6269eeb5b97c196e8bc091d52e17f532896c09dcef8aab6996c933099b56b6c5a92cf94ade0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
eab55b58e2adca4251040de67c107e3d

SHA1
acfa3684e044ac2763ccbf3ff3be4cfdc2261ca4

SHA256
cc61cea73929e3bfab7628c567d2375726b675aefa77d4ada9e9558cd241a0dd

SHA512
f9391218997fbdacd05a7d636ecc973a8911a91b578cffa75af9bbbabc477a2d5bfb4de593af0cf553e007cc312a97866089c64590a4cca9a9fb6ccaee10aef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9f46328dc2aa24bffb88260b11bd2a09

SHA1
29d0933bc38cec10985ec29319b8a190cfc5e5d5

SHA256
0c3ae31280a7b35e92afa070bd19bb9f8ef3f67b8a332bc9fe70328a959b1273

SHA512
7b8462ae678ef27058201e6016204922b1b82e7742ec9c300557335da5554b7c2a159b15ee16b5a3b3db4e1eeed0c6965da91b513cffe412a5b141d3ce30524f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
daf8a74494f0285acbb75ce4c362f461

SHA1
ec4b54cbd7f30f98903952c3aa135aebc1a73276

SHA256
84e738a00e23fbd47a7480c5c1cde02c12d78d7d631cdf0a91f54e5c5ed0e58f

SHA512
16cb9b135ea1754bf1f41c606bcb114e31e7793c9af9cb500b38ae0fa9a3cad76d8397850997e09a3e5574d3903f3a4150e0771bb4ef2d53ecd7e92828ba0062

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
00e8346ad6a7d8e1a39205e97cdddc1d

SHA1
6cc9592a9fa5c95ac954636e178c56d0eb6451ee

SHA256
90f61ac101aa345d94c065e92fa72f4881eecee97008ac1ccc295ed5840b17e1

SHA512
8c4847b9b3e58c2587d2cb996173debc240b31666c7370f4f019cf3fb61acb5c456d10a4aa06ff0adde0bc36159f9378822937bff0be947a156a76c265572aee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
90da7a16b5450040fe9d220030e7ae61

SHA1
b9d3d73949f1d985b6d038818f492e22db492c50

SHA256
4440b965ec187dfbcfdf63dab7ceb9e0698d37c94291ed38a21443f0e817280f

SHA512
05f6101effc66cdc07d0367d217cef75b489d9a83224801757e0b14d03e2de324c8124d4a868e83db92a640816601cd48bcc8656fbaf462393db98aab8f9d5a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
c871edc2dda7c3bf7670755ef29e48b0

SHA1
352efe93152467d4f4e55c6956f0cfece715a46e

SHA256
b416478250686d2238a300cfba3d2a0b93fff09fa4901c4744041586e87c9009

SHA512
fe13e6eeee85031e7a6114c61237701591b21bf107e53fdc6791f8ddedbcb576334355099e77ea4e88b16df046d97de02d1863a8d2d94de3f3b56c71be7b95d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF74c949.TMP

Filesize
5KB

MD5
c881ec175637f6e0f0aa3c5990f086cf

SHA1
ed9296299494366b35fd4760a7ec864167ab5777

SHA256
495f9452322381d2f38837237487c1cf66881d7303058923bdecf91fd5467e7c

SHA512
368072642b98e6815aa0d1f6b39e65a98682b3d78e5986152fb609b28ca35980f54e2cd69d840a4112a49fb0c2376fbcbe21f8c259bdc06f90d81c000fba36ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
687a7f46ab79a5a69454c1e8766a853f

SHA1
fee80ca2c54f4deaf03459644d0384c61116d376

SHA256
37292a56489e48cfa953d7fce13d9f0b37b5afe1cd983ca68ce2182cab4a86f7

SHA512
7c4535a4da04e656f8bfc02fe34ad2ab4a32a7d7d6739bbdbd9903ae41a3bdb585e0a6525eb9b0ba2066bc1f0daff968c91e2253ad5c4e66fa429d8a7a7f644e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
687a7f46ab79a5a69454c1e8766a853f

SHA1
fee80ca2c54f4deaf03459644d0384c61116d376

SHA256
37292a56489e48cfa953d7fce13d9f0b37b5afe1cd983ca68ce2182cab4a86f7

SHA512
7c4535a4da04e656f8bfc02fe34ad2ab4a32a7d7d6739bbdbd9903ae41a3bdb585e0a6525eb9b0ba2066bc1f0daff968c91e2253ad5c4e66fa429d8a7a7f644e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
75KB

MD5
4e0c11d35ec83583a779388fc51884f3

SHA1
edb06d0ea5722e3966ad728934e6e9fc95b70834

SHA256
1ccc336060ec653ffa822c445921d23e1e08056891c8eaf4ca8ce618d0230458

SHA512
40eb17e6d9367802a7c4751690c617b658a1d34630538577d50bfbb877b2d805c74107f1fb715b4ecf2e5807038bbf8f7181789b8ab2f98ded1499de8c0b4d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
81KB

MD5
20999c4b50a016ff99ca54071fdf6cb2

SHA1
627282e97e791c9f6e80124071536b39fc1d57b9

SHA256
ca0239d04c7faf97324a77d724ba34b1e809b36078b2fa35dfc039a113b07141

SHA512
cedd7ebe6d4de05876061cb2818d8e23d1a33fbbd30ab3d0e7e7b0c7128ee50f47d39f657a47d278485a0138f94cd00db4163488ae4480aaefb0dbbc9ce7c0d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BYN4WSI\PCClientBootstrapper[1].json

Filesize
3KB

MD5
ba883c9d3498a873472e840547ee330d

SHA1
bb0e2fb10ae4cbf8f7bd1069b476b0bf59a35597

SHA256
a37dc81c1ee2d44d2d35c2a4fdf2121b7ac54ad8acd73bf864ffb005bd492294

SHA512
0aa439f1da015805418c12dca77005ff896e3c34a8a9dbca372648152e8691092f6f0f05fa3ba6a280002caa779630d49b5d612648c3cd58a24a28f5991d1473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EV74ZOZO\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R2EIRHNV\BatchIncrement[2].json

Filesize
163B

MD5
bedbf7d7d69748886e9b48f45c75fbbe

SHA1
aa0789d89bfbd44ca1bffe83851af95b6afb012c

SHA256
b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

SHA512
7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6950.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BC9.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF31BCD44AADA4962C.TMP

Filesize
16KB

MD5
ffcd4d55875f825fcd973cf98f3b8e34

SHA1
9786cf00e73d0b2b1f25b611e504eeb75b60f9c3

SHA256
91a76a1bcbfc5750cd2ff2f888d3cb63055768b2cb734cbedb2977e1492822f0

SHA512
368d709b960fe24dadfb114073b4b1e9099bb1f9824214785ac9b637bd3d46b4d998ca5034671c7d342692143aa5836f70f5aaaeb266386060fe2b0a78b21037

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WJY0B3AT.txt

Filesize
603B

MD5
c539312923e0eb30166a7226a4f7b7ef

SHA1
77f5e1cb4b069a55ba36025e9f72cabae516c9d3

SHA256
391ecbfc8299b38a6e822039341a00a9994e05f77e744078503cc4a7babb5ba9

SHA512
9f33043789f04ab9f68fb9ad6977ee9946c92a6a7d849a2d784af3d8af9313b5e563af039bbd10ddfb151e0e60dc2e1e23b300133dcd69738fb198673c9abb1a

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153a4a7790bb16c4c2dbdcca7fe958d2

SHA1
77e52b2170a0f55b14736990f3c149727fb30557

SHA256
e06445689afbd0c4596f4b45ed8c20ce78836d67bc50b8ccc58f469f01dc29fc

SHA512
1c2be25037769ab1fe651556efb57de966fdf12b918466b54ab78c113c1895a65d2da266055265404cf31a48834315a00bf5321c63270e4d2181ce3faf7aa0e6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcf1f9c41e47f87afed998a21fa6595

SHA1
c4140924e8b8c654a941ab2e4f1ec716527e3ccc

SHA256
aec3c6a1b8e9421fc89be2b72f44e757e16f9603322d3bd144d7158b464f6ba8

SHA512
01181f2f237045a75565f291803ea2d2ce70fa5101d04c3fc2b5d253aa270780c40fa106250234b24afc34ca7bc9b4ffe5726127b5b571f9643259824f5500c8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f2bc69b9149e574cd11c318003c2f9

SHA1
df1e5e5f387a9ddcc00db6dcbc07015014bf9b97

SHA256
ca3fde49cae5dc9e0e40e62f9a176b11243e9c7820a7a9bf98546aedf50d980e

SHA512
f9b8c16c725e02bff1e9a9c2ca8a99565ae09b38c29022d9585adbbda55c0e8fa94c4924f07e7a954f08ff4c785a4598b7aa74a92b60c80b847e269bf5642a94

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088a4b499f228eaa3b2000e4ac203b01

SHA1
a0fc6cf10ec3674e24cafbf78193612f1e9ba897

SHA256
3891a14586fbe17331c4e2ecf610c25f3568b889fb23ccedb191e1fd4e89a3b3

SHA512
4de4f080d6b3a72cde7e1e6fffac25e9ccb1b8576d836b5c93e234acc77704dad57d67e8b9765cc206c9ec694ed73138604e58a7bda7b1afce0d96a55dcb26e7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3ddabe50db5f748e86ec37dcf7a313

SHA1
42506a97a003d0bad4d939a17d50ad205aae1ef2

SHA256
6e736feba2e9a062240e2cbc733650505b8912dfa815f9b6c73bdfc321b99355

SHA512
cc8f4f8de8b893600f4078aafd72f5bfd2c5361f6cd31d51bb3ba46ab461b019e445c9e8b3af1383bfbe1c1baa049e785cce9d655e6a6eedc5079da8f60b3657

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2f43bc630cabf42fc135e199740660b4

SHA1
27b1987071d450a3ae82db719b420d0beaa8dbb8

SHA256
5dac51342aef9e579ec4c383ec9115e05c1018e38b2718369ec2c2a989fbc7d0

SHA512
0f26d47c4992201f7452b5d954e1bef360b561ee800b43c151e1d4d4bc31741f9e0808ab601d32092c8d560ec9ee71f3d37b38bb042f8dd0e303eb46e678367f

Download Submit
\Program Files (x86)\Microsoft\Temp\EU3583.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
\Program Files (x86)\Microsoft\Temp\EU3583.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
95b5b81915323f8b91ad2cf6161c71f0

SHA1
424e60bd550fc3736fcdc7e19ea3b49dfaa261ac

SHA256
a114e6f865e407b6296ac00acd3b1e1e79953f589078eb6acdebdf1b763543e2

SHA512
2a3e60c77d18717d418f67d47063aadab35a65ad75d9bc8852830a1f36f499bea3e27bb0701bd61517b24a2d9d21e97aae28ed552869af51545cb865d6a76479

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
95b5b81915323f8b91ad2cf6161c71f0

SHA1
424e60bd550fc3736fcdc7e19ea3b49dfaa261ac

SHA256
a114e6f865e407b6296ac00acd3b1e1e79953f589078eb6acdebdf1b763543e2

SHA512
2a3e60c77d18717d418f67d47063aadab35a65ad75d9bc8852830a1f36f499bea3e27bb0701bd61517b24a2d9d21e97aae28ed552869af51545cb865d6a76479

Download Submit
\Program Files (x86)\Roblox\Versions\version-dc61c2db7d694b7b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
42fcd3d0e49864500ac6073e7b707de6

SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71

SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493

SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0

Download Submit
memory/2520-2387-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download