hxxp://google[.]com

Analysis

max time kernel
1800s
max time network
1797s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Executes dropped EXE 23 IoCs

pid	Process
480	RobloxPlayerInstaller.exe
4120	MicrosoftEdgeWebview2Setup.exe
1180	MicrosoftEdgeUpdate.exe
3680	MicrosoftEdgeUpdate.exe
2728	MicrosoftEdgeUpdate.exe
4648	MicrosoftEdgeUpdateComRegisterShell64.exe
4484	MicrosoftEdgeUpdateComRegisterShell64.exe
4716	MicrosoftEdgeUpdateComRegisterShell64.exe
2176	MicrosoftEdgeUpdate.exe
964	MicrosoftEdgeUpdate.exe
1232	MicrosoftEdgeUpdate.exe
3960	MicrosoftEdgeUpdate.exe
3308	MicrosoftEdge_X64_124.0.2478.51.exe
880	setup.exe
2908	setup.exe
432	MicrosoftEdgeUpdate.exe
2784	RobloxPlayerBeta.exe
3456	RobloxPlayerInstaller.exe
3372	RobloxPlayerBeta.exe
1900	RobloxPlayerInstaller.exe
4244	RobloxPlayerBeta.exe
248	MicrosoftEdgeUpdate.exe
2596	MicrosoftEdgeUpdate.exe

Loads dropped DLL 23 IoCs

pid	Process
1180	MicrosoftEdgeUpdate.exe
3680	MicrosoftEdgeUpdate.exe
2728	MicrosoftEdgeUpdate.exe
4648	MicrosoftEdgeUpdateComRegisterShell64.exe
2728	MicrosoftEdgeUpdate.exe
4484	MicrosoftEdgeUpdateComRegisterShell64.exe
2728	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdateComRegisterShell64.exe
2728	MicrosoftEdgeUpdate.exe
2176	MicrosoftEdgeUpdate.exe
964	MicrosoftEdgeUpdate.exe
1232	MicrosoftEdgeUpdate.exe
1232	MicrosoftEdgeUpdate.exe
964	MicrosoftEdgeUpdate.exe
3960	MicrosoftEdgeUpdate.exe
432	MicrosoftEdgeUpdate.exe
2784	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
248	MicrosoftEdgeUpdate.exe
2596	MicrosoftEdgeUpdate.exe
2596	MicrosoftEdgeUpdate.exe
248	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
2784	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 57 IoCs

pid	Process
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\DesignSystem\Thumbstick1Horizontal.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\fonts\RobotoMono-Regular.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\XboxController\ButtonRS.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Settings\Slider\More.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\DevConsole\Search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\MaterialManager\Gradient_DT.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\Tabs\MyCreations.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AvatarImporter\icon_AvatarImporter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\textures\brick\diffuse.dds	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\TixIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\CompositorDebugger\sequence.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\GameSettings\ModeratedAsset.jpg	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\CollisionGroupsEditor\ToolbarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\msedge_200_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\graphic\player.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\PlayStationController\ButtonCircle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ViewSelector\right_hover_zh_cn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\DeveloperFramework\AssetPreview\close_button.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\noise.dds	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\graphic\gr-gamealbum-icon-52x52.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\category\ic-top rated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VR\circleWhite.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\DeveloperFramework\checkbox_indeterminate_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\avatar\unification\AdapterReference.rbxm	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\MaterialGenerator\Materials\Foil.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\MaterialManager\Favorites.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\AssetConfig\marketplace.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\DeveloperFramework\icon_backward.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\GameSettings\RadioButton.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\MicDark\Unmuted60.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\PlayStationController\ButtonL3.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\SpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\CollisionGroupsEditor\delete.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_1x_7.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\LegacyRbxGui\popup_greenCheckCircle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\particles\explosion01_implosion_color.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\TouchTapIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\XboxController\ButtonRB.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Settings\Slider\Left.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\WindControl\ArrowDown.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\UnAnchorCursor.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\AssetPreview\OnSale.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\MenuBar\icon_menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\icon_intern-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Chat\ToggleChat.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\img_dark_scrubberhead.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580148294432932"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4748	chrome.exe
4748	chrome.exe
920	chrome.exe
920	chrome.exe
4516	chrome.exe
4516	chrome.exe
480	RobloxPlayerInstaller.exe
480	RobloxPlayerInstaller.exe
1180	MicrosoftEdgeUpdate.exe
1180	MicrosoftEdgeUpdate.exe
1180	MicrosoftEdgeUpdate.exe
1180	MicrosoftEdgeUpdate.exe
1180	MicrosoftEdgeUpdate.exe
1180	MicrosoftEdgeUpdate.exe
2784	RobloxPlayerBeta.exe
2784	RobloxPlayerBeta.exe
3456	RobloxPlayerInstaller.exe
3456	RobloxPlayerInstaller.exe
3372	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
1900	RobloxPlayerInstaller.exe
1900	RobloxPlayerInstaller.exe
4244	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe
248	MicrosoftEdgeUpdate.exe
248	MicrosoftEdgeUpdate.exe
248	MicrosoftEdgeUpdate.exe
248	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	4748	chrome.exe
Token: SeCreatePagefilePrivilege	4748	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeCreatePagefilePrivilege	920	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	MiniSearchHost.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
2784	RobloxPlayerBeta.exe
3372	RobloxPlayerBeta.exe
4244	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2820	4748	chrome.exe	81
PID 4748 wrote to memory of 2820	4748	chrome.exe	81
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 1148	4748	chrome.exe	82
PID 4748 wrote to memory of 3548	4748	chrome.exe	83
PID 4748 wrote to memory of 3548	4748	chrome.exe	83
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84
PID 4748 wrote to memory of 2908	4748	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2660ab58,0x7fff2660ab68,0x7fff2660ab78
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:1
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3440 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1856,i,2538454339434748367,2920480220390568916,131072 /prefetch:8
  2⤵
  PID:4720

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4860

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2660ab58,0x7fff2660ab68,0x7fff2660ab78
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3880 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4328 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4568 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2192 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1180 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4884 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4032 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5828 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5652 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3212 --field-trial-handle=1920,i,253221691589448605,7692554036054960044,131072 /prefetch:1
  2⤵
  PID:1884

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4484

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:480
- C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
  MicrosoftEdgeWebview2Setup.exe /silent /install
  2⤵
  - Executes dropped EXE
  PID:4120
- - C:\Program Files (x86)\Microsoft\Temp\EU3C7C.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU3C7C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1180
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3680
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2728
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4716
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEEyQUE1QTEtMDFDMC00NzE0LUIzNDEtM0I3NzFGODExNzRBfSIgdXNlcmlkPSJ7RDVERkMxRDctNEYxRC00NkNBLUE3OUItRjFFMUIxMzdEMENDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyOTMzQ0IyMy1BMTQ1LTRDMTktQjk5OS0zNjAwRTYzQjg1Qjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwOTYwNjg3MDgwIiBpbnN0YWxsX3RpbWVfbXM9IjU4NyIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:2176
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0A2AA5A1-01C0-4714-B341-3B771F81174A}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:964
- C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe" -app -isInstallerLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2784

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:1232
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEEyQUE1QTEtMDFDMC00NzE0LUIzNDEtM0I3NzFGODExNzRBfSIgdXNlcmlkPSJ7RDVERkMxRDctNEYxRC00NkNBLUE3OUItRjFFMUIxMzdEMENDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1NDM2RkNDMC03MUI5LTQyMjAtOEU2QS1GRTkzNjA3OTFBOTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwOTY1MzQ2NzA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:3960
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\MicrosoftEdge_X64_124.0.2478.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\EDGEMITMP_9EEE9.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\EDGEMITMP_9EEE9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:880
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\EDGEMITMP_9EEE9.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\EDGEMITMP_9EEE9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{58C1FAB0-391D-4480-AFA3-FBEC2815F39F}\EDGEMITMP_9EEE9.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6b2be78c0,0x7ff6b2be78cc,0x7ff6b2be78d8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2908
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEEyQUE1QTEtMDFDMC00NzE0LUIzNDEtM0I3NzFGODExNzRBfSIgdXNlcmlkPSJ7RDVERkMxRDctNEYxRC00NkNBLUE3OUItRjFFMUIxMzdEMENDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MTY3RUNDNi1CN0VELTQ1Q0ItODgxNS0xRUQ0QUUxOTMxNUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjQuMC4yNDc4LjUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDk3NTE0Njg1OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwOTc1MjA2OTY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEyMDkzMzY3OTgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2VkZmI2NTFmLWE2NmQtNGQ0My1hNTNlLTM3Yzc4ZWVhOWExNj9QMT0xNzE0MTQ2NjY1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVJKbzhSR3FPSjY2V0RSandmeVNZUXhrMHhwTSUyYlRrN1BURGJOcWswd01ISzUlMmJCVU1nQkszSlYlMmYzOEdyTDl5VHc1Tndvb1ZqVXZPWCUyZkRGbjdMRTl6Z1ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2ODI4MDgiIHRvdGFsPSIxNzI2ODI4MDgiIGRvd25sb2FkX3RpbWVfbXM9IjE2ODQ3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEyMDk0OTY4NDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTIyNDAxNjc5MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE3MDIxMDcwNDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MTIiIGRvd25sb2FkX3RpbWVfbXM9IjIzNDE1IiBkb3dubG9hZGVkPSIxNzI2ODI4MDgiIHRvdGFsPSIxNzI2ODI4MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ3ODA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:432

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3456
- C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe" -app -isInstallerLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3372

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:1900
- C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe" -app -isInstallerLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4244

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:248

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Installer\setup.exe

Filesize
6.8MB

MD5
26ef24e23b9ae5aaaa204a4b6901a6c9

SHA1
d852dce2672850096d43ed7a9e30ca72f44eaf73

SHA256
073aec6b50085f135e8e9903806cf817950cb09b686e106d7cf9edbe6296b8d3

SHA512
a538ea6a04be7928e9533149b681d7371c6ad7274ff87207b3004ee4a436d64c5b96668e3bc91b30227dff8d5a2b30b81c50af7db99a413077f18c008d021822

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.51\MicrosoftEdge_X64_124.0.2478.51.exe

Filesize
164.7MB

MD5
8f229750e00f388f5de3e974c351efa4

SHA1
568c2bca689fbf870a965cb4867a76a2f5549fdd

SHA256
92f8f1114c969dde4b8819de90c6b0662e9183c733e1378a64375fe4051382a4

SHA512
09d00746c57f3928eecee36db144385b0013e307289a007a0983388ec3a45364edfbe4ded94f39d8c083a2c27d8ffbfe608e822441dfbf728cad880629a0407b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.2MB

MD5
9a5054a082e2d341025a7cfab14be01e

SHA1
6f880fa9008dfbd65ceed2022744b94d9c42231f

SHA256
324961104eeb40c40e6bd00278affe755c82d77189606280fffd37852db54c3f

SHA512
cf24a5a3b79894b93b041b2b5e71f494cbdff4cc524267b81b46c86ca5b001e3bc9a57b724f46d0bdd3ecb0fb3ccf0168db978e5928422df7023f736548c15b7

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
eeadaba8d348f117ef628576952cb22d

SHA1
2cf6d56cef5f4959c85f5ef14159a2c561cd2626

SHA256
5ee29531f0ee75d23c86d4d286532ce6e7ed1469470b32c2cc74bf98104c8276

SHA512
afc4af454e4e5f4359238e215506e09a48d455a08f52c55297eca47ee452052780310689c5b3e3f1ad59c10944306adab829a51742ea8830ad837ec62a4e0b30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
bea0f0ab70bd35ec776893b6dfdd0f4d

SHA1
120acbcc90ab3296f4fbba98de5ba3f043efbbf9

SHA256
c4941c9fd0dcea01bc57b08c173d171d50c9518044b00b1b66742d446c952393

SHA512
2df84d53884f2fca794d393439abe7527d9f20249856cdb5fd79e00883a88d4909910d787b2c4a9cfe3fde391335aa81fe33b68448eaa0ccae72cd5d85b98176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\113a7edf-da40-44c5-b973-4a37d2080a50.tmp

Filesize
8KB

MD5
85f7f61ada780b3e177788d584c39373

SHA1
6799f8b32eba6503e687858e168d68662a31263e

SHA256
c15e8de8f9d41db5027eff4841e59906239579f70d467ee0d2b02162a598ee62

SHA512
b1231d44272c5b69d4e38d856c76a3acc64fc01cd47d07e9039c97c9345d0d518d32d9650229979e6f423f6c4f1cc6ca6edcfd46bd87eba585805811fc614129

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
3e433939f22c4881295351f8b74bd62f

SHA1
df7c5d6c54a78aa157e3eae85d6d480595526858

SHA256
d31df799afbd74c3fd66add72562da091e373fb2cc7d7b354b90a2f213368848

SHA512
a5145840fdcca2f01695bd7accb11fa21aee0b785b555f6567562f7beea90ff894825e23853b3a3127a7c8c32e9d23cb3d9d9acfc961f7e24c5deec8059402d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
6affbb4a397d7d2f632a4512a9ed0db7

SHA1
a3fe51357c08ba888b98ce6bfa36c94cf0f3fda0

SHA256
7c72d11e4f7469088909e4d3c0e4516e3a9fde7cd4a0be72f9c5af7416eb7dd5

SHA512
434083d94594b2825c821bc59ba0e35288d2e8f6d3d1c039fbd3359407ae9e72ff29c8a9ffe530aac693c38cd8c45ff16fcebb1c347da256c75cde717e14346c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
2d24c269001f89bb75d46c4ed03caf15

SHA1
7af38350e0379d9b9155dd5602ab361768adb9a8

SHA256
80b970f52a034dae8a007cc914a1d4478ded7ec4a45471d1d47da8dd86c73a27

SHA512
84c665eb1f8d68aec42f87ff91f4ea372e4c1a0ee6a6831eb0008a00b3c5caf7bceba2d4ffcbd497ff6e3de9b3e326800529b0f75df3801ef0b16832d92a93ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
daef0f292f04ce00bf4761ac42d64b39

SHA1
099bd038a531792c329e0acf750cc0b70caa52bc

SHA256
c8d6d5382e8541355029c2484d6d4b27351b8308061e3c0916c76cbaee6d1dc0

SHA512
731ae47d53ecae44b2df380951c75b9f9e811c47e242de8841917c97c103d6f53453c0983c5e5b3df3127439fbe7a0134e12691e801f17ca54bfeb0721af0891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
58KB

MD5
61b26867a60978f3aa276269ad2c2f36

SHA1
14ca8315b6d8b703cebae0a244db086261a36ac5

SHA256
acca1cef3c287a06b760a0ecc586c8f0bb63644850c815358540467808f50988

SHA512
23a1ee9dce275f4e6d3da9de4751ad3324533ad6d5697d304f92dbff08b8492df2ea35daabe7312c3168b9bcc9f333f5eb0b3676ae0450af76a1b83fe9cfc1a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
278KB

MD5
1fa0959d35ff26c564a6a8a78a09532e

SHA1
07dd79c490926c86c4c1fa128266d6fa481f5ba6

SHA256
ac6af94f52b268978c468f9dd4e57433fecd0f4fc304423416a4dc0f53a767cb

SHA512
7335f3203e31a57174bb5c8b9b2da8093a4593a27e26b6043fe8249ee34d296859f837e60c60b55bc5a0a6873a094646caedb0318193cae3588c80b89f837b90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
76KB

MD5
0628c5578f08ca0996c9f7b5492ede34

SHA1
99bd80e7cd381d197654b2a32df768436d32df59

SHA256
bb0dfa1a357c46fc93d26953ad6d927e5f84da4597a650adc9016ead29e094cb

SHA512
a7a2bafff35fa5876dbb04363a4f7245de05375f32c111bd9e80f212801188bec034e5c28cea550a1be73a8a7db3db5c482c6b68de7ad6e13d1e6957e10e5275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
95KB

MD5
6199c47a7507fc11993e616cfd5438c4

SHA1
54506f9ccdd4dc8975a3c713f6a49480905fb61e

SHA256
7089434c4d906c5f198cf3b81be210bd51b9972e4b7a9cd10cb499bf92a3aa6b

SHA512
ba02b808ae61c22b5ceb8d19455ed859a4ddc302aac7095e3a8d8b5222b22be2dd4d3b45d1faceb832e3d3a5d90de507e60b88a03b9b0218b4fbbad88ec1a8a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
146KB

MD5
9ab7f8c2ec841f3080a42d523d9397e2

SHA1
e5295b8008093a8627de6d0d21de65b5a372e04b

SHA256
089aa0a4fef0faab30777ef4f19c4fe64c00ccede0674a70627e29dc59131d9c

SHA512
9bf34726454b3829bf623836dfa5c3ef3e3787de341e92b3fb3c231cc1f482d09e7f59ad3f2803548ec082983f66196ac301a0f4d83d23c93a5b08b273a9bf4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
40KB

MD5
0f81b6d61de3f11df96afa46fb362f45

SHA1
b73925c797fcb5e23b0e0495ebdfb629d16f26e4

SHA256
7171337d694e449b8c4923733effa4185a3eddb330b96e9fd0e4e3497faf5364

SHA512
1c97e4e7357d385613f05f7a16439c25614d553cafdbd18a197c4a369726ec28b372ec6bed8b87a968d74a2585e3c999da9799e6cf558fa9ce25f87010d0e617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
65KB

MD5
ea56641d8bfa5c452164df3267423f04

SHA1
b046704be32eebfb1f7c76fd0a8a20c0e4b318a8

SHA256
c6912da3a835799238bfb68ec7c58e3e67f7429b5f1ee7c118ae90d412110b6a

SHA512
d5430d0a32ba24ac42f19ddaf0f1da43d4c5f76aa2a5b9bbf091f56724995e1818e4bf33e100fe1016786ac5fd55b342b9e5b0a432a2f3301fddcaa6ddce54e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
91KB

MD5
2e7c53d5de512c85687c4e679e44d574

SHA1
3914c04938ade45aa5d22bd709ade23b0373d919

SHA256
99cb8993007fcf945b64fbf3c1fe61ecf01168f685342c9ef87fa03e307d74f0

SHA512
c00c7c2bf7c3298cf90e4d7fc06ba722057d0259619c098bc5c599ecc682e7b37eb43655bdaf6f48be504465e156afd372f76ffce43d165dfc063aa47009a142

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
21KB

MD5
16ed7ffdc347c24c8275e6907b508257

SHA1
eea712285e89d88243c29f8a5b306a4b565a89bd

SHA256
d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e

SHA512
f906d22ea8354db0826210f6a94c4f654600bca2255fb8689cdd2bff13f33e578e95b46e6ca93a60a5793e62f1e2ddb1eaf67a8e4a01953301f7d5d7e5557f0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
576B

MD5
84afcd62be24502eaba79ff1fb33e657

SHA1
a7f0f311f9eafc49f721a033989ec5ec1fe0bcb0

SHA256
46855b00fadbc188d349253e8849e1887468d11314fb66a35fd608bfd34301f0

SHA512
4dca8ef2267c4e3e1d50ffcc10af068beecb21ac29e17300b93ccc76466525ae964d68eb48a8557a81132acd17c42abb076c440aa33500a9e3e30a7265cb1c7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
5d614e55279eefec74f0256de7b9115c

SHA1
f43008a0599d42b5ef7b5e74cfc7a85045bb8985

SHA256
24c58bf6159157b8426c40d414fe26742b487f0e018e50a59abacc31a91046ac

SHA512
cb9983918288fcb8736e5eba02b474062ae9c924fa42a50cca4810aa81bc4e754a85986c23c877e794528511aef97822e3a2cfecb126afda6afb3ee35247f4ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4677e008919bf895e2ccc665bf940882

SHA1
ea5a7d560bc02a7c3cd237729450e4870fe91510

SHA256
cd3db1f237c00d58d79642a28e16819582444e06ad1d464f315f1ec16b96dc09

SHA512
7509449a25e665d4c15fef945f6ad70a1d613b7592b542a87c96160fa9fee817780e76361af6c9d4881f547fdd486140078302b3a8a4be012a138ae16aa02cf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e435fafa2dcb29df995188a3ebbb80ae

SHA1
75b947203515a7eb2108e90cf8c5db09d9c59d87

SHA256
7de37e1acc478dfa692c0d88ee0babfb6e073f532572125e7a28b8f0664d7a0b

SHA512
d65d08e463c8d64099e63adef44a1acc495d62945bbdd9197a5b79f1c620c357302abc5812fd5516bde44f8423d946454c3be62cf28c6a3b34959782f72ff002

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1c8e3fdc54817d1645fbde0c95aaa777

SHA1
ab58145109066e840d94aa0aeb614fc757cb347e

SHA256
ffc729d2207cc9b0f8cc6bfd5d8ad214f480661c650768052543bc7489a006bf

SHA512
5c06964d9709719080c865c0e847caf8544bb5a75223805a26f7cdc184064a59f037ad83236cd0982d53d85662b01498fcc90727f5b430028070f41745fef8ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
320B

MD5
1106369a99427ac56ea0bd9b5b232425

SHA1
2d2d44780f6bccc464f4e761510f077a831bee38

SHA256
a6b2b583e145316f48d48dc55af0acf4981d9917d069df6420215c413ed804d5

SHA512
bff6bb716a7ce0ca9dd5974f582c7e0c639a5c9e90f17937151b4d0d2057c097a5afee6b16f48285777b514fb081a0399498001694c65ba2e9b45da58f88f6cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
20KB

MD5
eba650b39dec48f0d544da5148b2f176

SHA1
521b01c0becf0e0179a835b7ceb1ffd44beb931a

SHA256
e5cbd4d1918030063b8af777117975c707d9f07fdb3fdcacfd5c96793923fe6d

SHA512
d0c6020ffa5d5552da427b3a9495a997af69b577fb0fed6d0d76b7dbfaf7bb95504a6202a76f5937fe4ba4563d8f3436d015cdfed0ca835de5d9ff0eec7f8839

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
152KB

MD5
ad265ebf465e23c507db71aa4bf50d2a

SHA1
a6e422cb02e3386f86dec0780e099cd3633f1e00

SHA256
ad05136b354ba95f3f32ec3f0968b1ac0aa6870a6d8c865db80adca2ea7e3092

SHA512
0a55d5f1d70a56a529eca57759c24213730babea9df8738994d955f232cef497a5daf8fe1492fe831c12e6b1f1a2408a1d8105320419d58a459391967e24483b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Filesize
17KB

MD5
36db9a241239ab12a259f0a85ac75c7f

SHA1
d1f7ea33acc31c9c57ec4fa2d7db08f66d642ec9

SHA256
9cb864c2b4ef2100c5c1efc28c4d8519ea5b407b1e310351a0fa0f6cccdc9a4c

SHA512
4969096bed680a7a78a043301357fd4501866afc9e4e1a57ab01de6fb6876bfa26d1fdcbbe43dd070447486263e7eff37f1b8bdd81c5c8f59b4e04af0aa5f374

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
d3bd53770123daaf2230b6d8be46b4a1

SHA1
ec030079bb2b7eb6aa8fb2c3acbd07e74188555f

SHA256
8026aca0bb2da233862bd79d520aec8e1d2ce3155a15d986e76f806454e4e47c

SHA512
9d9814fd90e0c33a6f250803db975ed476eee42b6e2311118d821e270865a8ff523f3accc7cc3ec4a7012a5e2c01d94ed401ab2eaf6924315677ff49ecfd0a88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
1d25e44329160d47d0035d84bb61da4f

SHA1
27496dd65b38dfbb849b092b5728ba7464feea4a

SHA256
3aa361b260640b5444812acc86aafed389ae33825ab62c8dd46a4a28857b7c21

SHA512
626dda964a86f84674b1c5851e469c8172d441f0b7214403073bd1b79c0500cc79ed5d033b9afa5bf83efe7933feb84c6e3092806930d02346bdf651add210c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
137e46f8f7fc3bc5c9993d3e40c18a18

SHA1
f2464953a45323a0f0e45685dab786f7938e8dc6

SHA256
65f9bb059e9886afd9a19a86100b56b08da5b28d70a6fc735a1444ef8887dc13

SHA512
bc270f5ba6bdf20ff0cdda74e760061475d9052a54124b348586b4b593a9339e118d5ec6c5138fb45d489ff443e72b5e079251ba0046e0a75ae3deb3a9acb71a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5d9560bd5cd71855a26733436f0cbbfb

SHA1
a51b04ea7c043247f542355dd493ec21de3d32f8

SHA256
7f5a198d38ba62b35086857ae0571eca61534248a46ad8e456be65357aace605

SHA512
44e694a37326ae297da2234586769f99f50c16b9a70a61ef52cddfddf62884a1af6c0011c7537edf851bc535b082051dd2b8046e681ec8998655d590cc334818

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4fe8063b848c6a17c9e3c59e732e056b

SHA1
972b4feb91d86996ecc96058686f972162e88f4a

SHA256
3ee0c9edf67cf45170f91469f43aa6c5a68bccb43ccad0217c4823de073535f1

SHA512
42a07c4b9575a7db66ded1c8aa59b23e8def2fa078dde4422d16ac68e304bbced159031232df18927cb532184c67b04b2385fa4f6a07c547ceae1f36f3eb9d6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
60dd9f1e9f48c7e25e78b28c05961f94

SHA1
540a77afa4017a3b484ad0a660d83c9b2522b47c

SHA256
aa73daf7471045cc15f298178dde0f0ea421a28dd428f38f329f73e9b0c47d43

SHA512
aea3eaef80b059a3e147367ac3ea5aa8caf5f4ec5dade3cb4a90690aa1bf94ae533c8281f54029d9836f9cce0ed5fd3721ecc676165486627427bdf35f3ce1c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
12a30c1ad2c821da08376924a46d441c

SHA1
ed8bdd970739b351058664dcd7c6d16a3201fe83

SHA256
a52266514ba45fbd618d385657a78e3867218a6176bb1cbb1d00e488b5b3624d

SHA512
e72ee99e01eb6fdee7b660fdf20cc477e6524045f17f8d17fa2ecbf473b7fcb8a047964d546237b28f4e1055f1b53357b58c42d727732e95d035dd77bcfeed44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3ea7587e36ec5529f2d9c3cc0a9b6aac

SHA1
c047b7dddc5d51cc7f7bdcec096e1aec2b5d9092

SHA256
9baf9bffbf9c0e29c37082819bc52ebb0ce54f61aef5ad3f2fbcdd3fb052cca7

SHA512
90d96f0c56522aeefe56b6ee53cbb442c998a1e647bf0ad9c5458bd998adddfeccbfc94ca96506f25e95c310f7b1e62456d420e6498de0a59fef45cf829c9f5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5787fddb5ed31b2766410b20238dd008

SHA1
b8f96a77a6495c33b65d21e2e9964b5c59853df8

SHA256
79c671d3fb384121d4a99673c7e9ead0df371411861b870fd51cb97864d3f0ca

SHA512
284946aac25e9377b1feddc9a1157cb5f25552fe0504ddd83deb6660c9adede7fb09a30f87b0394c05ce4a8b84e5ca4326e919a5fc70fd3b951489c89591a734

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
c7c5802f9db2123ce9ac84e9e485bfa5

SHA1
4d14cb9b4aa300bc175d07e4c15972c5f8a1a2e4

SHA256
83fabe777aa4c0006b94304e401e4367491a0411907a02c93a9429fde7f7b2a4

SHA512
88d65f9c0bde08f4774d011ad45f2198892f27aa7c8294f79e572268f1ba161f0c85434df2585037cf5551d395fffbaf03fa1115880b6fd57cf39c9a15a4cac9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ee935478ecc3c059bcb38d7afcb87230

SHA1
48f2ff66140f0c825b1f1b20561e59833e00e180

SHA256
6c71b8bacfc45d1837f53ac96c451a3811704f16e0162bec307bbbf6b003bf0c

SHA512
773384fb69f5d911e4d1b72ffa28e7090748594355a9f2950432d45eb12668b5cd94d1198d3f2c79273989665e3dc1319aaa41110be03a5464d007b93830023c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ed8272df54f9d933f44a49269424e935

SHA1
608b6ee77a0ecaa8883e4a1ca3f427452e4dfaae

SHA256
c9842878714035ebb13f195e778427f1a6a27b3fb64321fa44a374888f985bf1

SHA512
4d8dc9e9af4311048bc1b59fe18d23e85f9fe572714f3850992a6bb99d51658c25372162dc85ef73393888be076f840aaee9e91dfa81254e78cc450a6df7e3b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bc96456bb4a0b5ca84ecaac4c5b97ee0

SHA1
a1ab15769751c290d0b3ce5f703fc6a6390aeb4a

SHA256
2b750e97b554cc42a569c30edbd2b4a32639e89ac699369ddb098c286c0ab5ff

SHA512
27b607d092567c05aa3941307da6159a89b92811f4a633510e53454d4b1a8f59a32684a565b749fd48baf3dbed5829f030f4eb88c8da175418445c0e7f17c16a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
acde428894284ee7df70ad0d3a5fdbe6

SHA1
96fc469f711ac5419c1c82cc67bb551801f72b69

SHA256
fdaa674de8119e06c57913d91d2a11f67a450ffa2de6d5eb3d7ff0d35edde434

SHA512
976f3218cd2e551abb4db444969824dd780718d434a151a807fd04d22f51d7c736f9bec68a53f280ed7c3f079136b38b52f1c6defe8f58c6b30bcc75b1d1bbd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3a9b1e02c061f6cd161e592a2d75c9b6

SHA1
9480b7f398d57700c07d0fdd28f62fc27c8d2bdd

SHA256
a2e23491fc8a25d57067c87cfaab344c90e470aab83962206ba98cb08230edb1

SHA512
c19a1778269e168706aefb98d3f4c7eb07c4f1580ebf2147dcf865fe97fc33e9e8be69c62019f49a353e37c40b98aab0330897134efe991c8a62995546788ee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4628fdb3815949712a7dc63f174ac351

SHA1
72f18920d054bcf618b211ab558dc7e0e69ed2ad

SHA256
0f661faaaa23fe09ded74f7ef8549fbf3d7b7ffdc97fa4571a6b3ab7cfdcea47

SHA512
774797e78f892f8068a777c7a6580d113ffc1b3a61904db8528a7ea358957564876deaa00353ed51229b62a2ceb714c9cfaf5cc9168931fb52262920a9c5cd94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
4202234608d3001116eeea8dc301da82

SHA1
92f2e0626248056b564b9116d51df5b2ee9125bb

SHA256
84544af2f0441274f7b5575b87a24c7115813e8cb5b7b67463db0aa2850f4cfe

SHA512
1c779aa303cdcc50a4842751cfb926f2c7bc591710743cbea2c431c2fc4b37c7e3e3cfd98be342f1cae739c4cfc492f37748009d0070e06d1e91284131294bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3490ebd4dff6886b0a6fd23d9b230cd7

SHA1
2b2f174bbf8e0e2bc25e9891da097c612452a1eb

SHA256
536ee9b97b63992c59917151f1fbafa326794cc914f712a1224391c5f0a6a519

SHA512
bbe096d188513127360e9b2576d60cd81d2a762f3b8744b359720c54a8c7d3d1ce94ac78b2eebc697df79f23c4d46356e9c28f5dbac0fd517fba9b7dd08d4c6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
e9fd43d6bbe79fe10d68d586421fa478

SHA1
203752e44c0e8f03d2fc740bef919211d405a6b6

SHA256
1a20377e058b2cce1e2afc624ed10c1399e8bdecf9fadf9bce742a6425defc49

SHA512
43706cd13aa2c7465be9926ab51a83fd3d2edf1ff1434a1861753784424a9c64dc506ae84bbfcd3f1d733806a7f5d539bd43831561b7840df2ee6cb626ac541b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
15a20c695af95936dcd9ba6777e55e0f

SHA1
29cc335db740ce3ed1012e9326b1b840e397a74d

SHA256
0020578938568aeb92018616c2432a8660284a6f8e35a861914492ec00755f94

SHA512
8b295245ef934cc7eaf033fa2baa7fb321a494539d11fc34b77e25034112d1d56b1864309f1edf565cbd2024e5274b967abe0557e9ca9d0c05df0fb793c66749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
03797c93175e28b4b6b9b2664689aad5

SHA1
62f3ea8b0ef626e10c9d3524c9898eb63e67be7c

SHA256
2d95222a3e06a8440e9ff482fc437e921b8a0035ae8da3e8edcd8d1352519124

SHA512
bcb8c962bda48e7cda34b489816fea6e756dd2d91a7d01a12bcd55888336e80c53929c99f8580bca216d5eaae842945729aefe94ff4c951b58d5d520d249a1dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
580ec8c630f9cb8157ae853596d29440

SHA1
fe9dcd0aaf961af56b6336abae984d3fe0e2638d

SHA256
5fe7319dbbd8039a52f628978a494a8c017b425feb40ce746f714b7ff0a7115c

SHA512
95f0fc4c1d352088e3344aac183e19f3892d990789a36b4966bb4b95a5d6e7b5e02c16dc570774aa84a5b65ca369c3fe9c6f55b7a9db8043a2d6a5a8fdf8ed60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1f7292a571d7505bdbf3f13d2da70fc4

SHA1
2dc25f108a0fc0b6b8cfd5991359dca7d712f0a1

SHA256
9f85d8ba357044ea7030aaead1d1e73f38fad5b72d9697c580db4297410c24b8

SHA512
083dd75a25f4e638ea4019ed6f20bacdba3977712a6aba0cc9c35e24139e8738ac840cb4bdd67137b006c97dc99b3e00b654711883c800c11fa03910473d3211

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9fe15a24173bf97b91da2ba1f2a3a715

SHA1
97110c789ceef6ff8ab3f981d4c429d856a001ff

SHA256
5abfdd1231518659e79290399f557805bf6e1e37dec46157e446a69eb1f545b7

SHA512
7c74a830cee3885ece945bffecfe575382352ac6b3fc26655ab035f28a7012f9a1f6dc32de70ab2bea6aa28318d0a2f1d4bd9611580a39f6d37935b2f7b50d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9ba0cba722385b1215d0e93835dbae8e

SHA1
5d1798d18e9dd517bd9c439239de47b9a6d782c4

SHA256
703b8d277eae71672d43270f9b2b309ebeb5a4c489b4df14cf182a5e9e4abb53

SHA512
482c1a293c38bcd0d62c4ba1a5ce73952774e96530cbf8500f5ba3b69d714b78ab770c0368f12ab16481dba9204b6047d68df3131809b4e4d6e11438f444e03f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
658fe5a2de4a72bb8090076965bde29d

SHA1
2162c59c3a531f6c7e5229e030c51616d65f8ad1

SHA256
c4411a458bb188a7ac664b8ef0b22f72c17d13fcfc827babc3d4882bcf52ea67

SHA512
18a689d97ab387747bf04347ff426ba662b4f2d6839a026c821855b217ffbb4d188317fa0c4e2abb4c7f28f277d1c7aa45ddf09eee1d04d70fe354ec976fc953

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
0f88f6bd597bdaf6af09bb6e97b797c6

SHA1
1319162c1118a234daaf41eade05c414f5b7482b

SHA256
f6c8f19069c70a572500f0c01fadd469495ae0a5358279c9f35aa12ff6109f7d

SHA512
5e586905d8e5f1f68886f84e04a18f4ac05c19cc2035712339e1ffb9d214753f27a35176f5f4ed3fb83fec67bd76f79ffb989381573e79cf695d663446bb29fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2cd97a63ed40912750b02b59ddac80637f281775\145298aa-2b47-4b77-814c-84093c420937\index-dir\the-real-index

Filesize
96B

MD5
2a080b09e6b839041582ada01799b638

SHA1
eb3a20a98e1008dd485a187775ea07f98b19c43d

SHA256
0fa4168425b14f55bee39a8086c700218e6413762f2b22a3d585919b15a21271

SHA512
c06a83f86f5af01d604c85ca1448f82ea95e1638607449b483fcc7eba2dacce6bb23e78126b2432b7d2468a4faf04b2e1bf2f50b9ccbfdd185c0829150a2b0e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2cd97a63ed40912750b02b59ddac80637f281775\145298aa-2b47-4b77-814c-84093c420937\index-dir\the-real-index~RFe64a876.TMP

Filesize
48B

MD5
95f265a3856e83b984efb87eaceab131

SHA1
bca80ba3c9fd03af7ed9eeeee6b79118b99fddab

SHA256
b7803a96921a14f2172a51b6cb703b2993f528a1fe5a330d2b34cb0e30c2f0ba

SHA512
6255292da3444dac387815434e349bfd64b09a0e6a0f12106ba3bc415f3cebce389e12404c36ebeb7bc604c37a81fd89d7528780a7276e4e7d0124a129be7707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2cd97a63ed40912750b02b59ddac80637f281775\index.txt

Filesize
123B

MD5
d018f51de4e3891459f0eacc04e4108c

SHA1
2de01c11c7672ed6610a0d68f58bb1351d3bc8d2

SHA256
2d44288d7ba4bdcd2f23cb7ce91dee3298eeb67adfd6fe2e5e5c6e06d1f4b1f8

SHA512
d222fe0ad3b4cc86dd3a16d99891834eb96492740ff9bd930957f801f91915930683fd8e52f432f9260bfeef279aa274219d86de55c1c07fe329beda24de5a8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2cd97a63ed40912750b02b59ddac80637f281775\index.txt~RFe64a8b4.TMP

Filesize
129B

MD5
51810479592540061109de6f961cdaa3

SHA1
d24658861dc12710d6ec73f5c86d7de194d28db8

SHA256
dd56d268700c1530196e1131711657197131f4de60d2b80b40bc0fc40c1c5986

SHA512
e4b78ad778b5c72df332b2cb3d9dc8e126896657e2c98dc0dbf9f81229a6fc8f9c6cf70dece1adca1bcbd3615ffb700ef70f504dfb1d66ee070bd9cf9a23f1d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
216B

MD5
1fe51afca88ec3fbe216997448a700b2

SHA1
df60cb799d5642f06114a3ad2da6c62f29c7d025

SHA256
9a5aecb61102d65e4b2297c12be24b7bad392a26ebfd229511f0f399819864f1

SHA512
f02a3189fb5e9101a0f3f3ae9646c03ecf6c97346d7048b9c0ec825bf7c72d5f3bbee554e68c127130618961a16ddb1a71d42ec2d59f17312f8447a1f7ee152a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe649981.TMP

Filesize
48B

MD5
a6875cbe7ba5d1ded550ec35e38f897e

SHA1
1c201c705a88946366e89deacd244f414d5fd5a2

SHA256
5d672293c786caf1ed5729c21227839b8448af6438678d8f1b3f7ecc2fc4df0e

SHA512
95402cbf5bdba5993aa530228d2601155c83deb690578040af2dbaa2107b82349147ce639452e24ced0470ffe9f04e6443d0dfbc5906a6c12126d9b909804b08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
7ba0d81d697de1fc70687de3162e6abe

SHA1
41f396d894a4e4220d3bd3e492c00f614d654c65

SHA256
504d972005b90fc1e4a203b208a8f4518cc76f7871aa07b9fff6672fab1aa8e9

SHA512
c0748d5c1e1bb112b39a5246f225156e090a422d086a6c943084dfd7f91ee2d065e3721fba0712819ad556507bbe04e0085d87a38c7045ecde9d5260de14414a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
39d60f852e915104c78be447837a05a8

SHA1
0b37c385e08ad3d841f9bead412fd307f60447ad

SHA256
b917db6fd2f921442f2f93724548637cfd367e076699f6b3873c134d0452fd49

SHA512
8d0a0931cd5e3f44490dcd95321095a51ac572c9206c03dfbcd79230c955e4cafeafcb7df0587e98097594e0264803140f3cb99fa6153ccea678ff285a74c71b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13358014834198124

Filesize
2KB

MD5
a83ebad9a841238d00f0492453ccb179

SHA1
88127d8082be81abe5eb7f9a8df88fdfa86a5e94

SHA256
adb6b2e3f137746e5e9c2b0a9b382701eb26726b93e00df3a59879dc0da523cf

SHA512
d173be3c0a0b5310b335a4183fe22455624ecde623443d11107f1d31ef9c420af85d03893d6edb06ece0518212d478988358336d740828504e90ae92a42d6d7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
96d7662a172672f8f9a01e8b5712ce1a

SHA1
94c8a83121b5e78271dc7c78b3467627ba491be0

SHA256
ca39ce07830960caad4514ec4171a8de870b098d12171ab14171029c47624cb5

SHA512
22656881f8d0871b90f81cd068a4fb0ca112022e2d49c873873caaf14d231880225699b13a303c15d05bc27117c0976e589dc247ffe15334e692ff4199be329a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
6764630be440ac374b121a2f4e7508ba

SHA1
b455d8630a73cff6bdc38b0062a26f8c1a0d5448

SHA256
24416e4d5fe9ceb3288bc44d347bd7fe0666fd8622caba894cce713209f6f8e3

SHA512
bd6b5183a2b9885478d296b6e9e6f03b3a55d0c3975dc6cb2b3c411b9c59aa55b7359ca5dc4f1d0bc43bfcba78a6375a01a4a2ff885488212cea84487d906f25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
15KB

MD5
6bb547e250d95c8d351b1f190f4cff16

SHA1
7a66e1c850e6bd1d7db89e297a699f969a080ba1

SHA256
894d283316992c536c114151ed96427f3cd5776ba8f37f60fa38d65d403a39fe

SHA512
b20943b24aa51022004cce88473152f12d45ab40691bcf2931d0db7661cec5ab0628b5475d9aa1a6e1f96ce101952d869ebc80f06bd1613f66fe4184fef70418

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
f7aca59e8bcc02bcef4de5abfc42e84a

SHA1
2932108be8301b1a1e6ea158af3d9b9840bacd6a

SHA256
823960b986e61366d7392429febd5306d14a268571be0762ea639597d3b3507e

SHA512
c7be08802f55bfbb6f8b146e6b4875a42cbd46fb66b1dc37a4e64b01d73ab7d2183a9e3a5067f6b575e2eddf3ffad2865f6a475f8611e7dbad301e3891131bb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
e6688aaef9a2a8446403ea8ed47a31b2

SHA1
e05473a53eed14c018caeaab4d4024b493a3cc5f

SHA256
07c29577761f46370ea7a89cc8045bdc1b4d1074d49a695206c3201c8ecf30fe

SHA512
b572a42a13a2704ad12734419553c48caa27a21e079e91280ac9f390b692690bfb81ad326af158d4f980dbf3309867fe086d09db645ed9b2633a1ee95039b7ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
1KB

MD5
6a2e46fa0c2ecdb7da8575631ff01b59

SHA1
564c7558d2ba23b30c5b089ce2edd52246fb0368

SHA256
20e07b38d4535cba5492c9f5b9246cc6a172edebbfb87afc89b6a61ad2cfe83d

SHA512
341ac241b167adb9dfad482f567c19ef914fe88260809d85759f3de2d35b2daa398b4f773719ef8c2ef8a20cfc8112e348bcb8692886dae0131b8b21ffca83b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
320B

MD5
26d50f16e7273e36416feeb5af41caf3

SHA1
42515df338537567e7608a70f316b15a87f7b57c

SHA256
aff5c892fcb1fc1caecc1ba10156f832d22bb0b4d8ed595b265439574c11b72a

SHA512
638f30c781e27494dc9b4b8a64648370cd9223d13e5d035879218f116a4fb7979d960f6234b64fedec049dedbb771efd2898ba0a2c6add5041aa6dc0091aba0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
889B

MD5
eba3e4a7304c7117225bad46237daf10

SHA1
e394a0ed5d3b0559de5f1a498887378a02a370c0

SHA256
f820b19d14401193880d532a2a4c6dfb37bf7a30d97bc9e74073c7dab6614178

SHA512
b4bc002758aaec25bdc8ed2307b672741964b65c2c6e8246253454e05474654e58a6a841f98ad7ebb054cee776421276703303c7130fe6484065a536a44a7444

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
338B

MD5
25f7810f3003826071199eb62be8965a

SHA1
e64b520417f654646839a8943787c3b86778818d

SHA256
93540b4769021e9c00ca41a53339c868848256406efdef02eb9b83b034a2ab1c

SHA512
6695ede78248544b5cce85d41df4829de9a148c4eb614a3dc892e731a7c68e841025cd2533bd21ac91b22bd08c62b4b3ee89bbf3310d833ce11f6a04b90be507

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
566b7948283a08b617800b1de17c6320

SHA1
f3c912d253009d24c8465c33cdd14052cea3e476

SHA256
01aff9cdc5b9cebe598cda7e469c1e4d4117d970e7e6ff5a6aad74ec978c7d51

SHA512
0711c889fa438875628e0586bf92c22d4315c1302ad49fe1dbcc00dc9b4fc7063db4fa6a410c54cf928b972373c9d0004ad11ca5d2f0dac4ecb4471ac6268f31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
dd06d094165de5872e8dd30f6f94969a

SHA1
3ddc9dc9bf8fba18adb511eef2383ae1462ecbd9

SHA256
078e94b926516d7fc9dd961ba215de5eb279f91674e01abb3bbd0b30f45f59a1

SHA512
aac8fa7563a276f3e2512731c38c947bf45ca3a7de7d019b2881eabaf267a7979dc469c53fdc097fe2b9d4e0817e0b5c60e899df88ab0af2664de455ec0a4b8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
372f3c95af28b84cdbdb22925cf3866f

SHA1
535ff14f6ca1b46b26935328047e26531f74143a

SHA256
df72e51000a792096b1e4638deb67d2e3cf66494eaea545cd4bfb24def742d2c

SHA512
bbffa2e58606b6666acb804ded87be572193ac0d3a821f7a8f870869dd5e931d7718c49d7c2b510f0dbf3ef66ddd462bfd7e31a8c96b54d848756cab932e85d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_000001

Filesize
24KB

MD5
85152090a7c4c922d51d7c8f8c4478f4

SHA1
7f93667828854fc987eb2bdeca01afcefe1ff342

SHA256
2f52a3480f08de17e3a57c211d4bb55c5751f0cff2d3c2ea96df168f4f1001b8

SHA512
e1195e3b6c3f736bfef60194fd59332278b4dc7f47555b044d5f157145c5d63c5be9cd441dd8a504890d76000a61eeb2458302b684d3acccf0fa37456b693342

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_000002

Filesize
16KB

MD5
ae9c274e26878d5f3f7aa93d8571b0e2

SHA1
559b7adc9cb68cfaba7e34f8a2e11e78a1f60d77

SHA256
1eba1ce6fb0dc8c765a4a21ee41a404ff63ea599c51383a53fadf5800fa8b03f

SHA512
fd63e27d4c0bf40b1245251ce75b1de114db47ccfb65dee437696696c130c45359bac4f1a60248a8db1b9cc2b6d20bef614b0c72ab40ec292c944b9338ff7079

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
009b9a2ee7afbf6dd0b9617fc8f8ecba

SHA1
c97ed0652e731fc412e3b7bdfca2994b7cc206a7

SHA256
de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

SHA512
6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
427a1de3a7720989a5716545b27cf4b6

SHA1
b49a390aa66179bfdd9daf9a24080e8899791d45

SHA256
3d007494c779e20c7e6716a1c04d0ab869d06b4ebe07e5671464b9340504fb7a

SHA512
f435b0c5d043d34ca2dce7e3668b04d25b715b45b514858c49ed750bfb69213b8026ee0d93c79c69626ceaa9cfce82fec8c562a308571255b3515cd4421bff35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
127KB

MD5
38e4254c1d9ea4d0883fc031fb61587e

SHA1
6081f0422132c19245b5b2a3066dc5d987a16eaa

SHA256
cc9a6ee4f8c1cf74c8c2c3bc2102f057ed8b4993bd95f23a3c87472dec014858

SHA512
16d71a31b0238a78168beefe6ddec0d73d19735d0b849fd9a6d56d1364fca55333bbad5082643a85cf2692c113759087e425a131a9c0c0d5aa603627a270f2e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
7b5267c2b013594ad88c9471e8f6a2d6

SHA1
c41df01861db7d30e8a80d810267fc80d5abb86c

SHA256
68c6344c82d061d3d79eea9869161e04b2d9e8a6c2b96b90aee00dddaf228415

SHA512
e12b930cdb4868f6c92755dbf8114e5dfc286f6e8d8965474a77294325e1fc2057748d3244d0bd4aac6a102932fbb7a47c213fcac3b77f5c75c8f3e85dcd8ccd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe60a1c2.TMP

Filesize
83KB

MD5
19e27be9a0128ef53eca8577f2144bde

SHA1
4b51ec65adbf534bf12414e169fa7af959917b2b

SHA256
e089458c9577bf95c5f94557e3957a1bc4f63c165d59945ec13e44055b6f6f06

SHA512
0895c9adce436aa34cab723ce6d636aad47335cdad50329dde76d751a1a08afc28b2de28e7391452f365a9eb0f3a9a86a988948b109c7cc130a02704632f0ca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0106ef73f91b2bf65b225d25ca66840e

Filesize
5.6MB

MD5
0106ef73f91b2bf65b225d25ca66840e

SHA1
a6d345114879d6f7bba0352bab4e80a2688518e6

SHA256
5ee503ec8e7fbc6a32d20b97dbaf5e1c85bfbaf31f8e393cbe20d654dd86760e

SHA512
544013691c28f6e1741d65c96c461b7850c0ee0f3a27c8ca1d631fe5df1733aba3e78fcc94c6f96b602d5fb351d9f843cd593f413114482b9816e4422aa33aaf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 329132.crdownload

Filesize
5.2MB

MD5
0c1b8a4ef9d42a8bb164a9cb3c6d5f13

SHA1
ae69fa0b3266efe502b5c6fcfce897de61db027f

SHA256
2c06eec63b04eb812ee682e56d9d70896b15d1c647929e26f9d85cd383e667f3

SHA512
882821984373f14d1d245d1bbea77b77bc92fe9012604da0151835c5822c25289ded8cbb76663fa29d36f231b28d8057a7a835f49b97761fe89f7c727e563dfc

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
67709e73447047aaeee4a446a3e1f9f9

SHA1
907321759a0e44b0212016af2fc3063226aeca08

SHA256
7d2633f233713dbdf0a7a9dc12d9d7d69a2867d721ea72a9c30173199bb88301

SHA512
4e396557787cca1e0ff1524b23282076de4f4913e50e6a03b93ab9c77107f71edcaaa3a9c82d6420448ff334020632609d77eb7fdd4c32d14d08e9509f399ace

Download Submit
memory/2784-892-0x00007FFF35DE0000-0x00007FFF35DF0000-memory.dmp

Filesize
64KB

Download
memory/2784-906-0x00007FFF34D20000-0x00007FFF34D40000-memory.dmp

Filesize
128KB

Download
memory/2784-907-0x00007FFF34D20000-0x00007FFF34D40000-memory.dmp

Filesize
128KB

Download
memory/2784-909-0x00007FFF34D20000-0x00007FFF34D40000-memory.dmp

Filesize
128KB

Download
memory/2784-910-0x00007FFF34E10000-0x00007FFF34E1C000-memory.dmp

Filesize
48KB

Download
memory/2784-908-0x00007FFF34D20000-0x00007FFF34D40000-memory.dmp

Filesize
128KB

Download
memory/2784-911-0x00007FFF336C0000-0x00007FFF336D0000-memory.dmp

Filesize
64KB

Download
memory/2784-912-0x00007FFF336C0000-0x00007FFF336D0000-memory.dmp

Filesize
64KB

Download
memory/2784-913-0x00007FFF33830000-0x00007FFF33840000-memory.dmp

Filesize
64KB

Download
memory/2784-914-0x00007FFF35DD0000-0x00007FFF35DD1000-memory.dmp

Filesize
4KB

Download
memory/2784-915-0x00007FFF33830000-0x00007FFF33840000-memory.dmp

Filesize
64KB

Download
memory/2784-918-0x00007FFF339E0000-0x00007FFF339F0000-memory.dmp

Filesize
64KB

Download
memory/2784-916-0x00007FFF339E0000-0x00007FFF339F0000-memory.dmp

Filesize
64KB

Download
memory/2784-917-0x00007FFF339E0000-0x00007FFF339F0000-memory.dmp

Filesize
64KB

Download
memory/2784-920-0x00007FFF33A00000-0x00007FFF33A10000-memory.dmp

Filesize
64KB

Download
memory/2784-919-0x00007FFF33A00000-0x00007FFF33A10000-memory.dmp

Filesize
64KB

Download
memory/2784-921-0x00007FFF33A00000-0x00007FFF33A10000-memory.dmp

Filesize
64KB

Download
memory/2784-923-0x00007FFF345D0000-0x00007FFF345E0000-memory.dmp

Filesize
64KB

Download
memory/2784-924-0x00007FFF34640000-0x00007FFF34650000-memory.dmp

Filesize
64KB

Download
memory/2784-925-0x00007FFF34640000-0x00007FFF34650000-memory.dmp

Filesize
64KB

Download
memory/2784-922-0x00007FFF345D0000-0x00007FFF345E0000-memory.dmp

Filesize
64KB

Download
memory/2784-926-0x00007FFF34680000-0x00007FFF3468D000-memory.dmp

Filesize
52KB

Download
memory/2784-927-0x00007FFF34680000-0x00007FFF3468D000-memory.dmp

Filesize
52KB

Download
memory/2784-928-0x00007FFF34680000-0x00007FFF3468D000-memory.dmp

Filesize
52KB

Download
memory/2784-929-0x00007FFF34680000-0x00007FFF3468D000-memory.dmp

Filesize
52KB

Download
memory/2784-930-0x00007FFF34680000-0x00007FFF3468D000-memory.dmp

Filesize
52KB

Download
memory/2784-932-0x00007FFF35C50000-0x00007FFF35C60000-memory.dmp

Filesize
64KB

Download
memory/2784-933-0x00007FFF35C50000-0x00007FFF35C60000-memory.dmp

Filesize
64KB

Download
memory/2784-934-0x00007FFF35C70000-0x00007FFF35C79000-memory.dmp

Filesize
36KB

Download
memory/2784-931-0x00007FFF35C50000-0x00007FFF35C60000-memory.dmp

Filesize
64KB

Download
memory/2784-936-0x00007FFF35C70000-0x00007FFF35C79000-memory.dmp

Filesize
36KB

Download
memory/2784-937-0x00007FFF35C70000-0x00007FFF35C79000-memory.dmp

Filesize
36KB

Download
memory/2784-935-0x00007FFF35C70000-0x00007FFF35C79000-memory.dmp

Filesize
36KB

Download
memory/2784-938-0x00007FFF35C70000-0x00007FFF35C79000-memory.dmp

Filesize
36KB

Download
memory/2784-940-0x00007FFF332D0000-0x00007FFF332E0000-memory.dmp

Filesize
64KB

Download
memory/2784-941-0x00007FFF333E0000-0x00007FFF333F0000-memory.dmp

Filesize
64KB

Download
memory/2784-939-0x00007FFF332D0000-0x00007FFF332E0000-memory.dmp

Filesize
64KB

Download
memory/2784-943-0x00007FFF33410000-0x00007FFF33430000-memory.dmp

Filesize
128KB

Download
memory/2784-944-0x00007FFF33410000-0x00007FFF33430000-memory.dmp

Filesize
128KB

Download
memory/2784-945-0x00007FFF33410000-0x00007FFF33430000-memory.dmp

Filesize
128KB

Download
memory/2784-942-0x00007FFF333E0000-0x00007FFF333F0000-memory.dmp

Filesize
64KB

Download
memory/2784-947-0x00007FFF33410000-0x00007FFF33430000-memory.dmp

Filesize
128KB

Download
memory/2784-949-0x00007FFF33690000-0x00007FFF336B6000-memory.dmp

Filesize
152KB

Download
memory/2784-946-0x00007FFF33410000-0x00007FFF33430000-memory.dmp

Filesize
128KB

Download
memory/2784-948-0x00007FFF33690000-0x00007FFF336B6000-memory.dmp

Filesize
152KB

Download
memory/2784-950-0x00007FFF33690000-0x00007FFF336B6000-memory.dmp

Filesize
152KB

Download
memory/2784-951-0x00007FFF33690000-0x00007FFF336B6000-memory.dmp

Filesize
152KB

Download
memory/2784-952-0x00007FFF33690000-0x00007FFF336B6000-memory.dmp

Filesize
152KB

Download
memory/2784-955-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-954-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-971-0x00000289E1560000-0x00000289E1561000-memory.dmp

Filesize
4KB

Download
memory/2784-905-0x00007FFF34D20000-0x00007FFF34D40000-memory.dmp

Filesize
128KB

Download
memory/2784-904-0x00007FFF34D00000-0x00007FFF34D10000-memory.dmp

Filesize
64KB

Download
memory/2784-901-0x00007FFF34C70000-0x00007FFF34C80000-memory.dmp

Filesize
64KB

Download
memory/2784-903-0x00007FFF34D00000-0x00007FFF34D10000-memory.dmp

Filesize
64KB

Download
memory/2784-902-0x00007FFF34C70000-0x00007FFF34C80000-memory.dmp

Filesize
64KB

Download
memory/2784-900-0x00007FFF35FE0000-0x00007FFF35FE9000-memory.dmp

Filesize
36KB

Download
memory/2784-899-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-897-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-898-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-896-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-895-0x00007FFF35F50000-0x00007FFF35F80000-memory.dmp

Filesize
192KB

Download
memory/2784-893-0x00007FFF35F00000-0x00007FFF35F10000-memory.dmp

Filesize
64KB

Download
memory/2784-894-0x00007FFF35F00000-0x00007FFF35F10000-memory.dmp

Filesize
64KB

Download
memory/2784-891-0x00007FFF35DE0000-0x00007FFF35DF0000-memory.dmp

Filesize
64KB

Download
memory/2784-890-0x00000289E1560000-0x00000289E1561000-memory.dmp

Filesize
4KB

Download