440b8b2951e94587c4da806df96a00eda98ef6336effc7916e61e577132e60ab

Analysis

max time kernel
605s
max time network
604s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryApp.exe
Size

8.8MB
MD5

74c366b46a85acac6c83e9671e64dda7
SHA1

dc9a7b4cc7511b701401aa86e0106d3495e3a0fe
SHA256

6a25cc6c05e54ca56e8b51d2b2bd8b9a17a96ecb1d1f6d4442d36378dc809ed1
SHA512

e0df64a74c3c9e1c36f5957d346d961cc92741b1803e05d41454dde4371a0e9420f9e79163bed9fe2d8b588b9da6f2faaa08003ca50be37a6425a8320acd15cb
SSDEEP

98304:wEgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7:wEguhegD4fJOWs9XNBZ16M2cuU

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 27 IoCs

pid	Process
2020	RobloxPlayerInstaller.exe
2192	MicrosoftEdgeWebview2Setup.exe
2612	MicrosoftEdgeUpdate.exe
4952	MicrosoftEdgeUpdate.exe
1192	MicrosoftEdgeUpdate.exe
1636	MicrosoftEdgeUpdateComRegisterShell64.exe
3588	MicrosoftEdgeUpdateComRegisterShell64.exe
1576	MicrosoftEdgeUpdateComRegisterShell64.exe
1900	MicrosoftEdgeUpdate.exe
2364	MicrosoftEdgeUpdate.exe
4416	MicrosoftEdgeUpdate.exe
3508	MicrosoftEdgeUpdate.exe
3504	MicrosoftEdge_X64_127.0.2651.86.exe
784	setup.exe
2904	setup.exe
348	setup.exe
3976	setup.exe
3620	MicrosoftEdgeUpdate.exe
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
2868	MicrosoftEdgeUpdate.exe
4876	RobloxPlayerBeta.exe
2256	RobloxPlayerBeta.exe

Loads dropped DLL 25 IoCs

pid	Process
2612	MicrosoftEdgeUpdate.exe
4952	MicrosoftEdgeUpdate.exe
1192	MicrosoftEdgeUpdate.exe
1636	MicrosoftEdgeUpdateComRegisterShell64.exe
1192	MicrosoftEdgeUpdate.exe
3588	MicrosoftEdgeUpdateComRegisterShell64.exe
1192	MicrosoftEdgeUpdate.exe
1576	MicrosoftEdgeUpdateComRegisterShell64.exe
1192	MicrosoftEdgeUpdate.exe
1900	MicrosoftEdgeUpdate.exe
2364	MicrosoftEdgeUpdate.exe
4416	MicrosoftEdgeUpdate.exe
4416	MicrosoftEdgeUpdate.exe
2364	MicrosoftEdgeUpdate.exe
3508	MicrosoftEdgeUpdate.exe
3620	MicrosoftEdgeUpdate.exe
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
2868	MicrosoftEdgeUpdate.exe
4876	RobloxPlayerBeta.exe
2256	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 8 IoCs

pid	Process
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4876	RobloxPlayerBeta.exe
2256	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\AvatarExperience\glowLight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\ne.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\models\ViewSelector\Corner.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MenuBar\icon_maximize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\EducationalBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioSharedUI\DEPRECATED_pending_withbg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\WhiteOverlayAsset.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\image_keyframe_cubic_unselected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MaterialGenerator\Materials\Concrete.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Emotes\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DeveloperFramework\Votes\rating_up_gray.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioSharedUI\RoundedCenterBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\slider_new_tab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InspectMenu\ico_robux.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\img_eventGroupMarker_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_asphalt_2022.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\msedge_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\Debugger\Breakpoints\filter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\ic-more-groups.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\bn-IN.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\character.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\Roboto-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\image_keyframe_constant_selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\scroll-top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\NewAvatarBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Radial\PlayerList.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\leaderboardOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Gamepad\Controller.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\ru.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\families\Roboto.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-90x90.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_1x_8.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\FollowingIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\verified-badge-2x.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetPreview\Likes_Grey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Health-BKG-Right-Cap.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\ic-group.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\RoundedBorder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\LayeredClothingEditor\Icon_Pause.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\import_toggleOff_dark.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2420	msedgewebview2.exe
5048	msedgewebview2.exe
1900	MicrosoftEdgeUpdate.exe
3508	MicrosoftEdgeUpdate.exe
2676	msedgewebview2.exe
4476	msedgewebview2.exe
3492	msedgewebview2.exe
3856	msedgewebview2.exe
4212	msedgewebview2.exe
3580	msedgewebview2.exe
3952	msedgewebview2.exe
3620	MicrosoftEdgeUpdate.exe
2312	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-01a570a3cd0a46f2\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-01a570a3cd0a46f2\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1584	msedgewebview2.exe
1584	msedgewebview2.exe
3856	msedgewebview2.exe
3856	msedgewebview2.exe
4880	chrome.exe
4880	chrome.exe
3580	msedgewebview2.exe
3580	msedgewebview2.exe
3580	msedgewebview2.exe
3580	msedgewebview2.exe
1252	chrome.exe
1252	chrome.exe
1252	chrome.exe
1252	chrome.exe
2020	RobloxPlayerInstaller.exe
2020	RobloxPlayerInstaller.exe
2612	MicrosoftEdgeUpdate.exe
2612	MicrosoftEdgeUpdate.exe
2612	MicrosoftEdgeUpdate.exe
2612	MicrosoftEdgeUpdate.exe
2612	MicrosoftEdgeUpdate.exe
2612	MicrosoftEdgeUpdate.exe
1004	RobloxPlayerBeta.exe
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4784	CeleryApp.exe
4784	CeleryApp.exe
4784	CeleryApp.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe
3236	CeleryInject.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2760	msedgewebview2.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2760	msedgewebview2.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of UnmapMainImage 8 IoCs

pid	Process
1004	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
4524	RobloxPlayerBeta.exe
2972	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4876	RobloxPlayerBeta.exe
2256	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2760	4784	CeleryApp.exe	78
PID 4784 wrote to memory of 2760	4784	CeleryApp.exe	78
PID 2760 wrote to memory of 920	2760	msedgewebview2.exe	79
PID 2760 wrote to memory of 920	2760	msedgewebview2.exe	79
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 2676	2760	msedgewebview2.exe	80
PID 2760 wrote to memory of 1584	2760	msedgewebview2.exe	81
PID 2760 wrote to memory of 1584	2760	msedgewebview2.exe	81
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82
PID 2760 wrote to memory of 2420	2760	msedgewebview2.exe	82

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=4784.3076.16689822413800208999
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffcd74b3cb8,0x7ffcd74b3cc8,0x7ffcd74b3cd8
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2468 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3128 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1724 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3212 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3204 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5048 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1744 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1884,17275663896332467280,5760124873727314822,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3952
- C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe
  "C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe" C:\Users\Admin\AppData\Local\Temp\abc123
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffcd375cc40,0x7ffcd375cc4c,0x7ffcd375cc58
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1692,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3524,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4796,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:3120
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff660724698,0x7ff6607246a4,0x7ff6607246b0
    3⤵
    - Drops file in Windows directory
    PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4292,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4300,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3340,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3312,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5284,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4944,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5380,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5040,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5368,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1576
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2192
  - - C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2612
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1192
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1636
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3588
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDdENTgzREUtMDAzQS00NTNCLTk4NDMtQURBMEQ3NDc3RDE2fSIgdXNlcmlkPSJ7ODM5Rjc5QzItODQxRS00NDI4LUIwODktQUYyMDZGQjg5QkMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszM0VGNDI2QS01RUM2LTQ4N0ItQjk4Qy0yN0UwREUwRjQ4NDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNDkyMTY5NDQ2IiBpbnN0YWxsX3RpbWVfbXM9IjczMSIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1900
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{07D583DE-003A-453B-9843-ADA0D7477D16}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2364
- - C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5688,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:-0i8VJVmuX6_cYOYhAIrgr8uaKj-82DrJsEkC6Pg9fjp-OqKxW1UhFO3tavJKFyYSQiNJ2k7G3lpMCbZBDyhHEio-hGWOYhfzJjHAs97bPhHv1dCvMad6dUecukZH4agY6tP91UHm6-bhGTfuCZejBY8SD84GarJY-VoLe8ZYevh6anC5G6p2ySvbwTDYfY0b5p1fLV-XLfj4FGIv5d8LQLrsAJBfdCTukIkM1qFOOo+launchtime:1722624843413+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1722624727070010%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D0f586b4b-f161-449f-8843-0f0cf7d76d85%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1722624727070010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5064,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:mz3clp0xM2C8nAfqXmxObxDbyJW1wrDXEnpDR7MZS6Nq2RFep8Z5msdRhvFfMGfu1iAFNOZ_nniix-EOqHLxToehAp0MEtfql1hdOkeDSRCAwwbMzBZzgB_pVCk20-81pU3b3rrsHFv97XgqPKYdfe7380fAINxWaW6zqhFnZgRA8jh4RlBEaxOZp2O1sEQm5ENhu6-3yrBtXk_5GXq9axXxMGOX9YsCi5D7dylUyxA+launchtime:1722624843413+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1722624727070010%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D0f586b4b-f161-449f-8843-0f0cf7d76d85%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1722624727070010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5388,i,5908515291963059730,14675001882618235330,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:gSc6YOA2DKbhtN3rA37wAwdF4X1REErmyd-WFEUYVo6NAqMP9qm4IiJH5310SrZSe73LXRxcsFvdQ2jWgu5PHuwAEACnj3yhWP4R6-ZVXZGYARkFQhasoPim_kONbM2J-IKWv4ZXWYXOMwLXbglRLFn6DXo_pDxJd4heS1io__Gkl0OJLOEvVYZrF6HzVkhiJmGc_QVHFhzSZuLAoiK_IbZnoxsPh12pK63zTHUiDK4+launchtime:1722624843413+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1722624727070010%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D0f586b4b-f161-449f-8843-0f0cf7d76d85%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1722624727070010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4524

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4416
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDdENTgzREUtMDAzQS00NTNCLTk4NDMtQURBMEQ3NDc3RDE2fSIgdXNlcmlkPSJ7ODM5Rjc5QzItODQxRS00NDI4LUIwODktQUYyMDZGQjg5QkMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCNkU1MjU0NC1CQ0UwLTRDQTUtQUJGMC00REMzQzk2RTk1RDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0OTcwNzk2MjkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3508
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3504
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\EDGEMITMP_6951D.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\EDGEMITMP_6951D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:784
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\EDGEMITMP_6951D.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\EDGEMITMP_6951D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4880E83E-CAFF-4FFF-95C3-9A46B16FD99A}\EDGEMITMP_6951D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7d9bfb7d0,0x7ff7d9bfb7dc,0x7ff7d9bfb7e8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-logging
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:348
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7c8f4b7d0,0x7ff7c8f4b7dc,0x7ff7c8f4b7e8
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3976
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDdENTgzREUtMDAzQS00NTNCLTk4NDMtQURBMEQ3NDc3RDE2fSIgdXNlcmlkPSJ7ODM5Rjc5QzItODQxRS00NDI4LUIwODktQUYyMDZGQjg5QkMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QkRDNkI0OC0yQTNBLTRGN0ItQkZFMi1EN0NFRTgwMThDN0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjg2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjcwOTgyMjg0MjIwMDIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNTU3MzIwOTcwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1NTc0MzAxMDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzc0MjMxODk3OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYjIzNWZjM2EtODZiZi00MjBmLWIxYmMtNmM2N2EzYTk1ODg5P1AxPTE3MjMyMjk2OTgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9aHhjSmVyZ0ZwakFhZVZpTmQ5NmJUUDNxRDlLQUpYbTJLZVhQekowZ3FxMiUyYjR3YkV0SkI0TkNsczM3QTdaa3pabVExdmlXNlJ5SlZYSTR5cUhrJTJiRG1nJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNTY3MTA0IiB0b3RhbD0iMTcyNTY3MTA0IiBkb3dubG9hZF90aW1lX21zPSIxNjIzNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzQyMzk4OTcxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3NTYyODkwMzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MjIxMTc5MjUwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNTUyNiIgZG93bmxvYWRfdGltZV9tcz0iMTg0ODgiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDY0ODciLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3620

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2972

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4088

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2868

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4876

C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU655.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24591f85e9569269a3b822d0da2e0626

SHA1
62641ade4943b93983b4e59ffd6ee4dcbd77c17e

SHA256
d29bcf294dd77568fd173adac8c705d991482d645127baccb7efca20f560a5a2

SHA512
d0bfe43ece2c598a12fe7d3f2cd12e0685b639aec0fc7a1bbdf0829b886c22208e4236500d8e6540d7faef1514769b87bbdc666602c5548649e50aa61f2077de

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
ba8b91145ef4f2edb89e66c82d6d436d

SHA1
2325ce372472d03d6b36a84505375f2f9292d286

SHA256
4e1b1661e255d895ae28c64f3f8616147d27126b6416578aedf917083f048c93

SHA512
a0d60646c9782363d27460d9833f3cb3536675e44062eee10479cb4d257cc8c28d120791c23f280e7fbe9c3fb2834ee3598d8d03758eb4e430f2da9aacda92b0

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bce0593703ccae52206b2d65135530c6

SHA1
1cdd6372e7ed94c7af2a20236d1ab9f9aafb8b9e

SHA256
97ceeb60fbd5315219d5eb33652fa4d595ce629ef765c3a1b1753c0154e5604a

SHA512
1cf2cfefcbb0c1467b978d7e7ae430d6a7407e3ce926f9071488e3eb553a09a471ab50d5ede63c7c0eab56815524fb3eb2d1b4b2493e6adac2077f7607aa5b6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
db3c8dea156a5efed9bb471ff2f8632d

SHA1
2a2204e4187f0c7bdaf4120e234ac75f3819d45b

SHA256
ed6878e3bcfdf629971832be444d253cef4f7f9d5eb9fce83f8e148352215bd6

SHA512
4ece4d5f75ce41dad7d43bc92d5ebebe2c32ac243af0a52496f6547bb809197176088ded6a622a29cbc404e4fbb4675ed614ecea01e6b78abbc1695cb8a733a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
831c10f2c97e15856e252691f6df8e22

SHA1
5bcca9185a183a80502a6e88af8b2a593f8bf705

SHA256
824df2bf5d0bcc5a2006209482bd1e393b32ea729ae873e0586c4336f52a05e1

SHA512
fd4271b89b9a6fcd7f5a06dbf8937eb1c5ff74ccee320bd849b3ed21c8d0e1ca3f9b382cc8edcd6903743d655f083c23aa0b63415288d620815a02dfb4f31d3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
7ae4d1d85661fb16ababa2e43f2e1a7d

SHA1
49eba8c37daf408394449c552eedf36d0fd24e68

SHA256
6bd785592958fc2d19937df4c7d246edaa6d23ed357401b238a65e51efe9b899

SHA512
91d62c22ceaaf272991a9b3f3179c0cd73421fb15fddf9e02d7399cf66f11766c7abc34ce5f7384ad568a40ffe7a2266c66dd2636c2d65018864f08c1d66bd21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
8f63a3754d6764f15145c534a8a25086

SHA1
c074f31a55500ae9332b2827e44d0caba23dd972

SHA256
a2259442b98295415b00435fc0170cccd9b7c7e4dfa65e14b7f6a5d46aa7a1e4

SHA512
aa4a0cb0b18f3d23bc1b539376a5604edc482cb8c0491fc40d8205e88867e8300348aa783b229949a92197f2627f85614bbf867b651d8afa31cc53dc4b168a0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ff0de286e39e0e9d813ed43c33ddeaf8

SHA1
7f48c197014ebe2a3885b4e0f8b02293e198b225

SHA256
68d916e3b6240b67c49bc9e643ad71ff3deb501fa6cd95176ccfd9bc9ad6eaf3

SHA512
00221885b3614a5dc3bdb876b62667a8868399edc9599ac95575836302b05c9e6fc85ea06db53f8816d392162a580be9897ce393f1913dcf41f6621d6a7b4a6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c199fcf91989bb57101aad76bd50a507

SHA1
6403b90adb5f6757cbb6c8a1884fe9a6a7c9f79c

SHA256
5a20831eab9d2b35a0e5a095bbbc50b5ba0fd90f59c13b16a78da3f739092918

SHA512
f724732e4b97bcf949d7e7ee0db0d2664f01ca5cbe4fc25c4f5941f5750f90ea4c4a0de3eac2e9f2720ebb1490fc2bf1ced239fffa636d10e8f92018c4553a93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
eb492275cf4aa8813a12b61dcffa1ba0

SHA1
a5b6b9860a6980a09aa6a3a19b00b6959f0da8b1

SHA256
e3e493e4284c3588a3688e6c47d4bf7baee18eef20f281558d1d6cca3e58fd0d

SHA512
4f5464b8791f73b70b6d16d129582f5227a4970046ee59026166e05c10b3fc319ca92cef912e8a3080a176d735475e9e50d0f952a497dbeacff1c08476e58092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
53d0643b02fcac2fd9a52dd679ee0343

SHA1
94f6bd3a1ba54aefe1d2fc564023d56387b599c1

SHA256
aa942cffd57fc9c7ffcbac933e0813bcc3810adf81b26380d8b3f6665c969832

SHA512
1662aaaf124082c3971c003d22117bbc6b025ea9afae4b81450c8c5cd88f522b1ffe0454be695639f61f802054faa51dd22e4dce8df9b5a93730ac8abcec2c24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
fe3e95fd15b7b868ed7e6edd9f616002

SHA1
c73016df84552c7b89af932972896805327f248c

SHA256
634b817d2d3b2d738dbbf6dd45412df42d6997391c7e19a93d3057768e57a5bf

SHA512
0c515d068c1f00f417fb74941c479b93d4ee626cc1087e0f0ba9d044bf36d79959afaa5c59d5bc169c98a9f945554fe7ec4539dae92ffe581f4374d62280454b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
8c692b5f96d3d8199029f9afa0634f05

SHA1
9ecfdcbe20172ea6df4f82f6dab7c0d42471869b

SHA256
2905e6c5b127c90c1e99633a4f9fe64c4e0aa98ff36d0b7b06f3b5d82dc45e3e

SHA512
9a2afb4b649c0378dc10c7444cebbf0fc8c0011073a20040ccd9b8afc8f6655e5ac1e3504f91dc11181612c6e631bfe2ad4e31589475bae448b08ad088993d05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
d7905b877939d751dc8fd3747b0d9cbe

SHA1
b18d248f03e1b18d658641f99d7e649dabf30463

SHA256
957b0fa9ff174accff21a3ac21b1e1546e4596c925c5f5f2ce76e184a70858b3

SHA512
cad66d538556cc108f0c25c156ea8ecc654de885b9546c42fb465f0a5cb4952489a3eeabe5b54a2cebf532253ed26b8584a7311f78aa6a027946f117f5589a98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
830bb1c7668320c195136c0815e18a5a

SHA1
73f9735451d9c48cba9d69b5e18d5950e2a76418

SHA256
54e852b19f5e568fe5afa2d7cd546ab059e2325b7c9b461e53b8237849b7b582

SHA512
ee3158c1a9ded432d44a905bd5f4169a9353aa5ea7dc056045216ab5efe1960978446208fb7b5e716f173b5adaa1cfdb6bc6eafd1b179a0e46900e8b31cf099c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1d843fdc6de38f06865a645f5e37066c

SHA1
0fd087a437fcb32dda9754a1736c930abbba9bff

SHA256
e640c90d9ba895607e5759dda802590a23507863867c3f3a5d5c80b310ca5d56

SHA512
5d009b17051337e1b301bfdc91b3fe4e081e01c333f65846678e883c712adfcbbd4127ef75e5536be64435b9e2b0f05d2d9e89c058c3a94b237bbe87c4c78f41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
06b6ad17fda931c7c32dfe38d6eb3827

SHA1
f645fd2fffd1d66081f35553942980a5f9f7b374

SHA256
d02aa533149c68012b528ca933d2c363e21d6ed080b1485df7b74d36eafabf6b

SHA512
84d34c4775cbc635c49f932df974318d7c31d5aa4642cd4adcba5a620e7cd88c3fad01a40b45b905c55b77ccd29b3f4ea69b9aa41fc0e2e49a69b21f430bf108

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f9413bf3aa9b952aa6493f7b4d78dd09

SHA1
6ada8d00f0bffd1417570e0b5d1b49a29d178b49

SHA256
551b202a6959838a740763c04c974f6030bf5e80b01c225d8ebb62a412fe04c2

SHA512
3b3e9ed92235024d2fe06dd878a917f1a30deb2ec69691fa5b94f0d4ef25be7ad087d7cccb70f932720eab73a42fbe5539a7e9f3f9c104695d62423ce63ba11e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7e2bb21cb1ac651892b9837225a259a6

SHA1
3f07475106b769119811f4a152e49c64bd7e7d84

SHA256
44e7e8bef7f179a625d0ee04a62f2dfbbab09e4600b18f10ab2310683ff9f8dd

SHA512
6b4be79c9466088e739b9c7c4abaa25b13bc67406f97fe6e8fa579549dfbc909eabea7f48fccef4f035a4356324e213001b8f2eac6d216711e54b02388105a05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fd904b9fc277136d5c512ba9454b8b5a

SHA1
38c31108c7af206690ed7fd1ae5a0ed4bbd2e5fc

SHA256
f7ea3349ad0cd99c3eea5663806e3d4598727bba6a61c260ba5914051a609d13

SHA512
034e52aa4b5c3e1c919e932da6c0bd9e98d74e1fdc3fea4eb4fcc5d637ee9404ad953ac4367d75deb2e9c2d14b6112878b03bdac377705a08aca68a3c7f9b290

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3844dbe58a10764f73e85c3386fadb25

SHA1
e6184a56907ab1b66383fe4c55492f53f5878f9b

SHA256
895849bcf34a9340473db60c183733d72d2b0e48320eafc73e94be78cafde2bd

SHA512
5d5770d90d0d4e9824716709a7f676b1da9d620270880d56eabd005af0ffae3900be2bd4c289ca173ae94714231fd4aa99f95a1b029b1f797e836e692b5e796b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
208d557c9b30bd4e65396109a4b9d27d

SHA1
d86ea57272cf4d935cc7a2567e37044a65e3a0e0

SHA256
13ad3dc312c597408e876e541ba8716dc24b3287588cc050533d2ae889303382

SHA512
3c0f309d85c3a17d5361b78188d2b3bc2761b550c9f2d3c7be06ee44cb36bd679deb649a503b5c3070255d45d44ffb3ddede64bf679f8555b87eda8f1775c406

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
bb3dcd3036fee20300bba2c0f21fda2a

SHA1
9779ab73e01f29da96532fa0db06be79284bcd0a

SHA256
826e6604d66e64a4ea8ad6b3d303cc79dd803a83e35dd92ef23b6ce7685e89f4

SHA512
ab2a2a02bae11d198f2427853ed744fd22915ef03856436c14892e984fd066095736d76b5f3d6037f66a7dde0eccf9edbed1a0d5e8694d40a5f5f3ba5dbc8296

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
9729fba54628c9e6502647ec1f82d054

SHA1
ff0743821f2f18e9fe4f53597dfb9a2be33e61da

SHA256
52f012bc4586d037da60ecf465b42c13ef3ecc89fd4bbc5dd6b8fac558ae1d63

SHA512
ff3a44fabc5ba3ab8bbac47c0f79c4e73b36261b3d0aa52a2d69d41e899900bda1f7e7178cfe864918f81546fc641e70fa300897ca91bdcf4809fdf77153155d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
70b4a6d9e81e3b7e2d84790e19e18082

SHA1
f2b3a0010671beca150ee7e42e2b3ba7c470513f

SHA256
fb8d0cf5182a942a4259acf4afd67911451204a3d7944e66265054fe2a8e7053

SHA512
9e1f1cb4434d0b26919a1644712cf82aaba3d75ae69b18a94ea51732130b997e7e661157ef963cee66182f8fa55bfadff9e9caec14d926242fe6f7c8684809f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f2c943aec88ffda6e12715d21056e5df

SHA1
9a8e421e7d5bbbe11780bef3c0d2a25532dadef6

SHA256
6d259770cf18c7aa927224220de98a803872e66662a148b5daa4205a7c8686cf

SHA512
1b97476d01fe095ec7e80eafa3b22a0f4f958512f7c3e8faa2b95973ba05785ae24dbadcac53295edf032a1c5af0c7b79b44079b149c3d6f0824ab44389646e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e778e17d2035992b57109c2d36b9b56a

SHA1
73829a0122fcdec02bcfc0c0dbc9497a53970f14

SHA256
377338fa8226317113c0b6f0cde6aea4815a143987ef52a9af15c001ff879860

SHA512
7434b6a004c6d780515c637c6835fa4203839b9b206668d9fe6ca54374a9c3524d93d47e01bb190b4efc0085c5ffc4b1bc9cc61670f416636b3927bed0d8f9fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
201da3aa335769314e43a0ff4c27fd71

SHA1
83e4fdb8c65272c63b4380b52f3bd47a697a58c1

SHA256
06745ae5bcd3535e2b0b64e968f488475892c374de4ca510138df97c5804d9f4

SHA512
76b4b0b8f4132ba31512992cefa600170f6d7bf77eace715dccdeef4db0df7c0bc01fd614a44ac3101c7197ad4813dfb095c142104972f310826ecd7ba36dc6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f0dc312218a80996450b620de8b981fb

SHA1
286f02d2391c787964bdd827676f732dccdfe84f

SHA256
bc3fd3a3e4a4c2090457fcc9131fa010dbbdb40ee018b9252aa90104b30f28c7

SHA512
ef026553e5007f0aba94c02b62205d7e94b649b52b6880cdae478ea3952ce8d3947d97a18916b3ca5e667e0c08f90dce34f2f34ad56044260d3a787110a9312a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
9d595462e2bcc56895f877d71997c3ff

SHA1
637c99b755d3450e4b2548060ed813ffdb06a677

SHA256
112c591d629928563dd73a51d1b09cbffdb88ee95d1d1b803391a9a7d0241e3e

SHA512
79d683ab4f7b3e4b50e882b0efb2bc2aef98c919f88d297bda08541e5a6df53f18cb1bf91419341c74a4020a2d06d83c6c3ee938bc391742cab0346830897adb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c4b96c8e825fa154c50e76ecec49fda5

SHA1
9df621f287454cf3cad0e61b023daff23e540a65

SHA256
bb4052074437efbd8cb72f58fef48599676b08c4eb13b8d0309bd8d1c676196a

SHA512
d84c43627a9f62287813057b10741ead645dbd2e03b35853481a89e82c9bd4e3030b5a068a96559caeb9c92c03bd7eaa9b8120464fdfaea1760483dd2968c71f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b2fcfd157c866b49b85966d0dadab1dc

SHA1
b520d108b3a305998102d20af83457a4b5694973

SHA256
60de8ce1a0fcf8565e6ee6d1302810b6e697a2ae47c511fd5ca37bfcc8c643df

SHA512
81332d37b9262f7af53f0fc7d82be0f6b3bc3a5b219b0a3b168725bad3acb563a104397cbe9448e43001974de2994ecea1c0ebcdf5675d8cd681ac03c1eaecca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
874c4558c1663cbcfcf3ff69045d22ba

SHA1
abf719d36933555dacb75be80724e4f46790b07c

SHA256
6f41e94e2cbb5554b60f1cdbc3ea11c2c3a8ac6a65b9041550784b1a9483db2f

SHA512
83888461901fc088527efb673c5223d2c219408cae47411ae960bed4e1703772d1706848a897b07db5df9b2082f39677b90ae819cde312f2163ddeed5bddcbf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
eb118b81fd4bacc0cfd2c087968dc0c7

SHA1
b95d638e289a94785ebef5f919076bdfbb1cd8a4

SHA256
f3df51f1d504dbfe60e53e29f6f8f415c5a4480f0b5f4f74d82206abd262cf08

SHA512
383d2a79de3fa0f17118dfd0c7bad787e159693a4d05affe403e18b2cbf2db183c9ffe67cd30b39c61d11dc33d160224588528f9468400445fe7c8d4d911ea05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f874b7c0bb791a82ca983f00709730ed

SHA1
a380b9fc13756e8fcc5ec85574d70a91c0dfb649

SHA256
5b9ec394aa61dcfd2a45524810ea70f0f5b7d477904731d4f18f6f22ab019e01

SHA512
2589ffacdbab6349f1c6a320578c1eee603332c57add88c217b5c68919b3b73752ce8f1e791c91f99f1cd013a640c7dbca63184a41a6a1fa21c70eb8c644a945

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
da265a40ea80e3c5ee0c70a921d0ee54

SHA1
579936461b11fc34eda53903d434a0b8a65243ef

SHA256
9c93ca4f52285ff56e2064fbd38f1aba30e274583a0ea391cd2ebd4da61af986

SHA512
5d5c0ffdae76de8129f6b011dad26ba7d7e03e9eca558bbf44160f4a5020dda415915f88330fe20f0432d9d5a73e727f7389de30ae2cdb1bad7b0e2972497bbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
536a9011dd6b1d30be8c257ac4125d4e

SHA1
7e3a945ac7f0871ec780d0ba48c4108e8c9f1bc7

SHA256
6b1f39336668b8638ef6ba3557f4e180c460d85db372947f8ee7f7f8f28b1dc7

SHA512
39f25e2433cb7621183fe04c8db29a4f36d28b178ca82860fdb41a17f6b94f4ff69fcf318fd978e5415116a30ae32fc46b526335fb24d90237061f65ed098695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
ae9bf76cfc9346ff8def1951e5581b4f

SHA1
3b922cec35b8434d59a045580fe5d53ab7fbcce4

SHA256
48f3fae81069d693f69daec7064739c1d7265ea2dffc472c8c1e61ce16bc9128

SHA512
163c03003bab4fb718bebf80dd22f730d7f3c143117331bb325bb34a0d9f985b20851e648bfbcfd0c2ce07a8d30f79215132238bd48abb998679ce881c833221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a3bf1d1af91920fdaa49fa6a19bc7a3d

SHA1
bfb5fca67e390fc6672a5b39591a69e6c98d4ed4

SHA256
9f92630aabaacce5d6a4650358c85bbd2727536f8df9b740079a3ffaec9fd0be

SHA512
3534196974c7e191143d3b6faf93226fc76201497d31c6d1e9cd9d4225f7fddc0c7fd4b38330ddd7183258c1ecdba889f7755ea2b9beb45755c4841846388ddf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
9a4ae621348ec2bd92977a1e07cadc57

SHA1
17d61fb25110e072bb91eb4d0a6ff3a44d3a7c87

SHA256
090cfc95937ec2eb25e271095a30987c96d8cc05d18f3554902aabab63ff065d

SHA512
841835883e87ea3e7d685bc20b0d27147996ec9321e0694545fbc96f640ba6360391272823cac5400349c01d1d5f4cebc1f7c2f6a7934f29cd006570fcefee28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
76796bb7a52a4de1b0b79e476d42f828

SHA1
217778b2c5b5e23f7d1465803517bf42b8266428

SHA256
1aff04858f4eb01d376b0e112c57b5b35f51b57072bb1a87490a0b0829db8db1

SHA512
6080954a9e2dbac09bda20d7b6f64cba4692a498055db27b7b1fde485ba6c73d9ceee6119cd9afc610cae2d1524a7d3b7f7da595ff97a05e851167fe8e52da6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
4d43cce24cdd3520e895afc78cd7ae03

SHA1
f7cf2b3a341f0ce72ff371bf961059f02a5b979d

SHA256
f9e65fddf4291914bc23626bd4f265082c9e9bc7d106e990943929965e019008

SHA512
c12c40f133c592399ce5fa0d6bf0bea5e2c33b806420b5a97a2ecb285b84ede96b67069e3e8dcd3ab2af57d41ca757e1592124a05445f57298da15c0ce3cf5cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
a0fd600931d13de15a774a399f87b3a3

SHA1
d6660131732f23c0f22d87a15eacda017dd93a41

SHA256
65c1407a4b4e43f28d408f37ca656ee765cd3ed3250c34ae70e5e929fbbe38fe

SHA512
0299998c8faf9b5f4ebf14ee644f4847d9c62a3f75fc34fcb2bc9828596062afa6f27b783832548b037137f49478be3e51bdcbf683ba4012bc5f423dfde92c87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f47e1d1588d492f3df93f642905801b1

SHA1
5fa0c33a94604687742d909b99d3d31edafd8d2b

SHA256
bc3af7934ccac494173fd1bdb92fd03c41658e204d8089f256fb6f0243fb17a6

SHA512
5b610d19cce76f9183c153e7d400e43d0ce903b7225a394ded8393a198305ecd3c00fe1962e66a6caa96b829f63e20ba15ff65bbbd027e2515d173212a443b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1d09dcbe8a21abd1a2b5b6838d72c681

SHA1
d6b7534cff369d382c18242b03c64404c027f115

SHA256
e864932d7c80ce7adc70b0ba6c5d113feec8acc2fbdbd641097e298e36d4a121

SHA512
f2bdbb055677c1d93e7e3327badf92290e76a090e17f3098a36bc94d7dcb347375c7eccfc68af5b3290eb494837fe8761049d1659a2a331f77e8f7782b1349b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
280bce0da8a375dbb638c77ef327c40a

SHA1
97c37b1c033b01272145e495869f9840f024d27f

SHA256
6e252a0218931ef3ced0adcfaf40e110857b44e97c9975c6a90bb053ce048b26

SHA512
040aeb6fdf2171083b7f04bd8fa37b9dd9848583faf9fc9c4ef6c7f48b4fb421fd3c5fe0ece2b04912a2e93941a9e2f4e6d852fc15f994bfafac40a619aaedc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
4dd87bcc6ae07be5a12aa052c5b9b811

SHA1
4323217b16a3b996f86d0cc621ac8f7d9661ee38

SHA256
d8c9a852bf828be78e6ca1e374f24fccce106bb12d3c981cdc9038fe7b08e0f1

SHA512
63d5c515e2f1ebda38e0a83855ea7fc7cdc9c81be856669a4d8ec9aa0f28402dbcc2e5101262d1aa9778d0ab592b9fb6c91d774482ebe05c325b6afbcdc27045

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
4185f4e2ee28f60162f165efd8469e39

SHA1
5b06d08a023fd45984f241cf24ebbbd2bfd5f408

SHA256
436462f8b9271bd3b39bd7ec4f232ac3bbbdff1f002999de234617b067dc2051

SHA512
ccc5c77d4ea63bd2f5d914947f846c979cace84e3a1f05de989fe5c239251954ccd2c7687d2f42dd3c6b018e5c9ad01218f7dca7fd5e31f87468fdc50a3e66ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
4b4610816d04258e57a2f7ccc6acf726

SHA1
b6f440601c92f30297cd00e650e1e1cf18d98e9a

SHA256
8116350bcafdee3f438df4d2fa980803e186eefef81ca2318eb8ae0ef4517075

SHA512
362a4d3a6e790d6f89e4e21fb787a4e87d60cdff4f11a36fd51b4ef40b7fef2ab6604ad62c927b6f91ce4765ee73c0fd505bc54287bce588767938071250ab07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8210aae20dfc2c160ddb283545841efa

SHA1
ad866193afd9fb063522c3428b9a73d03f43e6b9

SHA256
c0ead1a67d5637557df7d475cf115c3e202c8a1643e4d6a239ec873ee2b416eb

SHA512
f2d2ee43fe685b74813231fe076a3ef2eed98e4f3944d9e0e205daef728394f08f343d08ab1a619ce4211b6a9b112c475f3cea3b22f7059ef554a3963eadf0bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e0dc8ee719decec4c6f3958d5ca26c39

SHA1
34a522695a83589af3e84c68f71e8fee55327f77

SHA256
a31344010d44030f0a4042f5f68166291f166d94d59c6663fa80b625cde13160

SHA512
6408508ac745123cee0d9a40b5f09b8565752dc1feedd308488b9444ac7cc82629a8a1bafef677b3fd6e0b5e578f60cff521af70f17be0fb7a089b1f547aab44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
7c9562a5b4c8bcfd4e355af999f2443d

SHA1
6dd231b060f544c28fba9efa9fe178a9eddfadb9

SHA256
91109450fa8fed1ec45948ffab33d3407a4c571c24eeadfd56a45cb8b9db2eb5

SHA512
8fbc37092220f85750fec8845116f78bfd5254d6a34462c8d9110de379209cff62ab2ae17444b50d72d331f102347a4d596d3ee52afe3956e313ed803cbbb1db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
af0a3ab945058d2a1c2e208b8a96aef6

SHA1
829deb6425fbcf18b2dc576314ed521a61e02f11

SHA256
9117377a84e0209a560d5c896ec29dd8049e6221711379c31384757fa7f05946

SHA512
4ef3c117b0a067bf70d432a78c0c162d324f5236ebcae45a2a1a4f9d44f42e6e50bd6ef2f64e5d28a3bdbcbac454c9b50ce1982a614008be8b515ec4b8dfc81f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
4ff6528fe99469d72b97b0b1b4b6d857

SHA1
20fb4252382be897bedffff6428db4793d887154

SHA256
133620f1522c97a303f6ec3d7657839e594d915e9363ae5f1ade17936592b47f

SHA512
004732f0506b0dff535ee7893857b2b8c8044765e679000ec83e002507205901fcae21e3d26339d1d21c132d6d8a3d3b21c93f5fa8bc0f9765abb0d17df40584

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1c825908d040e9642f4f12a03006c842

SHA1
5a9f13d5225a6a34ad2406a4280141802e6f9cac

SHA256
ab8da138610dc12be072ee0476e23f3666ad9e9168dfacc171c3a12b984d340b

SHA512
7de1f5bb7cce620698be3c7279c758a41ca1e68502a2e1c5702dc6efc5d72ef35a184956e5435e426436a25559e8d740847c893d76dabd3b393b3439172ca8e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2687081d107ad1ae975564a8a5d95b67

SHA1
1c9d43ebfa7288b6e7167c8be29d8b9f886dc9b2

SHA256
e88fc19f21d307182390840f2cb3148be1b0288222757ec3c21a6d41dc71aadc

SHA512
66a351f96176de8d42ac6f7d0e80240864590e346f31d310c31c617d87326aead05696a246a32feec7ab12314891674961281285c5a2300b09c7addcce64f423

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
efd4549e7bb2c5c7d3e531559f08114d

SHA1
33cc52cb5f515cc1915de42d1d8a8481d61bab59

SHA256
ef482174801a9acfa69d975b003b8617207d8755834bb8a59183fd3f7a1a54eb

SHA512
712fa83f3e8c0c0403842aeff919b551d66e133b2672291c3d92da8579c911d7f080f5138ed8ef30f32f6081a26fa34c9fa9d855d624057595de20be6f17450e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a1a64952a2089dface1d57ae70462b74

SHA1
1ab561a0e16b92937af8a59b81bc7ea0b0c76f95

SHA256
a66ef87f9c51de990dec4c4df4a8a892414fa9fa86064e075aa18aead6e41351

SHA512
53b03c199d284df3ad87168aa319a7a96a38ce3b5ab54792daed6fad25955be6cef136d6b9a4f89b6464a3570ecc85b7e36e64ad29ee330d07a3a53b46538ac6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
582a3bf70a542a499d46b0a780ebbeee

SHA1
5281981b6bad55d26aba8e242b6709776e12dcc5

SHA256
30fcb7375ba8f6e9a5c9b2a63f69db50e928a9b293ec2f57295801a0d2f31ed3

SHA512
3e1341b4e58a4fe3aa500c62590f3dd44a3a48ab3890292c62350f50b4e06e826c875492399a78eab8fbee20885d368d9664be96e434d0aa0d35b2fd8986aa9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1e2d53dd2e3bdfa584fc3ee69e024952

SHA1
6a6d488c955ccebdf05c71b41ceceb4915d627b3

SHA256
90fa923518feca63a7660e57b696d3f1fbc3005499e2c42f39ede51a0f2aecc8

SHA512
7a55ea9a96d80c0414691358350e375813e48995bedc11b0b49c6ab0aa1a39af337e011f417d32dd8eabd165626c7c6e148c313c00ed48f6108ab7287244ec19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
dc17763931f8c7e51ab8e9f878567b9f

SHA1
fb54ed34f9719a3fd5214ca0398a7a9fd501c62a

SHA256
f053e1c5a380b6725569bc5597e6101cece7bbc5c7c66fd950a1f0ac60ac6b87

SHA512
89ff1fa8355b78f29c5a6c2e4911de7a2f09e9df748c6baeb1a3f5cf09dc9fae5b687af0905370c227ccff80b188615f4f937c12bd93cd30fdd3c8e090ae4695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c81236cafaa0a10018841f0e34190f77

SHA1
50438e7c236281cc0777f3a9d909c66245b14084

SHA256
34baa1f0bb5a1685db39684a788438278e09b2ae3039b80c2bb0b8704012b526

SHA512
1ee9a2683d3c9869a7d3fe9fe6f807bb43a053ecf497714f9d33e6b9e4320a99af315289b6e117518da007c889ab770bea7e62f13899041183f3cc01b62f0703

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c03a68e8ee9d4cd7f36a97631215124a

SHA1
6cd73136eaebf689ce248bf69caadda0642c5a15

SHA256
2b66bda16a12aec9fd8533c972742fa3980ba679a4685d2c9fbb169f3ec26f67

SHA512
09fc61e6497404ba128e4a8789a0c314840b9242ad7639c3d436374d0f73af119faf69f9fa9c14c23d8273edc979c8b8b98be3b265284acebeb12354434545c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
14802da522c8203387f91cff8961a08a

SHA1
6b9f89d882dc1faea1675efb6120260e9a595e16

SHA256
d2881595579278c3b156ebc92e16e3225d589e760d9f0a10aab5a7ac0f32ccc7

SHA512
bb0be6fe70816f27bb0fa702be22a9ba61c1020d3ba6b3c1a0e67b8a07f142c9274fd177bc872335c032962e71d60a2b869d149cc045a264ef8954d98fc4e95a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6350b832cde904bc20e3639d1af69a99

SHA1
93cb3d1e527f3e8bee00d52497bb9e16a23b5c5a

SHA256
8a4b42c91cb812d04ccb40cf32b6d56d905b2bb8d96a292107a9957b9f743eab

SHA512
7e4ae8d475df81d48341ee780a6c8a9821d178a90832fb2aca35e2dd0cfcb684d5041842b94ae97c5e20be175c94170ab653fe188f4527c7fda1bb12df856671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8b9bcdc4f77315befeab39af03bc0657

SHA1
bcfb9441dd845992842e0038905ea539247de4d0

SHA256
45224ff4a682867174b75fcde526d4a5bdc0c67c9a61c0fc5cc7f12fd9fcbd82

SHA512
89c19bd7cac43cb94b7a447bcc437fa15ed225f5f19bee8c417bf07430d2ecd1b7a24cdd83dc47a17b68ec66eba1a8c173fd0c9a82a6ac8f86a3a18ac454ccfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
39a023a754a75b100212c823f5ca7432

SHA1
b33e84ef4923ff18fd2752efc0cccded9b7b93ed

SHA256
3fb934730936673591b00154285cdc6356c0e036174e68613cf99caa0894eb56

SHA512
782cf28b3a450740236c4837c70273ed6e4adc03772cfced69c2e7bb52f1df7a68be381f50b23f583161661a09af5b2e845bdbdf5ebe26ac0b2ca2a786a862c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
25b0e34e962df2a573ad03cefcc1f7e2

SHA1
22190d596b94dd031bbf358d2c20a5d62d0f34b1

SHA256
7c51c52bfa71278e7f8da953efc75167adeee25f5c4b8f7ef0091eb4025a09ac

SHA512
37ad72140660de274bb4d0f05c3dffa72ff84eab633a522c5481db0bee11382cb150b858ef83178fd6859491769d70aca3ed5ffc417fad32463c69e4293a34d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
075b895db7a49069d9c72473e4e0eeb9

SHA1
5af335d95ef9360ee7a0f50267a9b3493046e28b

SHA256
1c060f0c4767b5d477d58f4c313bd2d604d4d3afb42b4fbbcd3dad48f1a40ee2

SHA512
93ebeafa0875c303f9a4af5057047d780dc8d4586bccf5faa0e1218df5526aa7b9932ba43e3579629776b97b240b3fc6c4c05704b8de7d5045a80061eb13b8aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5d660aae672d808e1e3a76b13a8bdf54

SHA1
a865970e4409b45a411c739dc92c50f7871ec9d1

SHA256
959f37ae671ede1d90cac2977f40abc9939bab448ccd4e248f3af7d41d0c9ef7

SHA512
399937f8288c77ebe650764a5f6813febaa6ce223955d07a2847fc04db8d0ccbb5167285133eaf6d91574d3416b2b6110c3cd776f72297b2523faf91ead02278

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
83885600bd94f061e717fd035de5db13

SHA1
4a1c4bcba647ce91e02a958693fb1756b3fad016

SHA256
304af629740a14c09fa5ece7f9a7ee3080ac24b93626f4fb72dbe32ac222059d

SHA512
a511f5132775e13eca2aa557a55ef6dd477edd790bb1b01156f86811c1e9e4117ea2c113c3de9581caf1221ed418c8bb6a07e08a62cbf851f51ceb3a30331acf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
4a30939151f80f299f0e7ed5014266af

SHA1
d79050b90f356dd38b667e169bca3acee4f9afe2

SHA256
f1674a0c09ef68fdaf1549fa57ad9cff7411a0f8f0334b2ebfb2b4f96321b577

SHA512
88960ea9d3bde32ea5118748f2543e295b8c51a03f14248da5246edfc2ad0eac4f6d63adb304a825355e985f2846e117340d2836ea63fbad11ff341a572885a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
66bced2f508b71c25413052a6e2c2ec0

SHA1
37a2e6f11d1c4efcaadbdeef9dab1ba677415d5f

SHA256
3cdd8740deccad186c4438aae53300d4154cba6ffcefd6a41ebff15bad44b68a

SHA512
6247c4936975f4684a9f829f3ae43538e6afaf62c6dd1e837b66aad19eabbf22fc1b276d53642b424efe7dd260eeb90b0168af6fe63b1ad10e29b5716fc1afe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5224e7a1c8b7b112f9a0801a2ff13eec

SHA1
6111a107f5032b4ee6bce140f182430614ab524b

SHA256
0b1495a1abab4aec1a4dab85768c25867d5534211a6d74bb27a592bff8d0f691

SHA512
6febbf49da9951d520c8d5a74668ccc9ec52da36104dd6d5087e12710ace47993ca3f6b170b9bc9b4886c16b211a00305e86a45f029f57ba9011e9b4698763bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6540a71aca62ec7b70eb39a5e4684008

SHA1
ae86d8f6e385a45c56f29de10363e96927f6731c

SHA256
a45a9e07f28b0494b92517e5d38d2a60d09f9ee3512652058404d97bc1709a9f

SHA512
8d0176c1b7c1184371ed10c635eac76c21dbf4fdf168de4517366a2ec66451971ca92bf621abe421b09b16110d57f496c32f823227c2d633b66e6f57b3f4a0d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
824cf59e1e9a1a53ce0b29c799d070ab

SHA1
ecab92ef24bdc16c25100d7a6ccca6bac34996e8

SHA256
201f45f16e278a893029779add5bdeaa286b0c180fe2f1d9068e35837772781f

SHA512
91691bf04e84dac89e5308d289e0d11d8a6f7cbbe12728107f9d7d8b2728dc3b2e89540180ff0c900b02a58338a9d095aef4f14358eaa60823a18fa48fbf539f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
18a8119d3fec864572686cfb410eeeda

SHA1
b24811b69b30a72bbb23c5f147b4100df171df30

SHA256
a96176133c60ffe5bc50fd4a5a0ad28db532f4efb2455f80cf0d054e8771597e

SHA512
037fcdfedc76087829852fa13622eb1a24dce7c716fdc50f81335561ac62796b8e2c1b417ce4b336bbbc46b4701b898d5b4ee0bae393c7f872054f74bd303771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c9a7f0937ea2dc2df1b706075363ae93

SHA1
45cf3f2cb858d72e0ca46e64c9dd0a8500a78588

SHA256
e1855a183ce57151e1119d0522bdb6bfe75e720665f09cc7a0956ad7e8915a34

SHA512
92bb6a2fa376ad8541e7f8818dd99b71752b2fb08a98377a6c277d920bc0060e8038230a8608683c7b48eaecea8913f7ffc227ed53ca384cc0165766a8e96294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d10b520d716b2a8bca416422ed8e8a40

SHA1
30916679d020ced8a1b5874ff47e84640e7a681d

SHA256
017c7c191c2b77c16b4148949f257fdf2084c44379b175b412ebb027d2258d16

SHA512
b7cffa5eb50d696be6c31985b738afa0c32a16588f119b47d99cf436135199757d9616eaa6e9a9f8114e614c4903f63715272604047605d750a8f993ff788134

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0d693eda5c6a93216edf59e074b82b2c

SHA1
fb63feb572c8e7ff0b1fa581b6838aa15d89fdec

SHA256
584be504325bc98c521c44bd7e1a6e1903af4b1437cd25a283e2a707f1d05338

SHA512
05721c91d79026094c65aee986996ef6c41cc48164f04e33196e73e61e854a00a5f1c4b4dbe83e0c95d20914cdedefa06c082cca411eee6433b42288cae73ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c84cc8c210321dc73b7700477111645b

SHA1
114523789532def0bdec2cad32a4bc91f87f90e8

SHA256
4bff2738c3f37ac265b5617fa4b1e16a67649dc7355ff7bc35dc235f375c41ed

SHA512
b777235bc52883a66c7a95e01cf3df29571153970a09c9d83f9208f085a6fb0c9d82efe22281e930d40d0ef54dd15744f0962a627c368513ca37a5a44bbcc27a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0ef5ecc0db1bd3ba42ea1cf79b065045

SHA1
bbb2ad29f78bd8076c28b2470448ac3e8698ed4c

SHA256
b4fc119814e402110d15040d246b4d184068c94da4007ac92c39ba48d2fedb95

SHA512
4e3485327c42866e7f64fa216aa1ce0341bbfd351271b3fd672da36c444da8a88d4191cef8324fc00db87b5264cceb1671891ed15ead86afa11ac943eaff1d18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
cc70ceda1f00e0993e05ddbfad4e6e96

SHA1
d1eda3819827f9b0ff00fdb2c90381718d8b19c1

SHA256
79491681c464498b0d00f23ab97bed15e88f6b504c28c091a0d47e708696abc4

SHA512
bb0bc6c93e2701127bf28b0bccb5d4982f2e4543deafcdd7986c470fb95f5523345492a16fbd332c9bbe58d4e2dd13577607534ef02ac3250a32a448996334f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
c76d239f42f177d93ab15870e80defe9

SHA1
70129ebe12f4c966c7645af9dd50ddb218edd91e

SHA256
99f3fcb189c55b193a48abb8bb1179d492994d8e53e6bfa9eaccc1e89feb9d00

SHA512
d49f760f71552828a935db2bd9898bee5dcd3d6327c4130046a532b19c7e0fc4f8ad362fcbea37152cb935994719093318da836daa776c118bc887cbd38bf309

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4f09eefc418c08f275c2fa3f4b8d4dcf

Filesize
5.9MB

MD5
4f09eefc418c08f275c2fa3f4b8d4dcf

SHA1
1eabecb044e73dcfbf5326ab4fae00afdd22312e

SHA256
e9d623c447b1a1f3a279efbc835ce8e8ac396d85e3700b20c5c5ba6a0cdfab06

SHA512
d5515e3621ed19861eac2683b1409c0e34174920551058562dfa1fc009ec9973567a4109afe75577b960d42f1e876ea9cdcd09354c0d9ec48789767d534c6671

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
800ff6f1404d1f7b85de61341a1b3871

SHA1
859f718c0aca1464e62a44d2f03bcfcecb3a27b8

SHA256
75ea8dd6daa084f52ec5cd504418e40a234f5e06e84a5570300c63dc318d9842

SHA512
0367a4c46e14c9a11fa7749205f6790ef79a3071227302fc75e368cacd38b894828855c2c31ef9b0427707a817932ede31eed3272fa60653d36a2f5b47674266

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
dc02da0352ce576c376bdeca080c10c3

SHA1
3441dbed9fa08d88d98ce990febf509b5b598272

SHA256
c7adbe534d1102376ced31c0f4ff75d4ff7dc84ac675ae3a899b2930f6a8aa20

SHA512
c6316b3a9b3d95968fd29e9de1d0f812671ceccf3692644af20dc4890866f0e7883b4b6de23fe6638f1261bb20a899bfa54804c5284f4e8f2d87cfeb2fa273e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network Persistent State

Filesize
299B

MD5
cceaca5786ff47a8d9254984b3e71636

SHA1
cfe3e040fbb6f877d5c92012eae2da37d7192182

SHA256
a9ae93d3b34f94a6ba9b11f6ca7708ed84b0df05316b471c5632be19f1f3f739

SHA512
a9a377e54869350e3ca81911632b3c6f44f29a4e3fed82a75ab0977bcaf29b6f70c54b3aa46b6433e8454f2467ff2004642d2f0b77a74e37d55a6a9009a577d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network Persistent State~RFe623274.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences

Filesize
3KB

MD5
6cf034e12bfc19a1f127735e32e4b82c

SHA1
c055d06228ce10e89847bd680e6d5a59b0d0ced2

SHA256
10e6f34178139a23c2b476f391ef9e1a5466032655d914381dcfdc519939750b

SHA512
669ae256cb3628f43c82866422743ea38824cd47e95330d50dd50c193ec9bdeae13a71a25d84ba668a052ad36719d2fad388db5468b723968ee5c9f593305e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences

Filesize
3KB

MD5
604c195cc601d767ccf49ecdf40c5942

SHA1
2025a0d60d1ffd9c96faefad5b5f9445f59b1352

SHA256
cef2d07686409424c4aea28f17a7fcd36213674dc6beb2ce8b92ddfb697ce484

SHA512
20ea43328e2f742ceaa4cf570a6c2458925d2c24ccb79f391738007cbdbf87f050609963ae4944a74422791a9466d80b5771d35e9744873000305ea93cb4b781

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences~RFe621f4a.TMP

Filesize
3KB

MD5
07085047ceb559d428c16b2345422bc8

SHA1
52717ee69ef5c55b79df71ade1b407a02a81d44d

SHA256
9eaf92e6de196f76a05be8f3686db3d7ac7e5699bec749b18b189df2a977b0ee

SHA512
f0a357582c196b31933a39c1b92306393d9e38a6529179241b70e4f2ef2c140f2a6d54cabb983f76719a5a75fab416506167f53eb66a038c8d7c8c0cfc6c321c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State

Filesize
8KB

MD5
b0db7e6c2c7d36b00a8d544aacbf86ab

SHA1
12496837ae76c871466662c6420155d7559bad66

SHA256
a3b33921e5dd12e8ac0f07b051cab927b9e0ca69754a347dd336550807a43d58

SHA512
0db035b6256ca51193875d4dfdeb6d42ef67b6493c51b3d39658682ea087de1f9508d217ab9ddca0f12573def5d02b0bf2bfeed2ada698d310c09ebe29854e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State

Filesize
9KB

MD5
e22f2d6d18fee465e23dd6d44831424f

SHA1
7f86abcadb35caf77d0645125687342a4c6fae42

SHA256
c930bd30662dcedcc6f6bc9edc4dc4f6ae342a4bf21200da7f2e0a48196d9f94

SHA512
77a2cffc42a4a9688d0c5e55c9e360e116ab837e4063f1437786482c000974fa5f9a0012cf1ffa3b49780853cc5c32431f36f8cd1f89a625ae108e5552c6d781

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State~RFe61594b.TMP

Filesize
8KB

MD5
7c2c01567d73bd9ff13da31c2607090c

SHA1
91a2604f53cc6cdcd50eef8c014c21c3723244f8

SHA256
6f519e60c06810c5bf3e109975a27acd42f692f9735284f03e8664eaa70df350

SHA512
0df98f3128bf392dec854a78b9f12ddca28cec209e5baefefd4d67e6c3c35a2808401ed03794bf53140c4b7a3e9bba1e2fff54389b35b56329b4b3f62e495570

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Advertising

Filesize
24KB

MD5
131857baba78228374284295fcab3d66

SHA1
180e53e0f9f08745f28207d1f7b394455cf41543

SHA256
b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49

SHA512
c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Analytics

Filesize
4KB

MD5
da298eacf42b8fd3bf54b5030976159b

SHA1
a976f4f5e2d81f80dc0e8a10595190f35e9d324b

SHA256
3abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec

SHA512
5bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptions

Filesize
689B

MD5
108de320dc5348d3b6af1f06a4374407

SHA1
90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b

SHA256
5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53

SHA512
70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Content

Filesize
6KB

MD5
97ea4c3bfaadcb4b176e18f536d8b925

SHA1
61f2eae05bf91d437da7a46a85cbaa13d5a7c7af

SHA256
72ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554

SHA512
5a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Cryptomining

Filesize
1KB

MD5
16779f9f388a6dbefdcaa33c25db08f6

SHA1
d0bfd4788f04251f4f2ac42be198fb717e0046ae

SHA256
75ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639

SHA512
abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Entities

Filesize
68KB

MD5
571c13809cc4efaff6e0b650858b9744

SHA1
83e82a841f1565ad3c395cbc83cb5b0a1e83e132

SHA256
ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b

SHA512
93ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Fingerprinting

Filesize
1KB

MD5
b46196ad79c9ef6ddacc36b790350ca9

SHA1
3df9069231c232fe8571a4772eb832fbbe376c23

SHA256
a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3

SHA512
61d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Other

Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Social

Filesize
355B

MD5
4c817c4cb035841975c6738aa05742d9

SHA1
1d89da38b339cd9a1aadfc824ed8667018817d4e

SHA256
4358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6

SHA512
fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Advertising

Filesize
2KB

MD5
326ddffc1f869b14073a979c0a34d34d

SHA1
df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63

SHA256
d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb

SHA512
3822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Analytics

Filesize
432B

MD5
01f1f3c305218510ccd9aaa42aee9850

SHA1
fbf3e681409d9fb4d36cba1f865b5995de79118c

SHA256
62d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620

SHA512
e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Content

Filesize
48B

MD5
7b0b4a9aafc18cf64f4d4daf365d2d8d

SHA1
e9ed1ecbec6cccfefe00f9718c93db3d66851494

SHA256
0b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43

SHA512
a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Cryptomining

Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Entities

Filesize
42KB

MD5
f446eb7054a356d9e803420c8ec41256

SHA1
98a1606a2ba882106177307ae11ec76cfb1a07ee

SHA256
4dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640

SHA512
3cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Fingerprinting

Filesize
172B

MD5
3852430540e0356d1ba68f31be011533

SHA1
d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff

SHA256
f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054

SHA512
7a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Other

Filesize
91B

MD5
09cedaa60eab8c7d7644d81cf792fe76

SHA1
e68e199c88ea96fcb94b720f300f7098b65d1858

SHA256
c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975

SHA512
564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Social

Filesize
3KB

MD5
318801ce3611c0d25c65b809dd9b5b3c

SHA1
b9d07f2aa9da1d83180dc24459093e20fe9cf1d8

SHA256
2458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03

SHA512
7daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Staging

Filesize
16KB

MD5
39bdf35ac4557a2d2a4efdeeb038723e

SHA1
9703ca8af3432b851cb5054036de32f8ba7b083f

SHA256
04441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae

SHA512
732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.5MB

MD5
6399cb94a0d00b72ffb53432cb26c891

SHA1
d18c3616da0c6807771c0d7e501e811a9f2e7ded

SHA256
fec985e0648a7d41c434c8fed666139090f7bb5df85939da743a1f8859765811

SHA512
5f06f6e235c1e1c68255cf34fa22713ddd8a8667d9584ba316358c785801a0d9ca68a93ff2c2b20d55bca5c0502a2edaa2a06a8f45fec2292b880725f8ee5097

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
30abd09cfb1913746f4fcaae0927bfd8

SHA1
b07a21de40adc9a572259e8fbe4a973b584923a0

SHA256
4d7867b85e2ee5430144f7b0593bd0518a4c33654ab66f3f1a14c94eadd04725

SHA512
f3832ed74a879ef07c33a027986b9955480d825c2707f591ac87979dde9da95376945b7e41ef53266cffd588aa8c6b3b81dc390abba29b924798781053d38ca4

Download Submit
memory/1004-1929-0x00007FFCFC650000-0x00007FFCFC660000-memory.dmp

Filesize
64KB

Download
memory/1004-1921-0x00007FFCFDCD0000-0x00007FFCFDCF0000-memory.dmp

Filesize
128KB

Download
memory/1004-1932-0x00007FFCFC670000-0x00007FFCFC680000-memory.dmp

Filesize
64KB

Download
memory/1004-1931-0x00007FFCFC650000-0x00007FFCFC660000-memory.dmp

Filesize
64KB

Download
memory/1004-1905-0x00007FFCFEBC0000-0x00007FFCFEBD0000-memory.dmp

Filesize
64KB

Download
memory/1004-1928-0x00007FFCFC4A0000-0x00007FFCFC4B0000-memory.dmp

Filesize
64KB

Download
memory/1004-1927-0x00007FFCFC4A0000-0x00007FFCFC4B0000-memory.dmp

Filesize
64KB

Download
memory/1004-1926-0x00007FFCFC330000-0x00007FFCFC340000-memory.dmp

Filesize
64KB

Download
memory/1004-1925-0x00007FFCFC330000-0x00007FFCFC340000-memory.dmp

Filesize
64KB

Download
memory/1004-1919-0x00007FFCFDCD0000-0x00007FFCFDCF0000-memory.dmp

Filesize
128KB

Download
memory/1004-1918-0x00007FFCFDCB0000-0x00007FFCFDCC0000-memory.dmp

Filesize
64KB

Download
memory/1004-1917-0x00007FFCFDCB0000-0x00007FFCFDCC0000-memory.dmp

Filesize
64KB

Download
memory/1004-1916-0x00007FFCFDC20000-0x00007FFCFDC30000-memory.dmp

Filesize
64KB

Download
memory/1004-1922-0x00007FFCFDCD0000-0x00007FFCFDCF0000-memory.dmp

Filesize
128KB

Download
memory/1004-1915-0x00007FFCFDC20000-0x00007FFCFDC30000-memory.dmp

Filesize
64KB

Download
memory/1004-1908-0x00007FFCFECE0000-0x00007FFCFECF0000-memory.dmp

Filesize
64KB

Download
memory/1004-1907-0x00007FFCFECE0000-0x00007FFCFECF0000-memory.dmp

Filesize
64KB

Download
memory/1004-1906-0x00007FFCFEBC0000-0x00007FFCFEBD0000-memory.dmp

Filesize
64KB

Download
memory/1004-1935-0x00007FFCFD250000-0x00007FFCFD260000-memory.dmp

Filesize
64KB

Download
memory/1004-1943-0x00007FFCFD300000-0x00007FFCFD30D000-memory.dmp

Filesize
52KB

Download
memory/1004-1942-0x00007FFCFD300000-0x00007FFCFD30D000-memory.dmp

Filesize
52KB

Download
memory/1004-1946-0x00007FFCFCF20000-0x00007FFCFCF30000-memory.dmp

Filesize
64KB

Download
memory/1004-1945-0x00007FFCFCF20000-0x00007FFCFCF30000-memory.dmp

Filesize
64KB

Download
memory/1004-1944-0x00007FFCFCF20000-0x00007FFCFCF30000-memory.dmp

Filesize
64KB

Download
memory/1004-1941-0x00007FFCFD300000-0x00007FFCFD30D000-memory.dmp

Filesize
52KB

Download
memory/1004-1940-0x00007FFCFD300000-0x00007FFCFD30D000-memory.dmp

Filesize
52KB

Download
memory/1004-1939-0x00007FFCFD300000-0x00007FFCFD30D000-memory.dmp

Filesize
52KB

Download
memory/1004-1938-0x00007FFCFD2C0000-0x00007FFCFD2D0000-memory.dmp

Filesize
64KB

Download
memory/1004-1937-0x00007FFCFD2C0000-0x00007FFCFD2D0000-memory.dmp

Filesize
64KB

Download
memory/1004-1936-0x00007FFCFD250000-0x00007FFCFD260000-memory.dmp

Filesize
64KB

Download
memory/1004-1911-0x00007FFCFED30000-0x00007FFCFED60000-memory.dmp

Filesize
192KB

Download
memory/1004-1914-0x00007FFCFEDC0000-0x00007FFCFEDC9000-memory.dmp

Filesize
36KB

Download
memory/1004-1913-0x00007FFCFED30000-0x00007FFCFED60000-memory.dmp

Filesize
192KB

Download
memory/1004-1912-0x00007FFCFED30000-0x00007FFCFED60000-memory.dmp

Filesize
192KB

Download
memory/1004-1910-0x00007FFCFED30000-0x00007FFCFED60000-memory.dmp

Filesize
192KB

Download
memory/1004-1909-0x00007FFCFED30000-0x00007FFCFED60000-memory.dmp

Filesize
192KB

Download
memory/1004-1933-0x00007FFCFC670000-0x00007FFCFC680000-memory.dmp

Filesize
64KB

Download
memory/1004-1924-0x00007FFCFDDC0000-0x00007FFCFDDCC000-memory.dmp

Filesize
48KB

Download
memory/1004-1923-0x00007FFCFDCD0000-0x00007FFCFDCF0000-memory.dmp

Filesize
128KB

Download
memory/1004-1920-0x00007FFCFDCD0000-0x00007FFCFDCF0000-memory.dmp

Filesize
128KB

Download
memory/1004-1930-0x00007FFCFC650000-0x00007FFCFC660000-memory.dmp

Filesize
64KB

Download
memory/1004-1934-0x00007FFCFC670000-0x00007FFCFC680000-memory.dmp

Filesize
64KB

Download
memory/2612-1807-0x0000000073280000-0x0000000073490000-memory.dmp

Filesize
2.1MB

Download
memory/2612-1745-0x0000000073280000-0x0000000073490000-memory.dmp

Filesize
2.1MB

Download
memory/2612-1744-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/2612-1900-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/2676-33-0x00007FFCFD310000-0x00007FFCFD311000-memory.dmp

Filesize
4KB

Download
memory/4784-5-0x000002B5484B0000-0x000002B548DCE000-memory.dmp

Filesize
9.1MB

Download
memory/4784-2-0x000002B52FBA0000-0x000002B52FBE0000-memory.dmp

Filesize
256KB

Download
memory/4784-12-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-9-0x000002B52FBF0000-0x000002B52FBF8000-memory.dmp

Filesize
32KB

Download
memory/4784-10-0x000002B549F20000-0x000002B549F58000-memory.dmp

Filesize
224KB

Download
memory/4784-11-0x000002B548470000-0x000002B54847E000-memory.dmp

Filesize
56KB

Download
memory/4784-8-0x000002B548FC0000-0x000002B549034000-memory.dmp

Filesize
464KB

Download
memory/4784-7-0x000002B52E2C0000-0x000002B52E2CE000-memory.dmp

Filesize
56KB

Download
memory/4784-6-0x000002B549080000-0x000002B54913A000-memory.dmp

Filesize
744KB

Download
memory/4784-22-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-4-0x000002B5483D0000-0x000002B548420000-memory.dmp

Filesize
320KB

Download
memory/4784-88-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-1-0x000002B52D4D0000-0x000002B52DD96000-memory.dmp

Filesize
8.8MB

Download
memory/4784-13-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-21-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-3-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-99-0x000002B54F910000-0x000002B54FE38000-memory.dmp

Filesize
5.2MB

Download
memory/4784-0-0x00007FFCDDD73000-0x00007FFCDDD75000-memory.dmp

Filesize
8KB

Download
memory/4784-117-0x00007FFCDDD73000-0x00007FFCDDD75000-memory.dmp

Filesize
8KB

Download
memory/4784-163-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-162-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-152-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-149-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download
memory/4784-148-0x00007FFCDDD70000-0x00007FFCDE832000-memory.dmp

Filesize
10.8MB

Download