0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855

Analysis

max time kernel
187s
max time network
190s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-08-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxPlayerInstaller.exe
Size

4.5MB
MD5

c9c89a5180728704d9fc8b10fcfa5124
SHA1

6eb7edac4c879645641394eb20db3cf707019b47
SHA256

0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855
SHA512

98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220
SSDEEP

98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt

Score

6^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5856	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Sigma\Other	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\button_zoom_default_right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\FaceCaptureUI\button_control_record.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_salt_2022.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Help\EscapeIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\CompositorDebugger\next.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioUIEditor\icon_rotate8.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\ic-game.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\de.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\backspace.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\AvatarExperience\CenterPoint.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\as.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\compositing\CompositShirtTemplate.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AssetImport\btn_dark_showworkspace_28x28.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioSharedUI\close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\DpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\icon_whitetriangle_down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\TitilliumWeb-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\xboxLB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\MenuBar\icon_menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\PivotEditor\HoveredPivot.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MaterialManager\Texture_None.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VR\hoverPopupMid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\itemcardbkg_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\icon_keyIndicator_selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MaterialGenerator\Materials\CrackedLava.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mtrl_basalt.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\MicLight\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ViewSelector\bottom_zh_cn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\models\ViewSelector\Corner.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\button_control_play.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\RoactStudioWidgets\toggle_on_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\SpeakerLight\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\DeveloperFramework\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\FaceControlsEditor\face_frontView.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Radial\BottomRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\ExternalSite\roblox.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Sigma\Analytics	setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe

Executes dropped EXE 16 IoCs

pid	Process
4980	MicrosoftEdgeWebview2Setup.exe
1928	MicrosoftEdgeUpdate.exe
1224	MicrosoftEdgeUpdate.exe
2920	MicrosoftEdgeUpdate.exe
4740	MicrosoftEdgeUpdateComRegisterShell64.exe
776	MicrosoftEdgeUpdateComRegisterShell64.exe
1496	MicrosoftEdgeUpdateComRegisterShell64.exe
4696	MicrosoftEdgeUpdate.exe
4840	MicrosoftEdgeUpdate.exe
4292	MicrosoftEdgeUpdate.exe
2476	MicrosoftEdgeUpdate.exe
2804	MicrosoftEdge_X64_127.0.2651.86.exe
1224	setup.exe
5012	setup.exe
5784	MicrosoftEdgeUpdate.exe
5856	RobloxPlayerBeta.exe

Loads dropped DLL 17 IoCs

pid	Process
1928	MicrosoftEdgeUpdate.exe
1224	MicrosoftEdgeUpdate.exe
2920	MicrosoftEdgeUpdate.exe
4740	MicrosoftEdgeUpdateComRegisterShell64.exe
2920	MicrosoftEdgeUpdate.exe
776	MicrosoftEdgeUpdateComRegisterShell64.exe
2920	MicrosoftEdgeUpdate.exe
1496	MicrosoftEdgeUpdateComRegisterShell64.exe
2920	MicrosoftEdgeUpdate.exe
4696	MicrosoftEdgeUpdate.exe
4840	MicrosoftEdgeUpdate.exe
4292	MicrosoftEdgeUpdate.exe
4292	MicrosoftEdgeUpdate.exe
4840	MicrosoftEdgeUpdate.exe
2476	MicrosoftEdgeUpdate.exe
5784	MicrosoftEdgeUpdate.exe
5856	RobloxPlayerBeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4696	MicrosoftEdgeUpdate.exe
2476	MicrosoftEdgeUpdate.exe
5784	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674343950207319"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-01a570a3cd0a46f2\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4248	RobloxPlayerInstaller.exe
4248	RobloxPlayerInstaller.exe
4532	chrome.exe
4532	chrome.exe
1928	MicrosoftEdgeUpdate.exe
1928	MicrosoftEdgeUpdate.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4728	chrome.exe
4728	chrome.exe
1928	MicrosoftEdgeUpdate.exe
1928	MicrosoftEdgeUpdate.exe
1928	MicrosoftEdgeUpdate.exe
1928	MicrosoftEdgeUpdate.exe
5856	RobloxPlayerBeta.exe
5856	RobloxPlayerBeta.exe
4728	chrome.exe
4728	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeDebugPrivilege	1928	MicrosoftEdgeUpdate.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5856	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2760	4532	chrome.exe	86
PID 4532 wrote to memory of 2760	4532	chrome.exe	86
PID 732 wrote to memory of 2084	732	chrome.exe	88
PID 732 wrote to memory of 2084	732	chrome.exe	88
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 2136	4532	chrome.exe	89
PID 4532 wrote to memory of 4272	4532	chrome.exe	90
PID 4532 wrote to memory of 4272	4532	chrome.exe	90
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91
PID 4532 wrote to memory of 1260	4532	chrome.exe	91

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4248
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
  MicrosoftEdgeWebview2Setup.exe /silent /install
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4980
- - C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1224
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2920
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:776
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1496
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTVBNjZBQTMtQTVGRS00NkJELUI2Q0MtRTU4NzdGNUM2QkRGfSIgdXNlcmlkPSJ7NjU3QzJBRjctMTBDNS00MEE5LUIxRTQtRTU4MEVFNDQ5OEIwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0NDUwM0Q5Ri1GNkRGLTQ3MUQtQjdGQy1DNzdENzAzMTZENzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNjcxNTg3MzEiIGluc3RhbGxfdGltZV9tcz0iMTUwMyIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4696
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{55A66AA3-A5FE-46BD-B6CC-E5877F5C6BDF}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4840
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" -app
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3584,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4584,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4852,i,10278841090209630566,617032175564365547,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:2084

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1768,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4452,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4440,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4272,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3696,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5156,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5300,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4584,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5196,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5208,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5964,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5824,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5876,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6400,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6536,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6716,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6732,i,13890968485555737860,2928358406609683796,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:4692

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2664

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4292
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTVBNjZBQTMtQTVGRS00NkJELUI2Q0MtRTU4NzdGNUM2QkRGfSIgdXNlcmlkPSJ7NjU3QzJBRjctMTBDNS00MEE5LUIxRTQtRTU4MEVFNDQ5OEIwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QUVFMjdFMS0yNEMwLTQ2RjktOEFFNS05ODFGNzY1OEU0REN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA3MjA4ODkzMyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2476
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:2804
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\EDGEMITMP_18026.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\EDGEMITMP_18026.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    PID:1224
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\EDGEMITMP_18026.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\EDGEMITMP_18026.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4724AC39-7F93-4F93-8938-02D84F8D2D49}\EDGEMITMP_18026.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff60a4bb7d0,0x7ff60a4bb7dc,0x7ff60a4bb7e8
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:5012
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTVBNjZBQTMtQTVGRS00NkJELUI2Q0MtRTU4NzdGNUM2QkRGfSIgdXNlcmlkPSJ7NjU3QzJBRjctMTBDNS00MEE5LUIxRTQtRTU4MEVFNDQ5OEIwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0QTZGMDhBMy1FRUZGLTRDQTAtQTQ4NC1GQ0JEMUZGRUE0REZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjg2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDgwNzk4OTY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA4MDg0ODg0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyODcxOTkzODUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2IyMzVmYzNhLTg2YmYtNDIwZi1iMWJjLTZjNjdhM2E5NTg4OT9QMT0xNzIzNTY1NjIzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVY3cCUyZmVTSHo5UDNkdTBIT0daWGJFSURESEMlMmZRaXlSZlJSWDQzdGFNUiUyYmk0dG1xS1dMTTlZYWlPc0d1aiUyZmtXdjZmOTJ0WDViVXhRU1ZUNFI2cCUyZmk5dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgZG93bmxvYWRfdGltZV9tcz0iMTQwMzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjg3NDE1MTgwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMwMDcyMjM1NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc5ODAxNDA2MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjMxNCIgZG93bmxvYWRfdGltZV9tcz0iMjA2NDkiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDk3MjkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
1⤵
PID:1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1500,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:6124
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff6a9f24698,0x7ff6a9f246a4,0x7ff6a9f246b0
    3⤵
    - Drops file in Windows directory
    PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4516,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4608,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4528,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5468,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5464,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5948,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5820,i,565993215712075127,10752918709432183120,262144 --variations-seed-version=20240806-050131.461000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0dacc40,0x7ffeb0dacc4c,0x7ffeb0dacc58
  2⤵
  PID:5176

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
f9646357cf6ce93d7ba9cfb3fa362928

SHA1
a072cc350ea8ea6d8a01af335691057132b04025

SHA256
838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

SHA512
654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
34cbaeb5ec7984362a3dabe5c14a08ec

SHA1
d88ec7ac1997b7355e81226444ec4740b69670d7

SHA256
024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9

SHA512
008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
0b475965c311203bf3a592be2f5d5e00

SHA1
b5ff1957c0903a93737666dee0920b1043ddaf70

SHA256
65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0

SHA512
bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
f4976c580ba37fc9079693ebf5234fea

SHA1
7326d2aa8f6109084728323d44a7fb975fc1ed3f

SHA256
b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791

SHA512
e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
03d4c35b188204f62fc1c46320e80802

SHA1
07efb737c8b072f71b3892b807df8c895b20868c

SHA256
192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95

SHA512
7e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
5664c7a059ceb096d4cdaae6e2b96b8f

SHA1
bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec

SHA256
a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e

SHA512
015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
497ca0a8950ae5c8c31c46eb91819f58

SHA1
01e7e61c04de64d2df73322c22208a87d6331fc8

SHA256
abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7

SHA512
070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
45e971cdc476b8ea951613dbd96e8943

SHA1
8d87b4edfce31dfa4eebdcc319268e81c1e01356

SHA256
fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d

SHA512
f1c9fccf742fa450be249dbbf7e551a426c050ae4af3d2e909f9750068a2bdc801f618eb77a6a82d13421d27949c9f2a9681a44bcb410ccdeec66b24a70f6a9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
b507a146eb5de3b02271106218223b93

SHA1
0f1faddb06d775bcabbe8c7d83840505e094b8d6

SHA256
5f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed

SHA512
54864e9130b91b6fd68b1947968c446f45a582f22714716bfd70b6dc814841fffe939bc2f573a257ec8c62b4ff939643211fb29cabc0c45b78a6cc70eaa3752c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
3bc0d9dd2119a72a1dc705d794dc6507

SHA1
5c3947e9783b90805d4d3a305dd2d0f2b2e03461

SHA256
4449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb

SHA512
8df01ad484bf2924892129c59317f3da4f79611be2ca29e208114e5ed2cb96a63f753511dc4fe97e281417366246f2fb576cc6ef2618a67803ae7ac01be7b067

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
bcb1c5f3ef6c633e35603eade528c0f2

SHA1
84fac96d72341dc8238a0aa2b98eb7631b1eaf4e

SHA256
fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1

SHA512
ecd79ddd9f3e6db1d0471132c453c324ab55bdead21de77392f418281bc8a2dd43e9009912896ffa3d55d4d3ef17b0aa847a084369b619eb04a2d2313641d520

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2805.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
2ea1200fdfb4fcc368cea7d0cdc32bc2

SHA1
4acb60908e6e974c9fa0f19be94cb295494ee989

SHA256
6fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3

SHA512
e63b80a5929200c85c7a30a3054bd51eee2f27e603501f105073868690906f4619a27a52e58c90ac2ab5d5c34a4739dfdd2a511574afeb7d0118de88c5544f42

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24591f85e9569269a3b822d0da2e0626

SHA1
62641ade4943b93983b4e59ffd6ee4dcbd77c17e

SHA256
d29bcf294dd77568fd173adac8c705d991482d645127baccb7efca20f560a5a2

SHA512
d0bfe43ece2c598a12fe7d3f2cd12e0685b639aec0fc7a1bbdf0829b886c22208e4236500d8e6540d7faef1514769b87bbdc666602c5548649e50aa61f2077de

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
a4ba043536ce617762bd1ec291c8ce89

SHA1
8a81a3d7fd2af1643e0f5bd412ba2d2de036c689

SHA256
d3b489cdb5b47eeb093a3a326126f3a0fcb546c5f4f8ef4df47e4fa9e9fc073c

SHA512
f0ee2bf68a88e8b1be0db089d2c96586a5df7121a7e0a01c52b52288a9fe45f633a7f7b65acc150fdc2251a2c593402e0fcb6bc6f25e0f11f50fc0c71aebbc13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\605154cb-5069-4717-abc2-ce084335cc85.tmp

Filesize
199KB

MD5
b61b1d0277777fdb205be145ae5ccc2c

SHA1
7bd5376ee2e884229fd151dca004ecb9879ed250

SHA256
d164c1704ebb479d3a031df9fe2412569ad9d3a956ca3da7ff60eb72666a2e8e

SHA512
341d5dd5ad732f6a53c4b09e38da054af60c2e2a482be4b33fb3c88a95dbd366afe252f23d483bd91534260bcc7bde60c3082dbc003d4240c13ff4657372c7e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
a79262f89d388f555cb943871550ff2c

SHA1
c3e1bc1afc3f4401a358ac079e7adc56087e9e8a

SHA256
5dfeb6413e81e0b127f6b04c960164441a5551ee6f797af190cc1552bb638a5e

SHA512
0eaf66040355a4f0e432f1753c58f5134c7f917088ba9d424625bc44ca6c6af1a58a012ca19c35b5365e9adf75194dbff5f254ecd5ed4ddb7c5b38f30f43b878

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
3c2b8b63af205c16cf19305d551bf296

SHA1
1a2e82ca4a4b64cccefa2526d5f42c0df2250b6b

SHA256
f42cea81cec94e264a7dbd13a640833a029782c82ff53510bb27d2e8567c0c52

SHA512
a21c913bdb622ef4492b4df8fdc33f4213d0ffb41e52cb20f6fe1c7983cd7910783e55dc02144a5399b0d8d0718fc8f496fef9f92af68d7e1394deba2dbbda4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e

Filesize
229KB

MD5
b7a90c0e59fc22621e89056428eb378e

SHA1
6d013f680251281dcf643717b0558af5bdaf8839

SHA256
c42a481c62574ae089f05a0303fb8f43ed3d43524ae355c712a083f467fb5260

SHA512
13acdb8eb5118c64f36c41ada548d41e8bc48d163be1cf4471640c51387617abf4fc160867c4574efc1f980b5e57e5ed83da3d3357abc7a01508e309b70822f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054

Filesize
20KB

MD5
644f2b0ee81b56ac7303031ab3ca10e4

SHA1
7ca67423f0ded5ff534f0a0d42df416b44d36805

SHA256
dda33f363084c0f939d6daf5e648ede370fe5be24bd408a6ea0e6bfa1042e6cc

SHA512
461b910c1c3d43d5e62ca18d8a2ec7c9a3db196d649c08ca56d92a8a5e39a991fa5dc53ee20572ecb93b3315b0ba2e2a0ba9f5644c61b2d2c81ef74c05abc39d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055

Filesize
47KB

MD5
fd1f79856510e1cddd8141f1d82aff4f

SHA1
659aa5c13b63adfb1480856cf8da6acd4fa624f4

SHA256
d2c922c16632143318a2792e0ea9345ea5c072ad583a84d8ef164cf952fec4f4

SHA512
7781c5280010519da7e71a849a9cb5e37f7b29a1e800bbf9cc47536eaa937abeecd1a2d61867c2744b7de83f0cfdc88b72255ee083501df0455fd018b0f86376

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056

Filesize
747KB

MD5
e28bef616cb360329b8090ce08fb08c8

SHA1
238bb9401cb8e00306b4cebb42641dd87003e40d

SHA256
35ecb2b52d81b75c460f0a391cd904afa2864e9e008ac464269a39172dd37317

SHA512
4c05bc41ac672c90fc779990e842eff4b62aea197e9a39d6c489565caaaaddfe1d1f04a91982ff132d6dcd5bcf0db395a277db054f744771a28c30f6b35e6d37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057

Filesize
32KB

MD5
11baba444fe6e52672b5c99c6a0d1f6f

SHA1
b8569340b6daea652ef46fa995900e66f819ad6a

SHA256
7ea0876f833cdd63dfd82723a277dea317b1a0e6172ad97b1df0f754a4c229fa

SHA512
975b280abdd1826c44a75c5cd315b75df151485bcc0cbad25fe12be842b5ac9bd99bffac0050a3610af0398e2662b8298fe1557c1bfc356bd7b9ea0c73b9b9c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058

Filesize
32KB

MD5
6fc9442f866c703ef95d3f94f8724e07

SHA1
274b02589d7959b0d8980d9cf156ef0283b92cb9

SHA256
9366424be6711ecdbe31e004dc9d352d59f1d0211aa91019114182d3ae084201

SHA512
551a9aa98a580749e06a80112e8d2dba0bce430b037e2039ace04dd8e60ccf9d3ae8908af0f38224f517c8975e8162dc34d905cd245423d2ae56905d35f5e8e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6b308a0568233699f0a72bbea9ccbecd

SHA1
db824cf128dabdda490c951cb83f666759dcd58a

SHA256
16b342c99fca15bc2e18cee4298d43ed1c0ee8dd1a3e5d11c3705289c1a1c187

SHA512
155099ac0546d704993ea8696842ca8daa8accd137cea7b083319cda0efb1fa0c86d7837d43a9d9facc6503f5791d63a38146c3ee6db7b722970f758d9413472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
36858d314caad324b834f58b1e226655

SHA1
925b91a7cbf1cde74077eb6bcca0c0e84f1ad7d3

SHA256
9aa7a67c558065a039608518d4b1b57b83f366f7b7fca5dce0c8dce0d28ebb8b

SHA512
1ee23bd1717d2afcb8f4a206f888af4fb6086cac009a5b1ede79f2fee25e46f152ca103c9bad12b36b2accb936c73d51d1c9d6004a51617bf236ee8097d7dd13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
be5432468508e5054b7f49bfd75b534b

SHA1
991d8be0f476b4f858c13f2eb12103e306d35470

SHA256
69ab2d05304780fdec7f4265babdbc8bce9c9e406a576cd33202a6958ea9b5e5

SHA512
8f44584a1dfe09c8a736f1012f5ce7962dfcd6b3eff02f0498e332cabd50f1678e8a5c80159002ceae5f78ad6a73802e8db96c82da8e1a58b0a18682a84d029d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\53d9a7f0-d246-44ed-b164-5fe3418f9814.tmp

Filesize
356B

MD5
0c33553cfdf15e8f1597f5a33c6437ef

SHA1
6c055f6d3ac4bb71b357e653b3aed3e629736529

SHA256
cf3081770c391751732b706d83d16981da34220f5bc726be25ac8152a6b0e6f4

SHA512
5b86f5dc18cfe675dcdc6b1840b96952d939676b905b0deadcb6cb9a3c57c7221c4dcfe8e9ba16d24ccbf4dcf0e64dee6d9d4d19b401d05b8142a576e1f5f5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
55f1fb9873172af66a62df65736744dd

SHA1
1a4e481a01e4e067b91bd2e1d4615d8bcec13ee8

SHA256
11ccf79d7c9b13d2942988ba808b43f50dc0c46d82b1ab8575710c16088b4d94

SHA512
91c99fcafe29c612761059eb976430360073f29088602c2f5e22a6a5b47008e0fcca1cf140563d40cde1a857802b04ad3790684d69baa87e233febf895e9787b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
16KB

MD5
aba633cdc3e57a820dca8a150e1a54d6

SHA1
988dc5a225a1953188ce541057f2cc6fc921588f

SHA256
68297d1ca6deae650cd731a188cafe04d3afd40eb82ea0a505da3c3b30a729fa

SHA512
f191c3f38de0d34e048db4b687950c77f53c4314757e35e86b70c801a65f0b3cecbeef31d97e244fa6f0636a899a131295f9f386a7895924b7aa141c69fcae34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
09ad2cb98ae8f2a5255415f14a605750

SHA1
54816cc8c32e0d72cb0832958eab7808a0ed41a5

SHA256
970de823bcdd78410002de4405f74029793b5bb8f65d56ce2b41de10096e640b

SHA512
fddbec340e279d32d8fe2a0bc0f58c9493b00f7c7c2b838a8bc659697a11ad93cabc275002190c56c0afd3ec7ebbb5f9a579b8448bb6300f5e2e92af44482d98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1728838c3b995be6e67f435c7ca5ffa2

SHA1
bfa243fe4172fe0c8cd88de3e49a96e29f9fada8

SHA256
f65b7702da813b0d025c63f78ddda0eaadb4581fe1e5499317b548e53a8556d7

SHA512
be99ce85cacc26effa1926c9ebe27d63481f7cbe140b2e462f48da890ee64709eaee573a957cb7d526f62bf5352e9eb7fd5886e6b3d3bb51cb4d211c2d19d81b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
bbdeb15589011690bb09bc08d02904e2

SHA1
6fdfaeebc01e2e3ae7f2b3f8d1dc027740c142a4

SHA256
c73da79f854df41e6851493a0140bc54af0edbba4ce8a471713c2e5986576e65

SHA512
ce90fa9faa94e72b674e3a5d2053044066b5738563338ef7c3a7587b356ca669ddc4a4ff3f6a7c9e8f8b1063c00e8f28009700678c272e26a7c0e9788939ce40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
05c4aa425f9597bdab2cadaf188f90df

SHA1
b26d3d5307eeec5185fbf9b33a8d73e8a9b54475

SHA256
5f65b5748bea0113d36bb708edeb7b6125b9bfbc679095371b55158597e550e9

SHA512
9169d71e83d0e18abe5ff40fdc3bdf9f93540422dcb1689973f16d4b76138172d64cb6cfef0e98cb23e77cd9e584e93acef563da07ccd5bffbc375f138630085

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
44f171454ac06c677fbdaf80e31301ad

SHA1
228081c44cf4c0344f0fb3a1c544dde26e511a3c

SHA256
1205fc2f3f7ce2a829dc0c3ef7926707ec986f2eb4bd7ac3235c9e4024a83470

SHA512
a85e98362a7fc3eb309deac03067f7023cd2dc5c18066addb3053236b1e2439644c0c1b27a093c6271fc2a641a7c857e18f173ed37a402fc3c26c60bb9118093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
41d2492ae009446a7b62b64052cd6d42

SHA1
8b0cc22862852c68a4a7a7a51c123d0c7acdd63c

SHA256
a8ec7f65bf9b0805198ddf3accbfb256a1c9239acd1dbff01c9f67db5f3580cb

SHA512
f35640ed63852f2aa8049438e4f743330c7e7cca5afaaae420d4731dad19dcdd7e26e93a64b8cae715eb66b87b451439e6224eda88c653a8bf304825358d21cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3f8be66e2b81ddb9c0e37eb045e86442

SHA1
73693c53dfd0b4ba75455ca436032aad9c19711a

SHA256
730da19761fd759b78bc483465304ef5d38f39ec397d7151176a091168ece0dc

SHA512
bf9f7108615ab93d792ff1e5985ea2ff5d9c5167b86ff53fb83b575b8f3eecdd311ada33ea5a3f7bc1bbce40ba0fe1e3a6a7d602b8b8319ea430f3de62fef260

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bd89f113-79c1-44ad-95be-8b69590124f5.tmp

Filesize
23KB

MD5
c0c9d29a49b41d3849147bc701aaa1c1

SHA1
dd6a31b3f489fc3f34f008b3891646354e87ad59

SHA256
3e3dbdd48b20a6b39aabb6b965706ee42bfbb42e0d7ce1ce2feff75bd2a17dfd

SHA512
af7756a0ad7e60fac03df26399bc5fc0c7ad4649fbb8fd6403f10e984b5b52ecbcd6ee9debe2d210a24a22e1d9a477c6a3f90989ccb6e0fd64947590343b7927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2f0985d6ced054e83a7558be3867a3a1

SHA1
06f68f4657b6e9529d78791601f21cfc157bbd76

SHA256
3a71e10115c3be53a3f19434386fb9c4ace9f1cb9478d63928edb228977e1fa2

SHA512
db53f7bf588a33c1f036802950e101b7ba4def2c62b7ddec17067c5e5f2516ec42e17d2ecdae0fe892f67eea415430d6360dbc639c1413b34d8254a18b312eb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ed851b7eb428440edc8c5fe1d336f67b

SHA1
0a377dcbcf2ad88d9b8b70a95bf907ad8cb95946

SHA256
241f6fb4d750bfd2c8bcc8b7b7f1448e74846598527edd8e03f8d5134618c1ad

SHA512
014656265461e372bcc2804969c620aaa478a1dac1ad90d21e42817b30526d828ef372c6de6b47961f8ce94664197fe0e9e2a3b17c6fd40c3d291883ff7fecdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3182c27b48cebb9d3a03dd3c11f0d38

SHA1
a9ee19afb352a3825bd81fc517311a5f0c83ef61

SHA256
36f760a0c9d213eab5523c9ca8edee969edff04417faf64f56d0580aa6a137ce

SHA512
68612546e166e51c6cbf6c8fcb0050fab9d500e4cb1ba5bf7ae0979f4cee1808603462195552f09e87961f30218bb8dcd3a050c47761bac308057fe02eadcec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fff15f8ebef8169c6340fa3b343f3ce3

SHA1
ed5cf8ccef7d0eb1c5f31ce45049016b36235140

SHA256
b84a2e48d4f39cecbc776ab0cb08ce86e2e819a8472d9d67c3be105188c0fdf2

SHA512
3c71b8fd33e018569d27f1be26d9042f1a2356317e49ccbacdd9233415a5b09454a56fd9e4a68b2aefde85901095d5bf9c78f5487bf3b79110d0163d42240e69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0d28791a8ed0b4c587dbcf4e0bcc7528

SHA1
71c23fa6b0af52ecf37ecfa6c200d134fc74daa1

SHA256
07e6c42f7181a6d25fde19599c4996676d385a22c541f2cbdb89f4173b24f920

SHA512
aa185d55f43cd63ebfa14f4f7a10e0d645e5c5f63c04c475d3b73536535aa2b2451374183d50057c004c357de146ddc1c86cbc930025d9077e582d5ebaf5ca8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
86eda0a74b1cbb32ab28a80434c9a7c7

SHA1
cf25eb34db891d4e1e01de4e36fa59edb85b1fbc

SHA256
2016a2bdb17240d0c437edead78f93e7a55ffbb6eb8078cd293b96db5b75dfb5

SHA512
ce421acb0a94d83341e0808cb3a40ceae0a9114b0370be3575e9f2c1a1f5d082d37fb55707b0f6d7596936382591a166fb85aab5f2ed5802a7d13f7735138335

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
53f3b863ae07df02e923de55ee5a38a0

SHA1
39cda1029ee30409e2461f2467640dc4156bf53b

SHA256
1cd9817871d1dc4bc2419b9f2a9ad360f3baac1d98331e46ce144a78a5ea2428

SHA512
5de0421ea89ff636ef51ae37509eee0a2d65a77c8e15fdd5b2d5cf359b60e11474d0199d4e0f7f8d2f8f96b2d5676d26d0c4c9c1d1bcb33b849b893b6e8d9ef4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d414759d39471ffa4f04deecf9aa2cab

SHA1
651d1e36cef96676ab9d3fc14c40f69bcfaaaa9e

SHA256
4c99b60d47eb86f613a214810dc90218049ce8d7dee1aa6ed58faf3f09bb6dce

SHA512
e253bd0d212e5e09ab592a1fad41b40b21e9936b190acf4e62aa61e9b11b06ae62de1fff8abb3bd58720fba03d3e9b00a1ced53a705eff2aad41146843d5602f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
17b4e8ee5072206610da4b2840e5051f

SHA1
fa5d1a5e2a5f449b175feeb8b695194feed0d8bc

SHA256
9235401d01d49419a58cffef06c79fd89ea066863764e4c91332e67ae18a4bf6

SHA512
591d62e1e3fede67a102a2bf912ae1a063b350ae74d04de31fddcbaa323cefc6e0a67f8dce2545b05acebc6710971af2b4a4985a87124ac0fc29395f49675849

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
70a98b98385864e03a8d1dbcbfbde655

SHA1
c7321fa6b0bea7c5321e7641afa56d2ca845d1ee

SHA256
6d0b08755f73606b5c95907436cc56ec5fc3fae881d236be8cf0de5dfe5be889

SHA512
da79c983fda669a948707cad41d329bde4f705ac86825fe4ce9425c2677fadaf64fd64991486e5ce5a3ccbee343cf081059aa7ef7a44331f63b544d92e75b2ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
2d6a6eaa85910f8139d244890bf796b4

SHA1
b7415451d90b3c6e88d4c4946c3784f8324b51db

SHA256
00bb941ee29528a2ee627823751a2626c4a9cda3e7df27212594157b5aef0e24

SHA512
bf4505be588cac4dfe1019830dd0fdd6c949bcb1131184501c1d3cd1b9caed9245e77a7738fb44bd1dbd68de1d3e72e15d0ac2e24feae95255cbad8cf6536399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ee09e95a30c327853a36a2604f986c2b

SHA1
ee0709594c079c520dcc4d7378fd887663287c84

SHA256
1eaf1bee31c415357ff6119482e53312d9420f7a72c34104d5c5191925a6963f

SHA512
7e179843a6b81260e754597cfcf6dea13377e4a5c93e013e73f5b02aed01deacee969d9bd1d8501f8b65e92f9f784c716e7aa8167130457ce11e19e87e51cb52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
fdced7d905e0ba22291688920a25a837

SHA1
29a61646c90e9e755dc3ad4cf7eaa9f3314e7980

SHA256
4404d7c2368520a59b2b27c2fa1b4e0c62f01aea0a2837feb72a2e7b64981a7b

SHA512
f57abff19797244e4e3f0c458cd27b324f14508e1528629844bff8d9423e1ea1dd24403159dda14aa8064ebfe0c18abdb74a4c6a229d2577f6d0a3090aa9df0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4db8fcb6-1691-47b0-be42-617091cc65b7\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4db8fcb6-1691-47b0-be42-617091cc65b7\index-dir\temp-index

Filesize
2KB

MD5
125bc407e9d23a28f9e06c25c44b7b63

SHA1
bc04f42c847869d0566cddf86a2c0437f7f77055

SHA256
6a8675a5753d73fd445ce17fac59a8be5b7400b152c5aa03bfb43aeba9bfb042

SHA512
8d4ded649a8b8d8b412dd3a406959585bc8302e2c7d4373cd642f0339700d05e885ce548fb6827c569b97a5970abafb81dc10961f7cdef3c82c45d2ae7e0aada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4db8fcb6-1691-47b0-be42-617091cc65b7\index-dir\the-real-index

Filesize
2KB

MD5
9a6364bc6c4a13ce7ff2be404a871927

SHA1
f6aa0140b1d4e958648b8bbc2ad073cc03f09895

SHA256
5c5217170f9a526f1b582d2e393820ed47e5a8ace924bbf5ff45dde6f7e191d2

SHA512
01518a7fa836e1342457075cf72ed5cfe5fea5b418d71bae6cede37ecbe073342cfe5f2b4e41412dccd57defec860746cef21051176014e6c20988019247b98a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4db8fcb6-1691-47b0-be42-617091cc65b7\index-dir\the-real-index~RFe5997e1.TMP

Filesize
48B

MD5
0e2f10d2be947e4c772a0bbd437019ab

SHA1
a214500d3c9fc5face32e9d75ece3c322a5f59a5

SHA256
48d15f0b5fd6c0924443b2a7e36c15ecca14b97c8ff625651bcc5c6f8d3c068d

SHA512
4b1a6a0bcbe6c876baa673fb34e6d3257c586fcb616e01bea381a74a1ffcc11575b2480e0e79671914ed75dc0dad9321f3ccec1f9a1ffb8d533dbc4e34cd2b5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5f476d41-0c0e-44ff-a555-5567e31cac01\index-dir\the-real-index

Filesize
624B

MD5
2c27b576431a88897c84231b5395fc7a

SHA1
391ad1faf05cd13388225aea85f3b08785bf8b9d

SHA256
f8240da1adcd59a7e7a61b342d6d63e8596072db850ba710296bf04142323194

SHA512
dbaae6cff772762dd02a7656df462ada8ca321e30f6f220c3b4a39e1732fd29bf5073e531d4d022c57ceb8b013cdc25ada755b2100bb2a6b69a056682fecf8e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5f476d41-0c0e-44ff-a555-5567e31cac01\index-dir\the-real-index~RFe59f090.TMP

Filesize
48B

MD5
e0e7acc3c989657f56138349528641be

SHA1
9703cd76b5d0c4f4597da4729f80540101daafee

SHA256
5421ef920c1fd36ebdda05ddfbac46551acc8171b1d905e7ecb06218d6a9bce3

SHA512
071db539838cdbaae570dab479bf88ac569819f87676424955707bdf357e722084b4f20f69b66c378e961be61002d430cf496407f9177bd846ec4f6320296ab9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
359d8d5ce9ab8f0839a1b309ca799e0a

SHA1
657f6d195050596f8941f6d656330d624f86691a

SHA256
b2468b2e951ab4558b27a176322b2501b45595f9cacc27390600c6249f619051

SHA512
4692c49b90a584d615e22dc6be99a79380cdda0a04a2f6b3d4dac2e42e2181abd57b57972aec94f4f379b29f1d8be452f456d1c4489d1a89766c3b4ff933216c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
178B

MD5
5683f88d39b34595f8388087e1b587fd

SHA1
852d72e39d5664fce37ea370c2441fb8afc54db7

SHA256
9ef75b26563dfa5f30e456e8cb85d365005bfe936e642ef14c27c3c652599d38

SHA512
f7fe53774108bc478a8a9952c307d0c7014f85f5c088fb3799e470ad7f67722fd044f4f8af099a984f706bd169c6099a7865a4f2b4d5a95a56f3388164c6d2d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
187B

MD5
41fb4a9344565a04bef9c6e71be6f099

SHA1
0f202e70b4e4665798c1309b618be8775ce28d3e

SHA256
38f1776dd11cc733373ccec8df36eb53e9e0ef7fe1ac44a67851a36648ec2b3b

SHA512
6fa79a924a8bef82047eaab0eeb858f16c9eba66b3c856d6502d73d4716258bc0269303ffab7955ee2473524d9316a753f6bfc42974edf9ac1829095e2e0e9c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
3f8f71aad50d689fcbf7930cb1e3b887

SHA1
9574127ce7ab6840fd98e73956d2284aa07ffec1

SHA256
4e986b55ebf7bf72f3eeb8a25e69bf5ae8f503bd21593f3dc91c9b719731719c

SHA512
822e05f631293f4dcd50c8cf7f5118c4e1aefc04f8ce53dc2ce5a66ff7133b7c468d49de24676314a92b906cb5526edbeade015874ca63749adfff346dce7f96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
114B

MD5
fc7e9b11c5e3deaa1c0c68a169b03e07

SHA1
9f0f395d966bca1b70377b31282d723fedf847bb

SHA256
d4d8d9507391dcf1f8a6be8cee6f9bf57c7d21419ad45475d13895ab11f829e3

SHA512
ca4a46668855ebd1d1f5d3f1b643ce34861c32ac1c87e366f6f7159aa534dd438a9a493d3e46348976b3e9cbc4042d09652faf249c6200c2fc5252cb65250ede

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
183B

MD5
4d33c5f2284c010165247922f897e787

SHA1
9bb7ff4c81343149604cdaa6669e333409a6ddc1

SHA256
bfd7291f239d35b8800bf30860b5218d3e9c24a3cf64fde8c8140cf08d2de4ac

SHA512
cca2f14bec579e7dbb001a4a729dbbbeef5cef0b773a4d475ec253ba2d5d7cfdfd10339ec8de57958990502d9c97a993b229e1808bf68551861bc978da468658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe598071.TMP

Filesize
119B

MD5
585883dd9bcefba1273429c317a28b44

SHA1
8fceb0dc366a8c106b97d0607a1345213e60ee04

SHA256
9a28fe532ef792a5ad5aa7b2784f32821c1cde53b92fd961fc5a9b930c3e8e82

SHA512
b8aa6c78642b6e2dc549e7d1600a737bdcfa9fde12a3cd92a0f6c2d0eff98df1f89b9c9da5c09465cfd67407dbc09c15b817c7455798c454274342c709ad939e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\654376fe-0bac-4959-87c2-a8f64bf38546\index-dir\the-real-index

Filesize
72B

MD5
ee072835493767b02c8cbb34426fde71

SHA1
f57b4829399a137a4ef1923238f1ff0379ce943f

SHA256
1faeba81d5657bf028512031b3e4ce12495c8e8409537cb0583470db02d6c12d

SHA512
12b07eda6a1b30bcdad8a97c911019c30d4b70074193dedb6814e5a552b9f745b86f7c61c1f6efb52a180ef0304b44126ba9fe346dee4c59c71bfc856fc90b12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\654376fe-0bac-4959-87c2-a8f64bf38546\index-dir\the-real-index~RFe59214a.TMP

Filesize
48B

MD5
724cee0642bdf357f0c4998b7dea35bd

SHA1
e56ca7f191ba28eb8cb0fd4825ff2445f07f32b9

SHA256
4034f1b9066dadd6f90ccfd657bfa3f116e16534875321213b30d17eb332c00a

SHA512
8060b8502eed78e0be90d418d90543a7e7d45ffbb207d47ce50865650ac4b1faa1d6f510a081c76303b5ecd0cf86da220f0d34ce1256e0efb747aa009d5f6e55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\index.txt

Filesize
129B

MD5
4e24c346234fbb2183cbad74bd2d9c3e

SHA1
8c98a47c096c744ecc9f8fa6f0f1fbc632df39fa

SHA256
6137932cc57f1f5cd45da95ed79bfa74bfe6135131eb323b57ae12b5ae31287f

SHA512
1ab897b8cc47f7f433a78df92227438eb6e8c8bdc209745ac95f320ed10edbe2093affe9704d20f923a13381a16b97fffdc2c9e4375aa1efa706439506f181d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\index.txt~RFe592159.TMP

Filesize
134B

MD5
27816b8c6d0ccdc54aa3d39eaccbf720

SHA1
95f670db68e550da67798b1fa28fe4378dc70376

SHA256
cd101abd9fe752f77d04fe7906667e54c67208365a1a2c7e25532e8bbf46cf9f

SHA512
284dfddfe39b8820ee2b3356c880915df1bbb726a8a39df34ef92e242e0c8cecf2a9f22ae3e0f26898538795d9a16e41dac1c781d12f11196d45970e4bf6e3a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
eb6080c035850cf5173915e98dd4f2b8

SHA1
368e1bedfa9f25be868ad04cbe0f40586eb43f90

SHA256
56adceec971358395e7506b7ee76d0c7392e9193ba61fde945df9f1ca727f08a

SHA512
0daae15c0f65b5b9cc4ab7e8812b2095ac2244a929a8859042225b2181e0e69b5a05bb235ad3ec4ec72894f64621b52db8410d3ce6b3079abc597c5b30d71cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
bb50bb61c4b41673c0e62dd8d14226ef

SHA1
dc7aa95f0954f4d7b62b2f7388d5a652076048ca

SHA256
aa7f244ad14c3e4dcc9fd36436978427b7eafa4dad9b88a427fb98c5099defe7

SHA512
02ab0506ad89255aa28612be54defa888aa934d965687725aa7c6d0f45ec1a2aaf7b265deca647767e4d22fb89e5fccb2d2b4f186f04eb395cf20ceeb2c106cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
76B

MD5
46cb7641be727eb4f17aff2342ae9017

SHA1
683a8d93c63cfa0ccbf444a20b42ae06e2c4b54d

SHA256
944fff1dd6764143550534f747243ef7d84fdac0642c94135ab40f584520f63e

SHA512
dc1b5f363e90abff5c1663a82764296922c842820d2819805e87da6da1081f1b5f2d8debc83ac34a26ce289b7b22588b022433686b19b039074ae184968b9fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe597891.TMP

Filesize
140B

MD5
de5366513e67df350f973cc5c0102169

SHA1
b2ae0b07d574f5eee1f4af2e1d40154db5c16f64

SHA256
47638a027fa8eaf41cb2649e75ac21290c3eebd3cade85d95467546bb157b579

SHA512
cedc10e97326a8b5a3fa8bc431d6bab9702051f6626f8859a3dfcb0ba2ab6a57bce424fac2c03fd8c29feee2c25a59385e61500807093339fc6ae5a1b5255ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5f6c957-f08d-4e66-8d5d-bbd85ccbeb35.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
1d0fa7bdfebd71a8d18e379b01f89f5b

SHA1
d4ca4669d0af1a9e093b92979da48114087c2d96

SHA256
2e00413b0b6dce618cac91798cacefc101987de229aa1f363574af9aef4d30f7

SHA512
cbb8532182befca26bb16e5deb5faa4b040a40827d74de9c2dcd28e3297dd997836bdc7336e8ebb430143eef14fd9ae197474a7f83291af34d48e289060a9990

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
5e574ac7f19197b6a4d4d08b893d4754

SHA1
0b82076d731fa49122d3071588204e243776b2b1

SHA256
67875b6423e001dfb8c5ae9284b1998ca36dc6447e0cafae5e8b06362ab9af09

SHA512
f0bf453dd3cdeaf0dfad06a0ea5fdc9338fdfc92a6ed0536a705e314f9426be692c78732c9a31bbc0162cc537d42272708bd14b75a0b6675f4065c223ac046c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
2f99e4e86f7d70c9397398926ea2e6ae

SHA1
447a3c4be68368aab9465a7634f3f0e034d81d27

SHA256
a7740de2fc97fd7615060a7ee376850f22e809b492979ec0f17820756a4e6abd

SHA512
60a9d6e271bee9e402c1167a7623eee9384d449b887fb655f5cf0e6c9cea924a1f2cb1e1bc5c6b36c6f763ef6bf48e6d46179c8966979528507317fc5b2e11f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
6d894a258878227172201c7b0cd5c820

SHA1
e60d93abdee30eb5810549d25b170b6a127f42e9

SHA256
31fac53ea350e49b268471716153cc0aea32cc67910cee8fbc254dbcdbbe7d18

SHA512
d639c5aa967b979805358a193a7c0ee704827daac4850029b5828e0f1e7fab48f39e703904946c531ab9dd69978bc138b877ccc7f5eb11345514413ae4e05c78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
e745b0479497b9e47040b618eb122c91

SHA1
6c3ab23c8133b4863379291fb6d8f4dbb4d7ef40

SHA256
5d030db3b2311569226845c866c239ff1539231c50bdfa1484751ac97529c350

SHA512
cc21cb9e0e153e0a0be04a2b255036bc14af76afac43aab56a1d5b1fb8306327f52757a2db7c276635b32b552b22011d9f24e30a29852dc88cdf86d0c4a7f0db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
198KB

MD5
a1538323fe1eec273df50689012a35b5

SHA1
238d57024b8a5526ea9b0a55124815504f08169c

SHA256
fe4c054654b83efb5a4a3de51f7cc78873930de253cac2706262be9b2c560ee7

SHA512
57dd29efd22424570ab3e9c3bed2c864dcb8573e06b4138139e146c19977e45ac953da18ff958a91445df161435d6a0a6b8130409c704a2384689e745adff903

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
694d5f86d028a1bea2c9047a1ac9ddd3

SHA1
991bfe5388f6d4aac5889351f63fa8b90d0af33b

SHA256
1a4d6d464c7b69553405271be21d1f311774240d734a584592c2f0dea48a2dd5

SHA512
443edf292d8f1a5e8eb8ec2f65c7387064b17d4d893a929a52e5f1656e8770c2fea9e30b8bbb7051bafb72a9cfe969f1e0cd79e6617c2cace26cccae33897c60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
59a4b73eaae1745b3b8d178dfa10ead2

SHA1
c80bbe295ff6a885f4d14db8ed8364a0f968deaa

SHA256
e2bfe3707b79a54f3d2168fcf458b076dfa1f5dd777ad0b351b21f8efd238c4c

SHA512
494b524793b8179823aab7b659a96085938bca18c8e9887cd851462435b7753eb927f3b46feb7abb44e5b8c8d4aef683ac4e39ec9219c2061de1e90894a4c7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4f09eefc418c08f275c2fa3f4b8d4dcf

Filesize
5.9MB

MD5
4f09eefc418c08f275c2fa3f4b8d4dcf

SHA1
1eabecb044e73dcfbf5326ab4fae00afdd22312e

SHA256
e9d623c447b1a1f3a279efbc835ce8e8ac396d85e3700b20c5c5ba6a0cdfab06

SHA512
d5515e3621ed19861eac2683b1409c0e34174920551058562dfa1fc009ec9973567a4109afe75577b960d42f1e876ea9cdcd09354c0d9ec48789767d534c6671

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
bf5a8a9f882ae92b1efd1b679295b0b3

SHA1
744df7b276940bc17a887dea51c4b40e54a2c4ac

SHA256
5699881663cd7d96176cbdf29e64524a0dba2a5f86b171f4d240494ff77df7e7

SHA512
fa74a2f0f00c497021e5388c1fe2c38fd0bba5553124eada3692246a5507c8e62af9d081745ed648b5b06f7a446ab31252dee8c16cb996e0da53ecd2ade51ce2

Download Submit
memory/1928-1100-0x0000000000570000-0x00000000005A5000-memory.dmp

Filesize
212KB

Download
memory/1928-549-0x0000000073DC0000-0x0000000073FD0000-memory.dmp

Filesize
2.1MB

Download
memory/1928-460-0x0000000000570000-0x00000000005A5000-memory.dmp

Filesize
212KB

Download
memory/1928-461-0x0000000073DC0000-0x0000000073FD0000-memory.dmp

Filesize
2.1MB

Download
memory/5856-1113-0x00007FFEC0350000-0x00007FFEC0380000-memory.dmp

Filesize
192KB

Download
memory/5856-1136-0x00007FFEBF850000-0x00007FFEBF860000-memory.dmp

Filesize
64KB

Download
memory/5856-1144-0x00007FFEBFDB0000-0x00007FFEBFDC0000-memory.dmp

Filesize
64KB

Download
memory/5856-1148-0x00007FFEBFDD0000-0x00007FFEBFDD9000-memory.dmp

Filesize
36KB

Download
memory/5856-1150-0x00007FFEBFDD0000-0x00007FFEBFDD9000-memory.dmp

Filesize
36KB

Download
memory/5856-1149-0x00007FFEBFDD0000-0x00007FFEBFDD9000-memory.dmp

Filesize
36KB

Download
memory/5856-1147-0x00007FFEBFDD0000-0x00007FFEBFDD9000-memory.dmp

Filesize
36KB

Download
memory/5856-1151-0x00007FFEBFDD0000-0x00007FFEBFDD9000-memory.dmp

Filesize
36KB

Download
memory/5856-1146-0x00007FFEBFDB0000-0x00007FFEBFDC0000-memory.dmp

Filesize
64KB

Download
memory/5856-1145-0x00007FFEBFDB0000-0x00007FFEBFDC0000-memory.dmp

Filesize
64KB

Download
memory/5856-1152-0x00007FFEBD6D0000-0x00007FFEBD6E0000-memory.dmp

Filesize
64KB

Download
memory/5856-1153-0x00007FFEBD6D0000-0x00007FFEBD6E0000-memory.dmp

Filesize
64KB

Download
memory/5856-1137-0x00007FFEBF8C0000-0x00007FFEBF8D0000-memory.dmp

Filesize
64KB

Download
memory/5856-1138-0x00007FFEBF8C0000-0x00007FFEBF8D0000-memory.dmp

Filesize
64KB

Download
memory/5856-1139-0x00007FFEBF900000-0x00007FFEBF90D000-memory.dmp

Filesize
52KB

Download
memory/5856-1140-0x00007FFEBF900000-0x00007FFEBF90D000-memory.dmp

Filesize
52KB

Download
memory/5856-1141-0x00007FFEBF900000-0x00007FFEBF90D000-memory.dmp

Filesize
52KB

Download
memory/5856-1142-0x00007FFEBF900000-0x00007FFEBF90D000-memory.dmp

Filesize
52KB

Download
memory/5856-1143-0x00007FFEBF900000-0x00007FFEBF90D000-memory.dmp

Filesize
52KB

Download
memory/5856-1135-0x00007FFEBF850000-0x00007FFEBF860000-memory.dmp

Filesize
64KB

Download
memory/5856-1126-0x00007FFEBD840000-0x00007FFEBD850000-memory.dmp

Filesize
64KB

Download
memory/5856-1127-0x00007FFEBD9B0000-0x00007FFEBD9C0000-memory.dmp

Filesize
64KB

Download
memory/5856-1129-0x00007FFEBDB60000-0x00007FFEBDB70000-memory.dmp

Filesize
64KB

Download
memory/5856-1130-0x00007FFEBDB60000-0x00007FFEBDB70000-memory.dmp

Filesize
64KB

Download
memory/5856-1131-0x00007FFEBDB60000-0x00007FFEBDB70000-memory.dmp

Filesize
64KB

Download
memory/5856-1132-0x00007FFEBDB80000-0x00007FFEBDB90000-memory.dmp

Filesize
64KB

Download
memory/5856-1134-0x00007FFEBDB80000-0x00007FFEBDB90000-memory.dmp

Filesize
64KB

Download
memory/5856-1133-0x00007FFEBDB80000-0x00007FFEBDB90000-memory.dmp

Filesize
64KB

Download
memory/5856-1128-0x00007FFEBD9B0000-0x00007FFEBD9C0000-memory.dmp

Filesize
64KB

Download
memory/5856-1125-0x00007FFEBD840000-0x00007FFEBD850000-memory.dmp

Filesize
64KB

Download
memory/5856-1115-0x00007FFEBE140000-0x00007FFEBE150000-memory.dmp

Filesize
64KB

Download
memory/5856-1117-0x00007FFEBE1D0000-0x00007FFEBE1E0000-memory.dmp

Filesize
64KB

Download
memory/5856-1118-0x00007FFEBE1D0000-0x00007FFEBE1E0000-memory.dmp

Filesize
64KB

Download
memory/5856-1119-0x00007FFEBE1F0000-0x00007FFEBE210000-memory.dmp

Filesize
128KB

Download
memory/5856-1120-0x00007FFEBE1F0000-0x00007FFEBE210000-memory.dmp

Filesize
128KB

Download
memory/5856-1121-0x00007FFEBE1F0000-0x00007FFEBE210000-memory.dmp

Filesize
128KB

Download
memory/5856-1122-0x00007FFEBE1F0000-0x00007FFEBE210000-memory.dmp

Filesize
128KB

Download
memory/5856-1123-0x00007FFEBE1F0000-0x00007FFEBE210000-memory.dmp

Filesize
128KB

Download
memory/5856-1124-0x00007FFEBE2E0000-0x00007FFEBE2EC000-memory.dmp

Filesize
48KB

Download
memory/5856-1116-0x00007FFEBE140000-0x00007FFEBE150000-memory.dmp

Filesize
64KB

Download
memory/5856-1107-0x00007FFEC0300000-0x00007FFEC0310000-memory.dmp

Filesize
64KB

Download
memory/5856-1106-0x00007FFEC01E0000-0x00007FFEC01F0000-memory.dmp

Filesize
64KB

Download
memory/5856-1108-0x00007FFEC0300000-0x00007FFEC0310000-memory.dmp

Filesize
64KB

Download
memory/5856-1109-0x00007FFEC0350000-0x00007FFEC0380000-memory.dmp

Filesize
192KB

Download
memory/5856-1110-0x00007FFEC0350000-0x00007FFEC0380000-memory.dmp

Filesize
192KB

Download
memory/5856-1111-0x00007FFEC0350000-0x00007FFEC0380000-memory.dmp

Filesize
192KB

Download
memory/5856-1112-0x00007FFEC0350000-0x00007FFEC0380000-memory.dmp

Filesize
192KB

Download
memory/5856-1114-0x00007FFEC03E0000-0x00007FFEC03E9000-memory.dmp

Filesize
36KB

Download
memory/5856-1105-0x00007FFEC01E0000-0x00007FFEC01F0000-memory.dmp

Filesize
64KB

Download