90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650

Resubmissions

09/08/2024, 17:15

240809-vsxthsxbkh 7

09/08/2024, 17:06

240809-vmkxrstamj 8

Analysis

max time kernel
417s
max time network
419s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FluxTeam.zip
Size

34.3MB
MD5

eaa845a8cabd9e13151786580b122e99
SHA1

460d005a4cac062a86552977ff6b7bb2f95c02e2
SHA256

90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650
SHA512

c5a39b3b4b1462e537a811738438a3397005da0620e56474165246ead33c0663c571a3f35ad632f79baa62ed2bf54ffb08ebf53d8a48d269339c7e6c2fb5d007
SSDEEP

786432:CjyaAFZvok3gA/rbFy0Uf0dmAPNoDAyD8nJ3dnXqEOHsy/TZ:C2a+ZvosgA/Ny0Uz0oDAC8RdIHfrZ

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
5964	main.exe
2168	RobloxPlayerInstaller.exe
5564	RobloxPlayerInstaller.exe
5644	RobloxPlayerInstaller.exe
2384	MicrosoftEdgeWebview2Setup.exe
392	MicrosoftEdgeUpdate.exe
4836	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdate.exe
6120	MicrosoftEdgeUpdateComRegisterShell64.exe
5768	MicrosoftEdgeUpdateComRegisterShell64.exe
1068	MicrosoftEdgeUpdateComRegisterShell64.exe
4100	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
5964	MicrosoftEdge_X64_127.0.2651.98.exe
4752	setup.exe
4788	setup.exe
4916	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
2956	RobloxPlayerInstaller.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
392	MicrosoftEdgeUpdate.exe
4836	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdate.exe
6120	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
5768	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
4100	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
4916	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
980	pastebin.com
981	pastebin.com
201	discord.com
204	discord.com
971	pastebin.com
972	pastebin.com
978	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
130	api.ipify.org
125	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\transformTwentyTwoDegrees.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\img_key_indicator_border.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\TangentHandle_Automatic_9x9.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\LeaveGame\artAssets_DownArrow.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\eventlog_provider.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PerformanceStats\TargetKey.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\Debugger\debugger_arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\TopBar\leaderboardOn.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\LayeredClothingEditor\Icon_Pause.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\TerrainTools\mt_paint.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\TopRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\RobuxIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\Editor\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\button_control_firstframe.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\TopBar\dropshadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\dialog_tail.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\localizationTargetEnglish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\MaterialGenerator\Materials\Ice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AvatarEditorImages\CircleCutoutLarge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\category\ic-top rated.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Chat\ToggleChatFlip.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\GameSettings\CenterPlus.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Help\ResetIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\TopSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\animation_editor_blue.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\StudioToolbox\ArrowExpanded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\avatar\compositing\CompositTShirt.mesh	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ManageCollaborators\arrowDown_light.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\Auth\CharacterShadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\ExternalSite\discord.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\TenFoot\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\CompositorDebugger\clear.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\Top.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\fonts\NotoSansGeorgian-Regular.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\CollisionGroupsEditor\ToolbarIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperStorybook\Embed.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Input\IntroCamera.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5480	5916	WerFault.exe	214

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4100	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
4916	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	FluxTeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FluxTeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FluxTeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	FluxTeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\FluxTeam.exe = "11001"	FluxTeam.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676968869558307"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
2168	RobloxPlayerInstaller.exe
2168	RobloxPlayerInstaller.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
2956	RobloxPlayerInstaller.exe
2956	RobloxPlayerInstaller.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
920	msedge.exe
920	msedge.exe
3992	msedge.exe
3992	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: 33	4412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4412	AUDIODG.EXE
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5916	FluxTeam.exe
5916	FluxTeam.exe

Suspicious use of UnmapMainImage 5 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3472	4044	chrome.exe	93
PID 4044 wrote to memory of 3472	4044	chrome.exe	93
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 3296	4044	chrome.exe	95
PID 4044 wrote to memory of 3296	4044	chrome.exe	95
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FluxTeam.zip
1⤵
PID:2020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaf906cc40,0x7ffaf906cc4c,0x7ffaf906cc58
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3740,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4572,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5104,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4976,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4604,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3536,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5180,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3192,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5552,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5440,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5140,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5156,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5972,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3900,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6152,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6128,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6416,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5948,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6104,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6512,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6596,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6436,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5256,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6428,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5968,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6504,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7028,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6892,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7352,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6632,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=7500,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7748,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7896,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=8056,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7752,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=8440,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6520,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8212 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6132,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7128,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8284,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=8064,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7784,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7644,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8644,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=8244,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=3172,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=8744,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8660 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=8764,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=8624,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6288,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6508,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8580 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6184,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5424
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- - C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\Program Files (x86)\Microsoft\Temp\EU5D8.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU5D8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:392
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6060
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6120
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5768
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2MDcyM0QwMC1DM0Y4LTRGMjQtOTU2MC1EODVERUQ2MDA2Nzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMjMwMDQzMTUiIGluc3RhbGxfdGltZV9tcz0iNDUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8E2DD995-CAD4-494B-A3AE-D894B208DCEC}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2512
- - C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=5444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8716 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=4772,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:GimuaCp3TrGV-tdDU3gGiFz4s-Jrjsu6c9VkyhEU54vLIFyqq7aUG1udVcdP-FyPgzzS6eO4FDWwKW8kSqHj-mogrbJTCnm1WHE-yIHP4BZSumtW7FJIRX4TTTen0BQ_rBmWIa0rF5uGBml0Xkq9T6Hv_QIN_69dqwkqafsfYE7ypYaS4UirmxlcEJwxzPUX9lWLNewUHip_ik9wHlKfB3ALQTaf8zJ4FvIW87_69sk+launchtime:1723223564010+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723223386891011%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D388b2b6f-b14c-43fa-8bef-6f486ff5b383%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723223386891011+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=7860,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:_1RJyeWahc3o-LXWJbJTdxDKZkBEqC2i74uMxZIu7Wg1WBE-dYwFiyrMXsJ_RY4Bn85VsD-L0ygaH_l4tahJ8GHziQ5xFbvR0wCciZ8qZHwyiX80IvF0z4g_lVw6t86M45h08o3fAAf9PWzp3XYy96o-_5MoQrQ7m62LO0R6rKUFHebdRHdhaYadwApg4S3q_wHehiXkQF101WMpQtoZQTqtgJMNq4MdznUoLW95RaM+launchtime:1723223641529+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723223386891011%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3De2253d01-faf2-4f70-b8f2-f1881f219369%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723223386891011+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5776

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe"
1⤵
PID:2948
- C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\main.exe
  C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5964

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5564

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5644

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5304
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGQjNGOTI2NC04MjBCLTQxNkQtODEzRi0wOTBDQ0E1NDc4MjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMjc1NTQzMjIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1736
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4752
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff711fab7d0,0x7ff711fab7dc,0x7ff711fab7e8
      4⤵
      Executes dropped EXE
      PID:4788
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RUE2RTg1My0yQjQ3LTQ2OUUtOEIwNC1BRThERTZDRjI5QUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzA0MTcxNDI4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwNDE3NTUwOTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MjQ4NTE0Mjc3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyMzgyODI4MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1ZTThLODR0NjQlMmZXWGFXSTQwQkVuRGE0Q20lMmJzTkF5ZmpEWmh3RDlLSkhyRHE3dzVYZXBIRnAwRyUyYmYybFUzdiUyZmtlNjRFTyUyZmpCTWhjWkt1WVRCTU9FdnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjE0NDMwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI0ODY2NDUyMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcyNjIzNjQ0MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2OTg1NDQ1MjYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5MzYiIGRvd25sb2FkX3RpbWVfbXM9IjIwNjgzIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzNjE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4916

C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4028

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2956
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4272

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/2VURYJ5g
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf92746f8,0x7ffaf9274708,0x7ffaf9274718
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 2624
  2⤵
  - Program crash
  PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5916 -ip 5916
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe

Filesize
6.6MB

MD5
527503f430c5fd4a542f8c0f163fde47

SHA1
6b4db644895df6c71b547d8b147ef3e327418f9d

SHA256
d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

SHA512
ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
9f1edaf7fec140c4fbf752bceb8faee9

SHA1
446e908ae656e01c864606d2cef06ed8abd96fb3

SHA256
810a386924e8aeb9ad6a432067a96b9af05b2070b4a034b28c6d715d99740666

SHA512
2a97bdf30878cabc8460b26baa810fce2f06e649a98937c4112e674ddec24a3cab259b820fd6a382a11cb7d8167b33ebe28ae7e10338a283b299b9c5a4951f0e

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
6d859bde5c394e7cc8d465d6e29662c0

SHA1
2470bd67540edc733e60658f822927f85ce946b7

SHA256
0d9eab7ac500eccc4a83f062292436650faba93a5e86126f97309347f4144ee8

SHA512
811c5bff1091af714966ff9c246da877ad62e3a7af88d7922d489617e43c3bbd85f4f5e26afa2acc5e8fe0a156b718fffc3c0950ad715fe300e6b1f6f70adfcb

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
182KB

MD5
d8e0ba93e4506a35b9e764b3b363e305

SHA1
a0259de031a69beefd4c5857318e50c86aa19fb2

SHA256
824976a4bddea05ea750de41ef7342aad3bb4d76baa9eb46cd308ff495068ddf

SHA512
9f49a8eb560aaf1f4dc5e189d1cb458f138dc2b4a035529c795881cadbf09dc7f69279166f32f00a47863c6177f9c6a077ee1d717e86cdc3ade43d109548e783

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
89f10307a4e87f78ad0b6081cd8e23f6

SHA1
a26e92f89231b60cbd742d0a259d63eebe2388d0

SHA256
dcf169dc4a6449c4cc490dbdb448505ec91dd219619f32496100649c259388b9

SHA512
5845e6b34d0effafa10ba9c5eded904c13af64128ce3a152a3c2cad9c6fa38b7358916a0948eb6288c9c9ead23bd5195e16c77c49971fb53d6ceabc1e276f0f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6357551187434454728d5336952b8c04

SHA1
d549fc8b041640709e3046a189fe1fb3b4bc8da5

SHA256
adb9fdef9631fdf55dbcb2c1085415a12a2997a69a267aa48beb2f04dae4a175

SHA512
130535288a788239242aaf603301beb3025cdee224eb988884aeabfe154aad7849fe5a9c72721c4b6046b3a5aac478a3891c722b032cc245e9a9b5f541e6258a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
1024KB

MD5
33c169b03626d183ec8a8590b833f0a0

SHA1
5baa6dcfdc291c0c1104864de57ab9904f3e4eb3

SHA256
9ce0fa6211341cf0b1cef302f6b02958ea5790ce35879c28a68b86e789651923

SHA512
9ec498ee4a369710ce7404956ca45742a9c6a745d2d57a3a80e0ff53de84081c0ed4a9d0506fbae163a27c0f190761d3deb29a1e712bd1e6a0cf1251b7382e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
25KB

MD5
6c9f24607a85011c8fa145f30be632ad

SHA1
8f130cec0d0a6579fe8d398bc7e62451e7badda0

SHA256
7d5a1d5cc0ff324a2faa264a6d1a40115aa945a8d7c71808108da456125dc784

SHA512
79ef710010892897b208f4b4c61c043523454ae3bc9a765057ddf0b8e9f702d4a6ee1c13317b1fdf95caeda2b9d9fd182140614eb409b5fc72cbffc6c723b48b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
897KB

MD5
5909b4611b7766c0b954aeddaeb76830

SHA1
9cde8406d085b9ea44049bd7ab76bf2e38ca81e1

SHA256
b280cffd9e1b2ba447b00742aed04368c20030aa516ef345972dea8109c2c8f1

SHA512
fb0743c14d20b179d3f817aa6882ee19a15fc8861094ec225cd991c5cde9d233f83d019a800d856dabc9fbd72de34a58cd146ace8be26ebfafdba9b576dc0155

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
16KB

MD5
61e4576e6aa91cd435fe92f085fb0a3c

SHA1
fa21a6bad3a461c8f0e27b75913c8f1cbe0b2b62

SHA256
78d8aca4e50e6ba58890b68f8c3d6e562ff0b16516a0c3df56be18b69dca6aa9

SHA512
b250c2940f7ca24b763bfcd4d39d0022d6441bad54c415b9848ef949f8871f219289f044301de03313bf8cfa53bb2797c5590acc1b32889b0641f7a13b710bfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
72KB

MD5
0e203bbb83e307ebf9189804659fc461

SHA1
2ca8b6ec42cb2d927775f359b7dc5b9a4e75f5a8

SHA256
7bec2753105c16bfb8de69caa1ecb069a95698d3c4b5d5c8cd17d25c3897244d

SHA512
cc305c05ffafa4ebd67a1561ce19458acfbc1c2bfb05e7ce99ba6e80336751d62d2b0a957770cc9ac535a01f45e135b1d3623e46454168c100637722331f578d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
50KB

MD5
cd2f3074326840d55a3c3ea1e99e83fe

SHA1
3a2e1d1a93506526ae3ed2b44d584af7771ff8d0

SHA256
9ec9f50ac6a5dfdf7ace0a047ab4e86a7f8ff297030f93f9b8b4e27c57fdaa51

SHA512
0685f7e50451e87f8d7d47f3373d653f7d6163ffa8ccd143a85b179d2c5c51cf494e8b5f7e561436c35bfb8ffb9304f0c49962a8bf7065830f0cc95281f4ae6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
25KB

MD5
42e84ebcf5470237abd1f9e322b751fe

SHA1
a828a45804554507d9e8521c36109e8bc3d5eca2

SHA256
a9fc7baee3689f0331e46617f60d6e7c3ed631209b7211e7dd09cf20d22a64c1

SHA512
36606d42aee5689819dedf221af3c6c0da06aeb9997b9ce84b42db42ab80a0926352219f1e47f2287dcc850fcc96e4eefd5e487e09e1f1228102eced11271e25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
20KB

MD5
631c4ff7d6e4024e5bdf8eb9fc2a2bcb

SHA1
c59d67b2bb027b438d05bd7c3ad9214393ef51c6

SHA256
27ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82

SHA512
12517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
28KB

MD5
dc63386872598772bfa124231e36a66f

SHA1
ecc423f54ce64710f2a71f4d4a492a0d6a21816d

SHA256
5510313ed00e6dfb9160c180f539220fec23e0eaab8b0368ee42ea87d747743f

SHA512
51b15285049fc20f948b40b9fe7db95add72b54c88855b748d3f653fecd7bdbcfff2d6b2fb138adb7c6b702ff041c58905a13202c652aed57f812c15051fc572

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a5

Filesize
63KB

MD5
67e59a06ec50dcd4aebe11bb4a7e99a5

SHA1
5d073dbe75e1a8b4ff9c3120df0084f373768dae

SHA256
14be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe

SHA512
6364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ab

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b0

Filesize
123KB

MD5
ac50a2cb37c8260a22f16fccb46a41ba

SHA1
78f6ba6bbb347684315e398bb8824bf4affa9163

SHA256
9d39990daae223e1b8e4c1a9c2d777df9da2fa40c8a8ab52de6d60dbd1d79227

SHA512
a85411faec5ee26fd38d5416ae414d4c252b041d4dfabbc4e558d1753b11530e59d2b35b0622bac31c9e384d709bc9358cb8f3ebd004b3ac1c7d4e63fff2dd72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c7

Filesize
51KB

MD5
0a7c0eb14fb4f288d5c61cba111e3dc3

SHA1
48f6448938e1b8df723a9f7c6490a78887f240c6

SHA256
8bef2cb55b40f46f7e2fadfe280e4c41b71a657081858a8224c6fb639d910e4e

SHA512
a63a2651e36b03846d5818a4e03f7582ce95a34d9b4d4be9a5ee152ce22c305a14fec2618aa3f904495bed4c94a3256951ba75dbb0fd0386b3f570096ad4226b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e0

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
6c5eac29274140d3829e04fef438be42

SHA1
36dbec928092f42add2a159166cb627be4a54669

SHA256
260ae6e7650abe30acb48af04d74d3b39ca06f1225815b3878d2341303df6a78

SHA512
fb1d418f6010923d97fa1a424da08118c7367389922eb189bc81df17813dca8d3646ae5c996d36f0815844c035ec068d961bdcb9d79a833ff894a16cbf998738

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
e44e8733c082c77a8f00269a33a8ed96

SHA1
f59babb9ce356f0e0f8b75fd56be26f68a0ce9ae

SHA256
048203f3f74210c67d7f142cc18a5088c9d73db7bccc8b34532015b5a5171f46

SHA512
395360c1ab035ffa5bbbd6bed8d39f3886679421d67e6c4414fee65258311dbf80b4762cc2d9f3b9c425c851c183fb2cdc52216e398bce10255b8e90727d8598

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
a814c3f87d0094ceb89f3f99d9c9af46

SHA1
56f2a95be2ac9b3925ee57f0054ea2c6e48afcfb

SHA256
404c676d5540f461630db8316203d38153ca9e0226c2839eb8a9864b5ae3d2ea

SHA512
424ac136fae36ce26b267248c1903f566602628ebf07df53a50d4a1c5f24fb7f77dadc7172b7e14ca26743307dd3c2837bab0fee57055f7cc65e874644d3044a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a62a24b047933f49c83dcfb90d5f03b2

SHA1
2bb4d6544f010f5ec69222f1ec06fe2b8139b844

SHA256
a9e4ac81ba58f10521e8a0e81075f6fedce1be21563fe8d79e8969200da7acbd

SHA512
2faf4571e80b2918c7138e124636da7d474ded6a3010e2b1487ee7b29f94caae1a1698c36063b099bc99904e5d96ba144ef8f4219edb37a88863212c93658ee0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
b3ec210b162a2e12643d5c4fd1ce5913

SHA1
06de7d9e24a154f83518db1859dbf4f0106697af

SHA256
a602cd70b283f8d578b176622e250488c5087b53266b6104f34ba1851c63d10d

SHA512
a3aae09a77aae3d89758db11edd14b130759c01a77f6ad5c734f55311a44ac90cd4bc13156fc081b3762249022f9f14e26ed1d56a125f78149bfda04120c577b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
390B

MD5
adf9a6b2fd9d1e96688a6d02f31649ea

SHA1
915cd3ff6f2ea29cc2797a29611531a9c066f496

SHA256
9b20ae2a3c1607cd6d8d6851b61221a1c9be1b77f50102eb212ab06c9d90b443

SHA512
517a5830095b71d4d1c1fb36df6b01baa7098d657bc7ac54b41611dca93a073d4fe46637136d9fc35ea818302e8decd70bda28a2e33bc296620580e510dcb32f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
390B

MD5
5ca90bcce039395a0196070229a940e5

SHA1
55a601722f59d9b59302cf881224a744b52b8f95

SHA256
faa5a197c60dee1633058262fe81c126df899ddc75f906127372fcb97b24e9cd

SHA512
8e6a79df6bf1ff950799bf241da881657b5ec209ab4486a09262b91fd2869e3ef38fd8fddc65ce766030b43eae47f5c1c7137baafe7f34b63f74388f6224b303

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5c487a.TMP

Filesize
675B

MD5
14c9be58a64f2e33f66171acbda65767

SHA1
2ca527fda1e2fef166ccd5a4bab5262486261842

SHA256
57075ea32cb8ef1c2a3c252ed691bc08b450337bb7455eac9e4b98ab19ab9aad

SHA512
e8cf4c4e7428b6d6524c33f9f774c8b05c6645252ac51ae94f6a8abeb5aa34185ffeb39766f8f651e3a676e92e938ae015e73b22a7bc304323b7d6a1200df52e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
18098abe67c07da8ba82a28c4f645264

SHA1
2a97539499c4cd3ad0225d9a42c711f2c26fbc7f

SHA256
dfdeb41bef53aae56766192b58232c13612ffeeb7fd0261956acca21d239f402

SHA512
8eb5efea4dc08b3bcba0cf06a6c183520d047570edb6984e0821bda40d90e61dd3ec1a5d54e906a33f4e7ec32d05ba1b8366330ea4e0da9f63ec8b7efb88e8e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
29KB

MD5
fbc776ea9f3a1e09b6a7baa2e5c07bac

SHA1
fd3a14a014d1e5e078ee1cc071aa6c909246599c

SHA256
a016abb782994d366ab6cc4c2987e556c48222c2a40f4d30e8dbdb7a0c7ded68

SHA512
44d5b02446423d638a4319f2b60aa8040e2ecf57d6a525086d70b841ec54f1fd2533023ead15c031ec6711b255c282901327608643dce781dfd82cf460558151

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
45KB

MD5
5eb3c3d586693c69ac8910087a356e04

SHA1
c31dff0b185bdf9035d4112321868057f8c2a853

SHA256
f014f3ab3929aa20f14b3f31366e815f33839c2531ba71eb67ec1fa17628b30c

SHA512
8c84c6b6dfa4604abecee045a69e05995c1404291853c8ebc0f565b9d5496f20f6b72517571723ca1d6c69643e7caf5690c283ffb5046bce87d6cd7d39ab99a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
36KB

MD5
5c8dee597962ed0df078d3d554b7d6c9

SHA1
7cbe9b482ac1e44dedcd9bcaff1a0f7800002f32

SHA256
27207c1277d30328d3f4161b21ba1dbcf3ac55f26847ae18178c48c0387534e8

SHA512
7f32d851b97916b5f4b87995d45fb64e717e4defca22aca0a36d80d52ce1c183b12d36e22422da681f83f82efff175f43f5df665f53c54fdc1f13a3c823b0e2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
6b74941a288af457a71661aac3789401

SHA1
20d47de35749c466004126af8f5861162db704b7

SHA256
7ca8ad4293dd83ef07ebbd83ea90b987c0afb71297e858db4f5d52feee407efd

SHA512
2094bcc7f68c043865de9c031d1dadeb7645360e719a1b1c607e21fca38a54ff263320417a56baaaf6c2a141cdcfeb69421565b9bab68e8fb3d2b6029e96db6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
3a3c69eb62e0b2ddbd6f1515a4d82088

SHA1
b1cedcd0536e52ecbc9e46390e3350c84712b3e6

SHA256
aaebe23e06b3d283c81420530a45187b87d9e91d00dd5791f65ed6dc984fc273

SHA512
f4ec15c7432b5057c36ff638183f31b3dde3c8f85df4261aab7968d052c94f1a155e3cd972cbed20eb184aeff99489eee5099b336052cc6a59fbee01aa6bc45a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
b5cc65886e01129d60f412790bbcfc92

SHA1
e65f7834db2d1fb82ada52ef19d27fa463845f12

SHA256
fa7ad32ec8858354ea95b9ff30858ebfd005b2cf7f17a2a7d1ad21f58e58247f

SHA512
92f003f898e717b14b66b0a5edfe634e058df266e7bdb3d62b1c2977cf75e886e7244b186cb9285b93acc96371906d5d1d3cd85ece51866d8721996317802c23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
d51e8ca5d02022e815ebe0eaac4d43f3

SHA1
da461b39f42efb236ebfb87d9432a2148406d40a

SHA256
b8d22109b0f985d67836697a8caf42e2cfe51d1404f363e1e935e30ece998fa2

SHA512
a892e186b178390906dcb0468a1950332a877e223bb2af002921b2dbe4ef1088720ecdf360046e4eab079f94f29286668c6347c8ca5676deaba3ef4c96c86f73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
12171c4b14f8d9344d1a548f6d20c1e7

SHA1
44520072507f8db3e32623baf5b69050644b885c

SHA256
c716f23c2df7c3fc38ce8f093503e323fedb2bd88d2accc142ed10a5842e9bf5

SHA512
454d1d58feda2094c1a377a052e75ae6a5ba23ea18da03e274f3f4e3473794cf6b4e526f11733049bb98570b41a13f3f3edc6a5bebaad906fa64952cd8c35f92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
e4a8af0fb780434f343fb7ad5eceedc2

SHA1
b67d90ad9670d496d6052a68dd80f30ad774e894

SHA256
c550ef7210a9c011e64dc05a05dd242ff2a42e8fd57aa4b77e5313f657a277d0

SHA512
54dd8ecfcee9d87ae642a422bd50dcbdad4ba3644270a02a4f3846f1f32a4e9c7ae18c22584d2e9c0b6d99bdf10ab4e9d66b0eae3e3792031434d444c9b39fde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
a9a191f4600f7e997c473e38e73e11ad

SHA1
dd944b71cbd87af4b18b3c00999239563bdc68aa

SHA256
408fb1c338253359ea71f4e86c8ffe6ef52b19bed08e8a435639f47276673226

SHA512
5a1bda2d352840539249c3abd3681887a27ca04fbfe1f5d8bd7456d6938452a1326cdaf4c8a51bd671f341af326d60368bc5a5fb6fdc54096101a3d8429de383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
2dae230fb9d6ada90f2326ff5f6917b8

SHA1
73eded9ed8a1a2c5d3dd9d83088472cbb316eeed

SHA256
0172b3177319df9e6df7fb8fce49659c595653ffdc7ee5defb480894ccdadae5

SHA512
48da2cecbd32ede95794ef60eebb2c547563a4e7d1b70fcb3bc368c8af7499c30387036e6c68c0c30d70888bb2a6e8ad23c62d04f63ebca0e6cf396c01786b8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
c4b453379e4f3a35dc15a9a046d6dc28

SHA1
09dc38c9d42885c85fd80e010343109740f6152b

SHA256
cbef8760a7d8e5ca730fb11c78d4eadbcdf20febd1227ccb9f0e3e6c7eb2f5fb

SHA512
5eced0547c7929b0433c931b59e8f309d84a5117e7e38a04cd9bd0d6cd5f0f6fac9a454b2050ad1457c0401b59169d31a38b3bfa127c02f0ec5547b293d562e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
6b9829cb6dcc4b8106c1d7600756818a

SHA1
2b90a86ec01a0b63022e49658e5e5ef054f0f41a

SHA256
400eda6b1d413cda05befc3bbf80d925af343000f3afedebb222bc7174338c8b

SHA512
5787e4954ab77f8f85ac06fbda8f83b778ed787bf209192508cb05c7ae86781d0c64146354266c9cbeb79bcc498c46917b3a9d28bd6aff58d43297680ad19635

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
c2f6668eb27a27ab5cf4d4e698ae32a9

SHA1
567d3710b02f7af127ca42ba8bb832e84cef2a89

SHA256
f9442aef55f7925feda6d85c7b0aca1ecabdcb2b81d804f209e1aae9ee9a9e6f

SHA512
71f88aff812862930cb342a3fa0990f92d547aff92ceb2d82419ba423fd3f9f38fe89cf8334314e7c33965711d1f5c7c33d3ab3f750acd0a5fea4066b2ba1aaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
ca96023b3d311e950fc96e5c353d9a97

SHA1
37d157a8c963bf52c01723eaaf20da34152072c6

SHA256
a1cbaed57b0779608955f873c799ec417c79db96e021bfec3906c50048d19d3a

SHA512
6c730bc3183cd31e041d1b7c9a6868c841a8a0214c522c391e609548551fbb27a9850b86d9afbd968d6502c5cb7ac9b0fd0fbd2df13ccb9aa2b1683183f44f3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
38cb65ee1a9787926c721ef17a9abc3b

SHA1
0273c4b793d5e1b62ac9bf726a0d201e8a343520

SHA256
75199682b3b074440d1f70143b063e2cc65fdbe0101cf3cb601eadb23efa476f

SHA512
e504ec688f04714e6e5968c19e061bc7f35cadb3bc6742c2bebe0153d2d7c0c38911116d14e27a1630f0287ef296fa31f30537a319c39e734e0ade77a032cb75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
98e1e12064b53c81fc00ce0029861b03

SHA1
e1a51601225b9377c75151ad556e96c7fc4e1cfa

SHA256
0303a2535426fef0e0e66a779961777ace8e0144f2238b11d858d607835a5b9f

SHA512
1583148d8f4d4e3bdc2051be4b8fa32c1fe7106afd81cf1c311c3f878f512510b780a4ae436cfc827927901b93394a1da70aefa7d0d6a7f98938788c5043e014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
288b7918e50fba1373f601c9aa50e5df

SHA1
9a1fe88cc85d5ebc631771254d6a4052a29a9be8

SHA256
3a2b8bed6a35d25899559134e44f0617f55c0bcf0675fcfecfa1730f013934bb

SHA512
3673d65d42ccb172fd94da0bccc1807368abbc9db5d376a5f9f27916b767139a22f4bcc78e57d1a12370b33e9c4903298fe20891df12f8b350a9ea47218d4e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
20e1158cd3e49b62670cb5cbe6335b36

SHA1
b3a8aea7942d458bae5e00704de9bd9ba61f81a5

SHA256
edefd3e008396a67917defb14b8e2b03781a01208be53ad00c678f8c6206b363

SHA512
8f9f59ce8dafc53b7d746fa5560c6bb2fe80a7ed21d1b2af120441d0a4c143d740cf93a0493ce56390b9fd0b7640d0b505e21f8e03cc4501e0f72988a8aace73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
ba5fac58db832e522f38b5dc85184fa9

SHA1
8e356a699ed496dfdfd0cb67007db31d68c0a854

SHA256
229f919bcf3fbc0376e8cbeaeb1d8296dab858254c3d9f6a8b844c94b2579f16

SHA512
9e04adc8695c9e118a2fc8e505c9e9d5f5231b649cb0aa95481b3fbf99781346c781c12a242cd66eeeb560c5db67ee04a07b86c4ddfbbb160c307c3852e90298

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
89a7345d54f3bbec5bb3a9159fd7e161

SHA1
ff8ac7b9f237391f56068544ec6843e053fbac11

SHA256
b70f2913eee004a1b82f1cdec483115e3b17c7a77d8260915d904cba2156a234

SHA512
6a76e5eb4f1761e787bd8bc32da640ae4c2112baac6f4f161f1f3e2d8288ed12f2bdfc9641aae67acebf30e7813f8fd24ac12d97e482528a73eb547878a86b14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
36a515b502c3a34dd9e8c49a0be88073

SHA1
7dd04c0104ee3a16f285ff46c984364870d8fff2

SHA256
67b2216f701dd922984a7f86274faa900d8fd2d107b5324623134e12607258df

SHA512
defe441600138a257d47a205b4db87a22d94474e3b5a0933edbf20f3a22e727f7295b92cdb6ed1b7c4f6796d4ad5b7c96da930f7e65d83178b0d3c5b04869d1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
ea67a6d95f9f2e11ab16e21bfe6bee66

SHA1
99feac20046612e70065b5f59fe28e979255c5e7

SHA256
98959b6a47c503b2c3d47b89a8e573dd304a6d60539b36f1ba2989655c99f3a6

SHA512
0e7f1f08b6ae94db546db9b22973964beea00a94542dea96b5b5bcdd7416d81e5ed9b3a2734c1780d7758abfdd2020f279dc800abe6cea30592e0bc8f718b610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
13ab54bb8afedec24716665abce533b2

SHA1
a4da4fa5fb2d5a1415545fcbce6136dae6973634

SHA256
77430830e8b025f991121e69ffce093e7f6d1d08b902b103c786918055017580

SHA512
c70e3ea982e069cd39fbe3fbf3843c64af160d80798d82cc3d6a45864e6f422618abdbff1826bc3ace9a964c5f084c04f73905778c65a157519a6f2563fea6d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
b6d818f0317414ef3a0aa11b53bbc5ea

SHA1
1d56930fe0cc80dbf4220e41289e0fdbcb013bed

SHA256
e2b81aa4e859b0ec2c63ef0b9643db3075277da2a8ee1083bf5e8b5ac314cbbc

SHA512
7f3ae9b1919cba97991279bebb0a549abb3f12ba72c591f28ad34dc50fa36716397530e97ce0e9fb77298732a258ce9cefe8bc8fa38c5416e5d3a89817a6fbb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
37048b08b9a53aab20a1c96328955a7c

SHA1
ddea0710000d630721eb79ead5220aed60ed3d55

SHA256
330c7df371c9082c9cecf71bc7d70328f2872d37897037034796223fbdc4a8bf

SHA512
2a316602bcf15bb60af8d4c0147501e615d437b40f3f14387921ea0a9a3cd77a7fa72586bbfdbd8f7c4109d1256fa8614547e283c6caea41542a4551a26a3320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
f4e750795b8efde6cb553c9adf21ac60

SHA1
bc468de462dbff9fd500c6e75b4c0ecfc770ed60

SHA256
70174e36f18379703b477701806f2d622a94ad7856c304bb86785ac8497122b5

SHA512
498abc862e1d8411720200d6287efbd5956f2cfa18c6159f013be139bbb9cd39f8282219f9fb1c13bca4442d14bccc06de690a033b3be734b1e2107f1aab542f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
7070b11f2915c06d738020f4638c07f4

SHA1
2d63882a74875230d7d3e60b5fd63939aa9f8479

SHA256
33b799a9290460d2f30d409ad510477c6855aed9c0de5876c48aada231bfda8b

SHA512
1ca27165afe05570b1478c4dda93b590258ef86db7df4fcec4a94b3933f66e6a4a1e0f843046f17aa8d4da911055a90e5d5fe9b5f0436a950e08af71aa0a910b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
b731019f44cf2fede802f46a627764ee

SHA1
ef99387cef15da8c02474fa6d0d5c8f53955ac57

SHA256
e2b495cfe66493e21015960db6b6a73c38ebf9e023480c864e73f7e5f1011a1b

SHA512
b9be131e1d969a6abb9518f13402e1d4b72ded64243281d532535a0a31b606ac39ae38e526925dde8d69df60c2ed8b877a071ecbfd3b386215c30f80317e86b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
68a034be4a43340d19f6349be98a3049

SHA1
97d9811de8c0c9a827bef9427b7084f612826a2b

SHA256
aa68c8f080c508086457b4a8076a2d86b5299bc8bdb66a0eabc1552f63354a70

SHA512
c52fcf41871b74800d62826d721ee153151665931756209b75bf3dba5e9b4e0e495d0795a95415c473f75d76f5c0ecc9f1008dbd312d609f0203146b302a3d18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
7170735b16de86c5c742a9c72b4d9b8d

SHA1
d31e7db3d3d91ee8ce9e72051981d25bd3422030

SHA256
a7672679ebbb9a3e04611bc6650505da567a1446db7a9feec01d5b6fe6e36292

SHA512
6612a474a9e4af64eabb7ade259bc001d4a00ffd1a40a1b8c5372f95c838bf9da90c483ef9cbf59f0e0e0257f71c9beb6db1a729f6cc988cf549929125cab42d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
779f96d95777b3c66eface9c2c75cf73

SHA1
c8ce8107e880213077bf89246e5448c3062a3f48

SHA256
bd47381c4b3cc94f490a89a9d5b25ea516e987e3aebb9c8ca60abf520bd07823

SHA512
14c5d5e5c05c069d8512b36b323e80a8560dac958e48b5c8b2d8b0996ba2ff3bd814bc2d6fcfadb2ba9f3498c35a7444d6cb07319e9961b4d9b982aa8f49f802

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
7b06316b0f3dd583e3c86c735052242f

SHA1
540a4f9f6d6ddfe8aaed32b106452e33e0a8f9af

SHA256
0f6c04fde088bb2b7920d962505735fa957743787840601cb1135224e6542d86

SHA512
3a08da6ebca700e5954b7959dd072f7ee5c739ae800215022a42eb206fbc356f7656d3cb0b7cf0fafba3e61fb8c68bb641a34a52dcb0f640722392bab69ba56e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
39e22b70fc673f7441f6e2bb05a1cdb1

SHA1
2a04fad6c2585c81a0ae2f4df075a84c1fe13bea

SHA256
7bf3012dd5abe5b5fdbc1d3b99d4139b6162fbd32d26757ced8a1f7743dfe8f2

SHA512
5fa267f6f958efe7cca3515404cfaf1dbbff071553b521167dd868e10b5db71ffbff95eaaa6be7335c89f9b1e68820881bf797d8585f1a0afcc91fdc06f418cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
83c16ae664dfe024d60e97e2c9d478f7

SHA1
68ecab8a6fa2900af4073cd3ae50b9d7540b3104

SHA256
f60d1871b0908624038fa9988a7ab7d37acc126e8541bc4018c3218669b6df69

SHA512
0df68b6c3442dc6bbffe8645df0da12996a60512df9283281e47232aeeba59398df2dd91df4029c9d3298e389af8c68708d111b2e7bae2a5339e350ac7b53110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bb6bd7785f906a1dfcb7f2575f5035cf

SHA1
607a1868edc990aa9c73250d04453dee57e58008

SHA256
2fee850b35b728d117109f1fc92af3887e054d061c7e11fc51f26f6e27441c13

SHA512
a7b1efdf5e4c2e4640dd32e73757a4332b3cf066a561e55af54a213f4fbf79758282ac49f4495f7234eecc04daea805dd04d6e235887a15ccd32ea13cbf177e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
252c4135c2d99b9f74aebce892f034cc

SHA1
8ca61045c520177c2cfbbdc2ff6e09c8f79a9163

SHA256
242767db80efe9ffbb50d6e3a69c60c70091bd1148a57fd3cf558ce3089c7de3

SHA512
ff66e19ae435e032727f3b513f4b93f0568e473811f4ac4dc612ece3946b12168f36a03f8ccc1281e9bcd5fa48f9c122695bdfa717563882d3dc7803d5a9cc65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
4ead77433a6c77a089420e00cdd8d29e

SHA1
69402cd57c6b947e5b000384f8acf465104a2fd2

SHA256
32d9a2569e895daf161a069603d38cfe3a93f7d3b7a1f2bfe983a987d1c40e31

SHA512
0d330c78dbdb28df92167a7c74d45f3e453db6ee39b1ce97dc27c9d9997ee949005adfbfcae203774ba485e32cd2b445cec76aeb0082179c2ef8288787111890

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e58a2128bdf93303d98aeeba8077233f

SHA1
98e5eae88f25dcb4ebf4dfbeaf7117637765482e

SHA256
8bfe8f039a1ce2de67b4f5b6b6963a43f4c8e413549784caa0584932a3fff4fb

SHA512
6426301617fc06edaeac4cbcdabf17d76232eaddef12d51fa2bc483599f2d64c45fa994a90eed696381eaa7502434c7cc2aae3e08ebd3d6d200166971484259e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
3ad438406da0b2b1213b3eb555bfcf14

SHA1
7717341a58d73c373de9fa17dbc37a482b5256d4

SHA256
842db6fb70c2b7b7f28655e81a564d330b0feb24b9761b7e688396806c1d6ce9

SHA512
5714374da4bbb86ca299d16cbe117607b0106b4eccabbab7b59a3db7f4aedf234d931109decfbc5cacf5b03305ece686d20d3aa843d60ec3df1b01f428cd6535

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
c8bbaa201fab888df44e65ea39506edb

SHA1
f62ebdda02cf503214ec424afbdff7a6e86b1268

SHA256
f9b21d5016f854e4a32b76c2eb5f9260edc746de0d7999e39a0f7fc4d849080c

SHA512
d6889a6306698f69d4ca6911826acdae70e60604db410ff29ecfbe19cb50aa09d7826846d076be0b016b5b28458a402773c2e0f57db5df58c30b609bc41a09f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
adf49156dcf914748bada1dbadf61e30

SHA1
113985adeebe33cbadca29cbabb42856ba070351

SHA256
73cfd9d2a2e1cea346b8614ef79df3f1c0552dcc4e5dcdbc907140d597ff692b

SHA512
51714a9035ea8a831373f609417909df89e13e3cadfdcbd37b8ad028acf14ca5cb027c407887a7c85e4e59231dd32fb130338cf9984a0997203a3d57d6ac1c89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
b29ea8d28ca868df1137c18aa0193db1

SHA1
ab590b86429dd2702db307b83fe477120828c7a3

SHA256
97ca220281e5ca0f6289ca8b1b712244626ec3d9058e8d9c6ae62fbe15f4f575

SHA512
70e19cc8498908705e3055359cf6e490b2cb5f088e68c9c9611c8753875f4fc1a034b87a415d5e28ca78c8047f0bb5a48debf1afd8abca0d7b6a5fddc83274de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
5538dfbbcdc0da68b5cc238d650aa069

SHA1
1c1c25e4a77501262cd3462cf0a91c253ccbc34b

SHA256
bdc29f7a04803938157cf40bf3e6198abc1c018b3a2123664d635b8061b96640

SHA512
950e953d827973d4f8a50de6bb23ee2d19a1565ee0f6d6dfd73a827f66f40ba2653a09c33d81409d07d5b6fc8d0163b6ea4741a5834e9ef0fa33c9b9ea039548

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
1dd5a410025e481327dcb9d36fa5806d

SHA1
a28e1e4282b6bc5e7fcaa7aead9fc6f09dd6fa3e

SHA256
4736bee88d8de53e32b6f921ca4204831a402c8507b771468ed0cfa81d1ddf26

SHA512
1fbc8cbe787f8501894efad81094669f9b9105c374f9b630318bd23cec9334c76c9664b757ef247db7aee7015043980e8bfa4340efc891e308dabefdab44783b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
631be390fbec3d5e0c66d7716a86a65b

SHA1
da4d29a89ac843d4683508652bb59b10a8c7d4a7

SHA256
193193ac96624db1fc7f5eabe7e0b01844bdc81db34d2e40c42790182f1bc756

SHA512
3623a21a8faf5affe37d9e46aab42d285a863cdc7c0ab3709abdfc66c000f6b9b3ce8c0eeb14cb9495c65692b8636a79672594b1b3dfb35fb76f16cf669391d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6861d4dfa5987b177f8abf05b73b1e4f

SHA1
6626efde6d758471e2b8386152675e54f61afdf1

SHA256
3e2ad9ac5aa7344cd23851d935d6570f10048bc2bf9a8a7dd75fe27e778afb88

SHA512
772b591848886397308d091d8cbd5eb92cb04c1605cbd6d10a22ba473d4f6940bd6dfb3e929a1b05236712d9beb6fb67fc5f6752d8b6d28c9d2da8e9da6e2beb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
1c765e1deddad75831e3b7e8c46fa668

SHA1
09cbc0ee046350efe2168eb6e924a9ccfb18b73a

SHA256
8696616145f397a7d169b92ba2eed7b0123d5f974f74c9c54c45b97e16f9d1d8

SHA512
945287e8aa9e68b01bd42125950ab80586c4d1a9659a935d0fad48a0f165717ebc0651684716241178298081c3070e3923d8e88e26065a5ada7e0618f1ad68fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
a4a89369a7079988d31bdc62d5604803

SHA1
9b86dbcfb45bc4bd12a0a7eba58cea7c191db5a0

SHA256
731a1a0d3cdeed30043e6f3fe93cc91489ec9b2f69638890cb88d7da17d85e16

SHA512
80d0a2e3e1c842d1e66410c757814645a0b8ae5f114ec5ef292cea02529d6a9d4433f083eeb53b632bda60e343c5373197c1257f31b6576cc33eaa60e8f5fa77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
f09cb7e1c4e97060fb54a85eccf34f89

SHA1
629f99b51641fa5668fbda1e25f0cc4d796d6bc5

SHA256
ed5c46fe940680d83a29eb91812c9f0d53ed9ca9bdf4122ffd5591dfd5bbe592

SHA512
6d25f6692f63f43b49a4eda9b249d05fb6df392d261b1e08d4ab3709c16c5e2e0d2aeddb07e46b6d02bf910d773f73d5a1771199d19f7af32b4a53e74ad441e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
c148170ecfbf0ae82c72accb6049146d

SHA1
3299313eabc23254ee39252d8a539ccd99eeb17d

SHA256
6d7c0e31e11ba01f7247eaba1e6829cd58e2f230f38b7f2ebcb73eb5ef78e992

SHA512
c18e20e773343f2a00061f9823386ce8fbb7259031cade09970cc369c881f262796da262405ad6589c6c1da5ebc52dd40d9662c4064ee2de64c4856578880883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
aa6f65f9f3278a207a167f67532d6aef

SHA1
46932475f95c445c7f3452c4bf59dd15b2a41218

SHA256
98638f688cfd86f3f4f21d8345dbb12b36b14ce4f442f78d675f71d353e0c86c

SHA512
52175222a0ba0351e22d0eb52837d5f292a53941826a32ec436e33e398416121794e5b9285eafba9564d0fc8ef39136d89a194854f11fb5b00b816a9a44c7ec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
e1b763a70b652650af22c2c795490242

SHA1
68c39e587f503e70f83d5e6a071e2d310aeabf6a

SHA256
a2e4d4eda5ea9a617c3ee5a887305a2f44a8f26b84e50edb4508b22b63e9f5a7

SHA512
023a31f4d772e0490abc8dfd9ed85b91675f469b5784a554e64ef73fb845f0e322ae30c392241d9d632d1770d9bcf08a60b221f8cc678d6a9bdaf3fd10fa43b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
7b08b744dbbadf4861b4bc98b3b3c4c4

SHA1
cf61648ac12de7e66a16d601f5693988a4155cf5

SHA256
c536358dba83b5cabab664e2283b47824a6bb2d7bd7e6d8adcee68154fd2c51e

SHA512
98f31c8609cbc3bbf4360559278e57e4486240578c3acb2854214f5372510bc71d30f09dd0dba94fbcc2f66215bb629ab5d586266c1e2d2ce0fdf96db01685b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
bffb9e3e1577fdf2b94c2e73a0abe0a7

SHA1
ea07a9e9d2a58dface6bfb1b66672c6e23a33924

SHA256
9c07df0c48203af45fb60bed176eeff6ba41336b70640114f6af8b9e182d066e

SHA512
fe4aa220df4bea53bb47ea02602b5150decbaf0a5d9f0aafe3c9a19f821d18d66c3b62e1fca20ed477a78ef01fcb4ab2f1b193c04afb4361c4189b9c17a88d17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
cd7f02054e6ddd8a807a9d56964b9f6a

SHA1
7dc1cc5c44bac6f6222b06601b6dd4ad043297e2

SHA256
491842a674421f607558c6ebf5eb9e7fdcb1fd6e9ad149fb00a7f967bed14378

SHA512
5f0515a05c7846fbfc73b3db2cbb0cf7810a6d2b7f1b57b5e22a811e0dc2e84c084e2a1fe12602fbd4fdcbd4266f2cf62a84cbe6eae623b8692861eba4016cb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
65c303d951afd893892ef30e5a7d1853

SHA1
c06f22c266dba6f653ec3b89b4ce5e48a0bdb1be

SHA256
13a5a2d34a066d154b53b34103a1d715ab4091959daab7a6c780fd1bb1c22f59

SHA512
547f243714355808a0d84764703c4741f485107c14e5baec1debbc32fc075b8b7c5e5d90e9b1ce0e9b87e24006c070d6542499529edc8a282a1b56429e09bd02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
37f80fc772fe16d407b7c78ede9565ed

SHA1
f3a868544fd337480802af83d6a4790cb1f41d39

SHA256
fb5105d19d897865774f3eeceaad6a8be3f056daa950269a03e84278b1d19638

SHA512
82dbf24393e813a49e9d9e3763b8900fafb911bf8e1a0064976a1b166fc3e18ff983e022ae686a3862ec23e4927f747c17cc2886e674a21df9cb73c8ad6899a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
a09507a3e61839dc723edec4aa4122cd

SHA1
5de9ae58601bedae60c162c3aa0520f6099fa256

SHA256
4ae9dcf20fab0ca28d1770499e8e68f3fd0b89fa717a8f733292ce1e3177d039

SHA512
48c9df5c39cc6ecc049a54aa7e92e70f4cc88885d0744c88657b23bb59e04fb7723d184c93eca5ccaee3574e0527fce90b27a15346fc1f9664a7d4c96827e721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
caa0b7fa1744e4faec95f3add2ba5eab

SHA1
331581e11da5fd7b4ffac9c98784bdc6975282a7

SHA256
f2324cb2c441b1f251206e20251d546a3075687447b9aeb52e05538f7d9d3f3c

SHA512
80dbd9933e9631e30a0a77748dc2941d4b163cc63ddb7ccd2bc9b2678b9486cf403dafa5d23b019d1e3bb69228d5883a74048c3384d116291c012e719bc4159d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\03501080-a5cc-4d52-9d8f-c92d2a733353\index-dir\the-real-index

Filesize
3KB

MD5
035a70094cebfc3c31415b827970386d

SHA1
eff414d8cbf02cd27e85464449ba51cabdf34dc7

SHA256
8d66e2d63652cfe2f7ea50dae0f1da0f926c7195ae027bcb7902bde3c94c9caf

SHA512
77dd0645e6998cb1f2ed0d24c455766b31fbb4a838eb06f7cb3e09ae83c7c3085c43e473c34319545e870e5037be374eaeae02b350510c2116325a658218fbe6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\03501080-a5cc-4d52-9d8f-c92d2a733353\index-dir\the-real-index~RFe58efe9.TMP

Filesize
48B

MD5
76975f783de69725affb366b3b82891b

SHA1
709c2c7ea6a36d0e4dc5917fe48f7e4b5b4cc603

SHA256
60324438dc577217a8fda90b728f529b782a4dbbcb02d4ae9facbd39600753c2

SHA512
0b0300f53ee02b45aba829b4f0dafcd4cf48cc8cde27f9d2ee02e9d0169c27b6c86cfb5d1515a2e0b3ad1ebf3fa1a10f291571b22b0235d9a24552a5d01f34bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\925a02cd30dd2ad1_0

Filesize
125KB

MD5
c8cc908e95fec7002292a39fb4683eff

SHA1
e6179771e2fda24969966c02e35c760989ebb407

SHA256
71d4442afdad5eb59d55e04b13959bf2553c561abecb08cb5d17849eb68c81ed

SHA512
770fa23569fe9e720ab56f4a5e5a97cdad7381a777da4f206ebe921b32cc5111307e435fe92d89e151887ab11f4206a504cf62ccb4884cc32e807d224318c1be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\index-dir\the-real-index

Filesize
72B

MD5
aa0d12e7754faabde4bdc2edb8e56562

SHA1
8fefd9bc97b9fffb0f7863afb5ecd8eedf18a2e7

SHA256
ad3e059ffff2eca48849f12031e6c6052e2907516281a1aeb932b5a2a087d8ac

SHA512
e3174a79a079ffe401afb25bd047dc56bf2d502b94349a8661c61dff807976cb402660ca9b16d962807f57af4d57ee61c94ed0cfc247c3759e93ecb34df233df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\index-dir\the-real-index~RFe58f056.TMP

Filesize
48B

MD5
b6ffa6decbe05a0fd5b5478009ce9205

SHA1
ea4a0c72f5e97f30107c6285277593226051a8b0

SHA256
935ce41ecf3e8d81e16d3827c64200e290e0ee3dd24cead24fa96988a361b636

SHA512
76fbf25de2654715a7f76bb2f94b31c7a17e68a48b3c26677bba5ce72dc5451f0e2d50908a539a4f49089660c6e9669c766d37a48b418b4cf5615ec0b584977c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\a9976c73-1fea-4f73-9b28-c78cf6f37053\index-dir\the-real-index

Filesize
72B

MD5
5cfd4093b69fbdd4cb5bad521b363b08

SHA1
ce09e3b6d5401a76f2017c74a54706cd6d0db034

SHA256
6763bd58614f37ce19e039c25e2397cea7f62599d6aef0fc449a8d11fb23850d

SHA512
4025576bca95e08bffd57ce474e669d6ab008e307052c05aa867c9b5e9c733fbecc3f66ccbc5c4f6596cb157765822eaef25dd8091d55ecf1b9b71e4a0a01a38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\a9976c73-1fea-4f73-9b28-c78cf6f37053\index-dir\the-real-index~RFe58f085.TMP

Filesize
48B

MD5
1de43bf211cee30963029ca7b7a14569

SHA1
8ad806f7570c7f23b275e282d7b15ce9a2487108

SHA256
0a2e66fdff25e5814ac54f56e25beafb745f92205ec7714c5c3037aba3c18eb3

SHA512
67061ac809b3660401ab795309d5440f29cda0d11a252419696154e5c27d77dbd3a6094a243c9d09eae374cc529d57303f20cb004b0b72b7e47adcefc5f39243

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
202B

MD5
2c3187afaabeb3b2c2de22303970674e

SHA1
806a43984e4634e46e417448b132746735eb7723

SHA256
517904cad16dd948e8a4284185aa29b27ab1198356604f89bb9321219db6e1c0

SHA512
3356fee69d0c69b48adde8f34f1feb258b824cd6b8d297a307dc968e4a5e4586b81affe9ed9ee7a5c50dd286cf296f141461e834ae807620025e623bbefde8c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
262B

MD5
d3a6fc733364c1752503d7214090a810

SHA1
88cb94ab421c87af73a5cedbea4d838ceb9f2488

SHA256
33e39300ae164bdd9c539851d64941bc08ccb06fe1584ca9113a09a1baa7f73e

SHA512
815c1b8ede79b5ed509b0b131dd47b621295bedbd882cd6ea531cd33c954712c4488dc5196bee81457e0e0531fead072cbae70733bf761381ae61f8e8edb23cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
256B

MD5
4dda944d1b9b8b59e1147c5a77702409

SHA1
15ecf5f14031096e9ca48c6d81e8dc5ada28c0c6

SHA256
60543ec24e2a4b42ed4a6a0c6680d25243f039dedadfb1a13ba998a9973b9484

SHA512
94e0202cc18a3721f2643966362db4ca31e604331c3a9ef6c3f637e641bb0e075579580412c22b2d00fac1df7677a7d602438f50b98d6a896b4f2433025254b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt~RFe585f13.TMP

Filesize
112B

MD5
f8e71f24d8c0f08a2a826ba8f7fcb189

SHA1
d1c436cd63d3c46c204554fd2093a6aa294cdc64

SHA256
013bb18e5c60b2ccfeb5a46305a76fa54d2fdb62bd4883970c54ae4f3e878739

SHA512
fbc2d0fd857b4dd4ba60ada6a143f9daf48c035fb9a1d4024ef004c64987e7ec076df85e89d664653c6909a1590ade2a6d80bc010a0d0a4c31027fd56d4da852

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0

Filesize
19KB

MD5
bcffb6a82b239a0f4fc0cd741bd9ee6b

SHA1
669a2ffa2052ac667ef41b880ca00819383e97ac

SHA256
bd9d13363efe3ceedacb9114de16cbcaa1dd2cc42de37bcd3c4fa1f9de02e119

SHA512
71cdc9309c6d76a93464817db4efd3b66d799474848ceb598687d8e0f058f708c5a0b2a27f0d4309611ea54105844c61e97ffe2fe8f79fd28d7529402208ed41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1

Filesize
58KB

MD5
c3cc11763e8e8992a61c31e4a61f008e

SHA1
3c14b70f10482d9e30be9f6721cb41a90d21983d

SHA256
63f0fc0d928b408cb2b22e824929b9d7f0fed78480b12bcbaa48f60c079fa387

SHA512
4637118cdbd8863c747a153afb245d1837fef017f685184596a460b8efef3ac9c77b575656d1f407045e6ccf22e19523adfae94395725ba73acf9464a4b28385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

Filesize
17KB

MD5
32235cd579cd534703091fa5a17971d3

SHA1
3d87b637ed1b31023b07d2f89c13bf70452ece2b

SHA256
0c4a1593e219d18ca47964bad027e3a0a7a9e6336ae6d472ee9e94df3d0900b0

SHA512
b368d2ad25cd3d3dd95307efdf6369da04d5c4d1edaa0d50c3529c4c46b217ad907a16894ed36276f320e685b6c931eebdd759fe8b765e2e3279fabe6c7385f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1

Filesize
21KB

MD5
b91cae7cea8d4027291e3f7794e830e8

SHA1
904cc5a79db9beb89c4d64d98649f9376b2540f1

SHA256
cab6c74dab6b9483b6ff4288a2096bd0310908091ee4b216f2245ac814e046b3

SHA512
e745e8b853295b5e0e1d4702d6d987d47d058a0a2cb7f2ff90507cb2bec70bcc3dad0aac5056d3116a7a6c2b69f387e903d2e7cddd2663485d1f5ef17e081924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0

Filesize
14KB

MD5
a500f2f9535b832cd5db93a219175aac

SHA1
ee8bd33619d5f6acbd7878e2f9f816109f2fadb9

SHA256
64deef085bc6ad463b6b44e8a4c54c2941f9befa5dc2b7e24ca6fd30096f37e4

SHA512
fdf3689ff14b95cce2e172c650633a57b846a1c31456bd4e42cf50eb046e9cd8f5807c502f9ae6ffa5d959c3be30eff6a7c52f7d4b0e9077cd1a474b88a5b1b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1

Filesize
40KB

MD5
5f85ab4b4342c7e56cd396f79fdcba96

SHA1
fcd047bea513845ac3283a3414eb55e6dcee900b

SHA256
07a781ad2f2ceb3f5e8861d2c07e1b88c6142e551672c6f82777429acd0011e5

SHA512
bdc0fc77aedf5ed04e8a2c434f060bac89324b3063ddad448666bf025c921f6376d4ebf9d7e57a70c511d0c148252b784a01a0999845e5a04839addabbe393f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
144B

MD5
4cd0bf2347a05e4ecb377535a5da747c

SHA1
3f1d64445184a1f5b56ac5341063001364e7caeb

SHA256
f6169f1c35092385553b624d7a641cd462fcd84802b4bf3969c450ad322c4b23

SHA512
245b1dca64cb0a55e891d5c580f037bfc380cf355edb4f8060f8049eb60d2c80aca06058fda2fd28235eda34a45989f16fe5a18d3c9539550fd2a8a08a0fff30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
193KB

MD5
198912312772a71a019ac120516be5c9

SHA1
fad1b228a7959eacf6a90641bb9ef02b8bd64b93

SHA256
22cba29f8869ac9ab3e036b7835980339938f74dbfffa307cb238e17d9baf296

SHA512
e104b6945d34598dd02f31da74c149293fd66212c5dc79bbab82a41a2e89ea2bd689d53d1138ddd6af9893ccfc992ce349c8fde043cf504b4f6f22ebd685ad40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
193KB

MD5
9e6598db73339c042fdce8fa48267ea9

SHA1
e44298651691749feeaf8b72681af50cc62fe36a

SHA256
eacdc27d9fde1834b0be1e8fad31440b2ac9769fb71ee0e2145c3ecdb99c489d

SHA512
6a31d469f8fb2c16198d0ca8c9774e3e07c9a12426731c462bbbc48a7f1388b3b7b7834a261dd8d5dc45b31b986b0f4441c76b0595fe728f47dc5e33a4ddf283

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
193KB

MD5
ecb6b2b16445ff25e23ca07799ae3439

SHA1
fb67de528d8f8548cee7b459818528527555c2e4

SHA256
492114560898e08a4b5083df828563a47090c0f7660518f6ca06abb29ffec81f

SHA512
1e5c39c2b733374298a9302efd195c01888609ca39886b5efb27db5ffebce59fdf53bdd727ab77466a0c77552c33cfc82e99c6a10d7e9b0a1bac49554acfbc94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
193KB

MD5
0894653907152ca74cd73d0a686f988e

SHA1
80009456cc1008a698f6ac5baac3d525982f3e4e

SHA256
1efbc04684cbd94904c048a71ca6475b3af6e951a0ba1c7f27087bef1e56d95b

SHA512
3df9a677e6ea2b36987c9e701b4702dcf38cb234446f1e83c634489a4a88c4996d3808840c92bc4383c2081176e78361698d02fe76c7abc96b85559f3702722a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
193KB

MD5
d69632b779c0fc5db2fe5dbffb7404f5

SHA1
c2b6228e33d66737f6d19e1ae85091afadd79a99

SHA256
eedb07ca8359790516b74184112cbdc2baa75d0dd9a9b61c1fc0f96e85c18fd1

SHA512
0333749e37b710054205b1596d365d484c087db20aa9ad0c26a098d08284796c9fa517f58fd2b325864e5d5451fbad6c0caed835802c12bdd7c237130c6900a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56eada2ca2f2913cbf0e4ddb82dc9aa0

SHA1
e9da169fa37537e4be8ad40871603e04645a8d95

SHA256
37e5a2e4a233ee91c768ea827e48832f6a66892f1c63f27284735bdaaccfc983

SHA512
de43823501d537a648351b6dc59c5e9e4ec8d57825a5fb6b7547af5ffcebd882ce3ff12bbd661086dca5196470c63c284a40863cb515ec2f4ac5c4769bb9f620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e631b89044e6e80f728fb301139a954

SHA1
1b4ef30eebde1a78f91cbd3f68ba71aff1bfcdfa

SHA256
2ac756f03d1619f231cc6da540e5813f1cdd70e00723e73bcb6a64d88a5bdfc9

SHA512
08f9cb80d89576a832a11e4e76c358048d4f0de509813cf5e99c7cf726800cd5d54f4fb509e99f7270f84b65037d479eaeaaa60b29a758ea9ab80f4594d8e2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10596c550a3f02cd952baba8b37ba309

SHA1
56ac4c28cefad4f9d5d32bea6899e610945eab0e

SHA256
412aec5dbe1b0b22196778f35ad030bf22164b744133de4698f7ca87479ff5f6

SHA512
9011ba6c6ee81f9f70147727c0c9c9ff4850abcc5c6a8c0707aee0f109eb0742bbb0c02cda9272ef5d86b8333221217a5919dd40adbc53e8486ba4502c95d2cc

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\576e1c153e9a4c8db9cb845a7679bfcc

Filesize
5.9MB

MD5
576e1c153e9a4c8db9cb845a7679bfcc

SHA1
7fa5235289c1eb038774cdcf30be21cb72771201

SHA256
da54941bc273cb5ea3c50a3df7983f6560114d0e9f6fe196a2077e3810f561dd

SHA512
a4d956c4c860ba9b652647c4fd94ba0a617d1ec3436a8fe267292d36b38805acc4f484aa65e9c45e20c10536365a13645d25acbdc4c23e7506829a6f603820af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
83KB

MD5
5bebc32957922fe20e927d5c4637f100

SHA1
a94ea93ee3c3d154f4f90b5c2fe072cc273376b3

SHA256
3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62

SHA512
afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
122KB

MD5
fb454c5e74582a805bc5e9f3da8edc7b

SHA1
782c3fa39393112275120eaf62fc6579c36b5cf8

SHA256
74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1

SHA512
727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_decimal.pyd

Filesize
251KB

MD5
492c0c36d8ed1b6ca2117869a09214da

SHA1
b741cae3e2c9954e726890292fa35034509ef0f6

SHA256
b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1

SHA512
b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
81KB

MD5
dd8ff2a3946b8e77264e3f0011d27704

SHA1
a2d84cfc4d6410b80eea4b25e8efc08498f78990

SHA256
b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085

SHA512
958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_wmi.pyd

Filesize
36KB

MD5
8a9a59559c614fc2bcebb50073580c88

SHA1
4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d

SHA256
752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12

SHA512
9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

Filesize
30KB

MD5
d0cc9fc9a0650ba00bd206720223493b

SHA1
295bc204e489572b74cc11801ed8590f808e1618

SHA256
411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019

SHA512
d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\vcruntime140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
7KB

MD5
bbabe6e16b6b1cee11b883b094cb9fd5

SHA1
d7fe2f511d629ca2785b6a283e50ffc395477d30

SHA256
95d33c4593a527e9bdab099badc294bb5583a6eb9f659a4be3e741306d5eecfc

SHA512
5a0a8b187ea8890a69e3ba4709162b86d600a59da9852e06280d24e6026646e9d6d27341253189d63ed0c5e97ae0500fffcda6ecbded9be7bd9949e94d87e0f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
cb754e7f6da10751afcd008f7fa6ebda

SHA1
3b101168faa7877bbe116f0884241e73905db65a

SHA256
c6b934fe52c7b420aaaa12af717e9638af7d02f2e9009cad9d19282a6289e5ad

SHA512
e12b50de1e1830b2a925199d0ea94508816de4ab057f103600517fc3bb7175155b5e9cd92744285d7f8d5606f14301a2f949e183dadf4a5d5291f2b3512d1c48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
f8659fe78df21a059db9a17e370212c4

SHA1
84ba4b95f6a8dd52d81da44631e793399d4f3c7e

SHA256
c5eea304bf57b4a529643b6154adcd802dc606b6cd0b76c2031e08872caa20c9

SHA512
977d40732995ca4cf59338f023545e22470b070abfe0f639b30f29a5fc67f89bd77694a4dcc75bfcfd5674a71477ed13405a80674121c7074c1eddd5495c60fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
12KB

MD5
a425b5063b572fb54c2675077a3e3f1c

SHA1
15f23cec2e2dddf826bd4d6b03cd700cd814cc96

SHA256
fccdff3ae93cb132ef9689a7896761c3cb2661009787689b81e897f95892f650

SHA512
bfe59b2ca873bc709434726d51becae187188d612c609835657ef5e0b5e2b08429604f34138ebe8a456a549c07f195c29267475c3aa0cc24851db4d6743ed4ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
11KB

MD5
36b9d029c69f3aed28c48f3c25e04eb7

SHA1
0ee72d92cf1523801cfec5cba46110e4230a51e7

SHA256
7ebb4b3fc7cb732503b630bc2ab389060af032d3f25fef8734c2e24f0d4641f5

SHA512
ffdb4d6972045508969e9d9a46d04e3d23fc964c113685de1ab9daa145300a861b39d463cd105032a43c71361569dadbc07965906735df8086a511ec59bfbfd3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 274056.crdownload

Filesize
5.5MB

MD5
3191d6165056c1d4283c23bc0b6a0785

SHA1
d072084d2cac90facdf6ee9363c71a79ff001016

SHA256
cbd127eca5601ef7b8f7bec72e73cf7ae1386696c68af83a252c947559513791

SHA512
ac0fa1c6e8192395ec54f301bc9294c2a13cb50698d79d1ca32db9d4deb4852e7607032733d721bc5c9fd8d1ce5610dd73b30b66e0302141377f263a3b7fa0f3

Download Submit
memory/392-2810-0x0000000000350000-0x0000000000385000-memory.dmp

Filesize
212KB

Download
memory/392-2943-0x0000000000350000-0x0000000000385000-memory.dmp

Filesize
212KB

Download
memory/392-2811-0x0000000073240000-0x0000000073450000-memory.dmp

Filesize
2.1MB

Download
memory/392-2855-0x0000000073240000-0x0000000073450000-memory.dmp

Filesize
2.1MB

Download
memory/5916-3777-0x0000000005CE0000-0x00000000060B6000-memory.dmp

Filesize
3.8MB

Download
memory/5916-3778-0x0000000005B50000-0x0000000005C9E000-memory.dmp

Filesize
1.3MB

Download
memory/5916-3776-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Filesize
40KB

Download
memory/5916-3779-0x0000000005290000-0x00000000052A4000-memory.dmp

Filesize
80KB

Download
memory/5916-3775-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Filesize
584KB

Download
memory/5916-3774-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/5916-3773-0x0000000000350000-0x00000000003C4000-memory.dmp

Filesize
464KB

Download
memory/5964-1798-0x00007FFAF9480000-0x00007FFAF94AA000-memory.dmp

Filesize
168KB

Download
memory/5964-1591-0x00007FFAF9480000-0x00007FFAF94AA000-memory.dmp

Filesize
168KB

Download
memory/6132-2988-0x00007FFB151E0000-0x00007FFB151EB000-memory.dmp

Filesize
44KB

Download
memory/6132-2959-0x00007FFB163E0000-0x00007FFB163F0000-memory.dmp

Filesize
64KB

Download
memory/6132-2958-0x00007FFB163E0000-0x00007FFB163F0000-memory.dmp

Filesize
64KB

Download
memory/6132-2951-0x00007FFB17280000-0x00007FFB17290000-memory.dmp

Filesize
64KB

Download
memory/6132-2950-0x00007FFB17280000-0x00007FFB17290000-memory.dmp

Filesize
64KB

Download
memory/6132-2949-0x00007FFB17170000-0x00007FFB17180000-memory.dmp

Filesize
64KB

Download
memory/6132-2960-0x00007FFB16470000-0x00007FFB16480000-memory.dmp

Filesize
64KB

Download
memory/6132-2961-0x00007FFB16470000-0x00007FFB16480000-memory.dmp

Filesize
64KB

Download
memory/6132-2962-0x00007FFB16490000-0x00007FFB164A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2963-0x00007FFB16490000-0x00007FFB164A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2964-0x00007FFB16490000-0x00007FFB164A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2965-0x00007FFB16490000-0x00007FFB164A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2966-0x00007FFB16490000-0x00007FFB164A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2967-0x00007FFB14EF0000-0x00007FFB14F00000-memory.dmp

Filesize
64KB

Download
memory/6132-2968-0x00007FFB14EF0000-0x00007FFB14F00000-memory.dmp

Filesize
64KB

Download
memory/6132-2957-0x00007FFB17360000-0x00007FFB17365000-memory.dmp

Filesize
20KB

Download
memory/6132-2969-0x00007FFB15000000-0x00007FFB15010000-memory.dmp

Filesize
64KB

Download
memory/6132-2971-0x00007FFB15170000-0x00007FFB151A0000-memory.dmp

Filesize
192KB

Download
memory/6132-2972-0x00007FFB15170000-0x00007FFB151A0000-memory.dmp

Filesize
192KB

Download
memory/6132-2973-0x00007FFB15170000-0x00007FFB151A0000-memory.dmp

Filesize
192KB

Download
memory/6132-2976-0x00007FFB15310000-0x00007FFB15320000-memory.dmp

Filesize
64KB

Download
memory/6132-2977-0x00007FFB15310000-0x00007FFB15320000-memory.dmp

Filesize
64KB

Download
memory/6132-2978-0x00007FFB153C0000-0x00007FFB153CE000-memory.dmp

Filesize
56KB

Download
memory/6132-2980-0x00007FFB153C0000-0x00007FFB153CE000-memory.dmp

Filesize
56KB

Download
memory/6132-2981-0x00007FFB153C0000-0x00007FFB153CE000-memory.dmp

Filesize
56KB

Download
memory/6132-2982-0x00007FFB153C0000-0x00007FFB153CE000-memory.dmp

Filesize
56KB

Download
memory/6132-2983-0x00007FFB151C0000-0x00007FFB151D0000-memory.dmp

Filesize
64KB

Download
memory/6132-2984-0x00007FFB151C0000-0x00007FFB151D0000-memory.dmp

Filesize
64KB

Download
memory/6132-2985-0x00007FFB151E0000-0x00007FFB151EB000-memory.dmp

Filesize
44KB

Download
memory/6132-2986-0x00007FFB151E0000-0x00007FFB151EB000-memory.dmp

Filesize
44KB

Download
memory/6132-2987-0x00007FFB151E0000-0x00007FFB151EB000-memory.dmp

Filesize
44KB

Download
memory/6132-2989-0x00007FFB151E0000-0x00007FFB151EB000-memory.dmp

Filesize
44KB

Download
memory/6132-2990-0x00007FFB14890000-0x00007FFB148A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2991-0x00007FFB14890000-0x00007FFB148A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2992-0x00007FFB14990000-0x00007FFB149A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2993-0x00007FFB14990000-0x00007FFB149A0000-memory.dmp

Filesize
64KB

Download
memory/6132-2994-0x00007FFB149C0000-0x00007FFB149E6000-memory.dmp

Filesize
152KB

Download
memory/6132-2995-0x00007FFB149C0000-0x00007FFB149E6000-memory.dmp

Filesize
152KB

Download
memory/6132-2996-0x00007FFB149C0000-0x00007FFB149E6000-memory.dmp

Filesize
152KB

Download
memory/6132-2979-0x00007FFB153C0000-0x00007FFB153CE000-memory.dmp

Filesize
56KB

Download
memory/6132-2974-0x00007FFB15170000-0x00007FFB151A0000-memory.dmp

Filesize
192KB

Download
memory/6132-2970-0x00007FFB15000000-0x00007FFB15010000-memory.dmp

Filesize
64KB

Download
memory/6132-2952-0x00007FFB172D0000-0x00007FFB17300000-memory.dmp

Filesize
192KB

Download
memory/6132-2954-0x00007FFB172D0000-0x00007FFB17300000-memory.dmp

Filesize
192KB

Download
memory/6132-2956-0x00007FFB172D0000-0x00007FFB17300000-memory.dmp

Filesize
192KB

Download
memory/6132-2955-0x00007FFB172D0000-0x00007FFB17300000-memory.dmp

Filesize
192KB

Download
memory/6132-2953-0x00007FFB172D0000-0x00007FFB17300000-memory.dmp

Filesize
192KB

Download
memory/6132-2948-0x00007FFB17170000-0x00007FFB17180000-memory.dmp

Filesize
64KB

Download