90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650

Resubmissions

09/08/2024, 17:15

240809-vsxthsxbkh7

09/08/2024, 17:06

240809-vmkxrstamj8

Analysis

max time kernel
417s
max time network
419s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FluxTeam.zip
Size 34.3MB
Sample240809-vmkxrstamj
SHA256 90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650
MD5 eaa845a8cabd9e13151786580b122e99
SHA1 460d005a4cac062a86552977ff6b7bb2f95c02e2
SHA512 c5a39b3b4b1462e537a811738438a3397005da0620e56474165246ead33c0663c571a3f35ad632f79baa62ed2bf54ffb08ebf53d8a48d269339c7e6c2fb5d007
SSDEEP 786432:CjyaAFZvok3gA/rbFy0Uf0dmAPNoDAyD8nJ3dnXqEOHsy/TZ:C2a+ZvosgA/Ny0Uz0oDAC8RdIHfrZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
5964	main.exe
2168	RobloxPlayerInstaller.exe
5564	RobloxPlayerInstaller.exe
5644	RobloxPlayerInstaller.exe
2384	MicrosoftEdgeWebview2Setup.exe
392	MicrosoftEdgeUpdate.exe
4836	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdate.exe
6120	MicrosoftEdgeUpdateComRegisterShell64.exe
5768	MicrosoftEdgeUpdateComRegisterShell64.exe
1068	MicrosoftEdgeUpdateComRegisterShell64.exe
4100	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
5964	MicrosoftEdge_X64_127.0.2651.98.exe
4752	setup.exe
4788	setup.exe
4916	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
2956	RobloxPlayerInstaller.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
392	MicrosoftEdgeUpdate.exe
4836	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdate.exe
6120	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
5768	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdateComRegisterShell64.exe
6060	MicrosoftEdgeUpdate.exe
4100	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
5304	MicrosoftEdgeUpdate.exe
2512	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
4916	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
980	pastebin.com
981	pastebin.com
201	discord.com
204	discord.com
971	pastebin.com
972	pastebin.com
978	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
130	api.ipify.org
125	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\transformTwentyTwoDegrees.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\img_key_indicator_border.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\TangentHandle_Automatic_9x9.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\LeaveGame\artAssets_DownArrow.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\eventlog_provider.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PerformanceStats\TargetKey.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\Debugger\debugger_arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\TopBar\leaderboardOn.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\LayeredClothingEditor\Icon_Pause.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\TerrainTools\mt_paint.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\TopRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\RobuxIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\Editor\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\button_control_firstframe.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\TopBar\dropshadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\dialog_tail.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\localizationTargetEnglish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\MaterialGenerator\Materials\Ice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AvatarEditorImages\CircleCutoutLarge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\category\ic-top rated.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Chat\ToggleChatFlip.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\GameSettings\CenterPlus.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Help\ResetIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\TopSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\AnimationEditor\animation_editor_blue.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\StudioToolbox\ArrowExpanded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\avatar\compositing\CompositTShirt.mesh	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ManageCollaborators\arrowDown_light.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\graphic\Auth\CharacterShadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaApp\ExternalSite\discord.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Emotes\TenFoot\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\CompositorDebugger\clear.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Settings\Radial\Top.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\fonts\NotoSansGeorgian-Regular.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\CollisionGroupsEditor\ToolbarIcon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\DeveloperStorybook\Embed.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\content\textures\ui\Input\IntroCamera.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5480	5916	WerFault.exe	214

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4100	MicrosoftEdgeUpdate.exe
1736	MicrosoftEdgeUpdate.exe
4916	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	FluxTeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FluxTeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FluxTeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	FluxTeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\FluxTeam.exe = "11001"	FluxTeam.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676968869558307"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
5964	main.exe
5964	main.exe
5964	main.exe
5964	main.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
2168	RobloxPlayerInstaller.exe
2168	RobloxPlayerInstaller.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
6132	RobloxPlayerBeta.exe
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
2956	RobloxPlayerInstaller.exe
2956	RobloxPlayerInstaller.exe
4272	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
920	msedge.exe
920	msedge.exe
3992	msedge.exe
3992	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: 33	4412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4412	AUDIODG.EXE
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5916	FluxTeam.exe
5916	FluxTeam.exe

Suspicious use of UnmapMainImage 5 IoCs

pid	Process
6132	RobloxPlayerBeta.exe
4348	RobloxPlayerBeta.exe
4028	RobloxPlayerBeta.exe
4272	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3472	4044	chrome.exe	93
PID 4044 wrote to memory of 3472	4044	chrome.exe	93
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 4280	4044	chrome.exe	94
PID 4044 wrote to memory of 3296	4044	chrome.exe	95
PID 4044 wrote to memory of 3296	4044	chrome.exe	95
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96
PID 4044 wrote to memory of 3240	4044	chrome.exe	96

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FluxTeam.zip
1⤵
PID:2020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaf906cc40,0x7ffaf906cc4c,0x7ffaf906cc58
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3740,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4572,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5104,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4976,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4604,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3536,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5180,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3192,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5552,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5440,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5140,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5156,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5972,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3900,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6152,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6128,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6416,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5948,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6104,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6512,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6596,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6436,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5256,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6428,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5968,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6504,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7028,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6892,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7352,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6632,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=7500,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7748,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7896,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=8056,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7752,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=8440,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6520,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8212 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6132,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7128,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8284,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=8064,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7784,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7644,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8644,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=8244,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=3172,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=8744,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8660 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=8764,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=8624,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6288,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6508,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8580 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6184,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5424
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- - C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\Program Files (x86)\Microsoft\Temp\EU5D8.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU5D8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:392
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6060
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6120
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5768
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2MDcyM0QwMC1DM0Y4LTRGMjQtOTU2MC1EODVERUQ2MDA2Nzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMjMwMDQzMTUiIGluc3RhbGxfdGltZV9tcz0iNDUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8E2DD995-CAD4-494B-A3AE-D894B208DCEC}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2512
- - C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=5444,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8716 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=4772,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:GimuaCp3TrGV-tdDU3gGiFz4s-Jrjsu6c9VkyhEU54vLIFyqq7aUG1udVcdP-FyPgzzS6eO4FDWwKW8kSqHj-mogrbJTCnm1WHE-yIHP4BZSumtW7FJIRX4TTTen0BQ_rBmWIa0rF5uGBml0Xkq9T6Hv_QIN_69dqwkqafsfYE7ypYaS4UirmxlcEJwxzPUX9lWLNewUHip_ik9wHlKfB3ALQTaf8zJ4FvIW87_69sk+launchtime:1723223564010+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723223386891011%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D388b2b6f-b14c-43fa-8bef-6f486ff5b383%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723223386891011+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=7860,i,1045329822813887853,12483033336971277908,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:_1RJyeWahc3o-LXWJbJTdxDKZkBEqC2i74uMxZIu7Wg1WBE-dYwFiyrMXsJ_RY4Bn85VsD-L0ygaH_l4tahJ8GHziQ5xFbvR0wCciZ8qZHwyiX80IvF0z4g_lVw6t86M45h08o3fAAf9PWzp3XYy96o-_5MoQrQ7m62LO0R6rKUFHebdRHdhaYadwApg4S3q_wHehiXkQF101WMpQtoZQTqtgJMNq4MdznUoLW95RaM+launchtime:1723223641529+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723223386891011%26placeId%3D189707%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3De2253d01-faf2-4f70-b8f2-f1881f219369%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723223386891011+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5776

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe"
1⤵
PID:2948
- C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\main.exe
  C:\Users\Admin\Downloads\FluxTeam\FluxTeam\main.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5964

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5564

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5644

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5304
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGQjNGOTI2NC04MjBCLTQxNkQtODEzRi0wOTBDQ0E1NDc4MjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMjc1NTQzMjIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1736
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4752
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3C87B951-0FE1-425E-9DE2-79D8F62F1ABD}\EDGEMITMP_46604.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff711fab7d0,0x7ff711fab7dc,0x7ff711fab7e8
      4⤵
      Executes dropped EXE
      PID:4788
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyREQ5OTUtQ0FENC00OTRCLUEzQUUtRDg5NEIyMDhEQ0VDfSIgdXNlcmlkPSJ7M0M1NTNDQTktNjJCOC00MkQwLThFMjEtRjUyNDNGQzQ3ODY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RUE2RTg1My0yQjQ3LTQ2OUUtOEIwNC1BRThERTZDRjI5QUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzA0MTcxNDI4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwNDE3NTUwOTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MjQ4NTE0Mjc3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyMzgyODI4MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1ZTThLODR0NjQlMmZXWGFXSTQwQkVuRGE0Q20lMmJzTkF5ZmpEWmh3RDlLSkhyRHE3dzVYZXBIRnAwRyUyYmYybFUzdiUyZmtlNjRFTyUyZmpCTWhjWkt1WVRCTU9FdnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjE0NDMwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI0ODY2NDUyMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcyNjIzNjQ0MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2OTg1NDQ1MjYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5MzYiIGRvd25sb2FkX3RpbWVfbXM9IjIwNjgzIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzNjE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4916

C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4028

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2956
- C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-6fdcfe060c6440cd\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4272

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/2VURYJ5g
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf92746f8,0x7ffaf9274708,0x7ffaf9274718
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8862592243478165985,2694258519002410698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 2624
  2⤵
  - Program crash
  PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5916 -ip 5916
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe
Size 6.6MB
SHA256 d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628
MD5 527503f430c5fd4a542f8c0f163fde47
SHA1 6b4db644895df6c71b547d8b147ef3e327418f9d
SHA512 ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8
SSDEEP 98304:QeDq2y8CsL5+Wp686Ka46ws9OqNZ80llF4PdZ:zDq2y/sBrCd9OK8SGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
MD5 4dc57ab56e37cd05e81f0d8aaafc5179
SHA1 494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA512 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
SSDEEP 3072:wHrfzYYc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+s6LRCkuB9N3iQzFXf8qUV:0Ael/DRfkTC3dM7B+mCDH
MD5 SHA1 SHA512 SSDEEP

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 5.5MB
SHA256 810a386924e8aeb9ad6a432067a96b9af05b2070b4a034b28c6d715d99740666
MD5 9f1edaf7fec140c4fbf752bceb8faee9
SHA1 446e908ae656e01c864606d2cef06ed8abd96fb3
SHA512 2a97bdf30878cabc8460b26baa810fce2f06e649a98937c4112e674ddec24a3cab259b820fd6a382a11cb7d8167b33ebe28ae7e10338a283b299b9c5a4951f0e
SSDEEP 98304:dxv+bJVPUAxQLEOgNOncNcJt0gfSzjUfr0p8RywXZ/MEUDh/9uGug:D+bzPJm/BcrgfZRzE1zWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Program Files\MsEdgeCrashpad\settings.dat
Size 280B
SHA256 0d9eab7ac500eccc4a83f062292436650faba93a5e86126f97309347f4144ee8
MD5 6d859bde5c394e7cc8d465d6e29662c0
SHA1 2470bd67540edc733e60658f822927f85ce946b7
SHA512 811c5bff1091af714966ff9c246da877ad62e3a7af88d7922d489617e43c3bbd85f4f5e26afa2acc5e8fe0a156b718fffc3c0950ad715fe300e6b1f6f70adfcb
MD5 SHA1 SHA512

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 182KB
SHA256 824976a4bddea05ea750de41ef7342aad3bb4d76baa9eb46cd308ff495068ddf
MD5 d8e0ba93e4506a35b9e764b3b363e305
SHA1 a0259de031a69beefd4c5857318e50c86aa19fb2
SHA512 9f49a8eb560aaf1f4dc5e189d1cb458f138dc2b4a035529c795881cadbf09dc7f69279166f32f00a47863c6177f9c6a077ee1d717e86cdc3ade43d109548e783
SSDEEP 3072:+prLemA6nVx4F36PDTFPeVVIse4tdHqVx7p1RyPxrctyPxrc8JEalXYbCXA2XRm0:AG6nVxq6PdPpVVx7NyP+yPPJEa1YbyPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dcf169dc4a6449c4cc490dbdb448505ec91dd219619f32496100649c259388b9
MD5 89f10307a4e87f78ad0b6081cd8e23f6
SHA1 a26e92f89231b60cbd742d0a259d63eebe2388d0
SHA512 5845e6b34d0effafa10ba9c5eded904c13af64128ce3a152a3c2cad9c6fa38b7358916a0948eb6288c9c9ead23bd5195e16c77c49971fb53d6ceabc1e276f0f5
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 adb9fdef9631fdf55dbcb2c1085415a12a2997a69a267aa48beb2f04dae4a175
MD5 6357551187434454728d5336952b8c04
SHA1 d549fc8b041640709e3046a189fe1fb3b4bc8da5
SHA512 130535288a788239242aaf603301beb3025cdee224eb988884aeabfe154aad7849fe5a9c72721c4b6046b3a5aac478a3891c722b032cc245e9a9b5f541e6258a
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 1024KB
SHA256 9ce0fa6211341cf0b1cef302f6b02958ea5790ce35879c28a68b86e789651923
MD5 33c169b03626d183ec8a8590b833f0a0
SHA1 5baa6dcfdc291c0c1104864de57ab9904f3e4eb3
SHA512 9ec498ee4a369710ce7404956ca45742a9c6a745d2d57a3a80e0ff53de84081c0ed4a9d0506fbae163a27c0f190761d3deb29a1e712bd1e6a0cf1251b7382e70
SSDEEP 24576:9g3wqh1M+p02uIn8SWtXPqctun65xLJC7gXzG64pprV:900Sn8SWtXPdto6ztC7kWprV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 25KB
SHA256 7d5a1d5cc0ff324a2faa264a6d1a40115aa945a8d7c71808108da456125dc784
MD5 6c9f24607a85011c8fa145f30be632ad
SHA1 8f130cec0d0a6579fe8d398bc7e62451e7badda0
SHA512 79ef710010892897b208f4b4c61c043523454ae3bc9a765057ddf0b8e9f702d4a6ee1c13317b1fdf95caeda2b9d9fd182140614eb409b5fc72cbffc6c723b48b
SSDEEP 384:fnDQ2X1S8ThF+67q+YvbkO+0t6EU0ErV3pkoViu1FLxh3t7rKAL9V9Wg:fnDVX1nr7NYckYTkTEdxh3VrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 897KB
SHA256 b280cffd9e1b2ba447b00742aed04368c20030aa516ef345972dea8109c2c8f1
MD5 5909b4611b7766c0b954aeddaeb76830
SHA1 9cde8406d085b9ea44049bd7ab76bf2e38ca81e1
SHA512 fb0743c14d20b179d3f817aa6882ee19a15fc8861094ec225cd991c5cde9d233f83d019a800d856dabc9fbd72de34a58cd146ace8be26ebfafdba9b576dc0155
SSDEEP 24576:CAjVRhZVt2Rboh8AMZY2CzRYtgH1sdVnGm:9jVRDL2ViKYqldRGm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 16KB
SHA256 78d8aca4e50e6ba58890b68f8c3d6e562ff0b16516a0c3df56be18b69dca6aa9
MD5 61e4576e6aa91cd435fe92f085fb0a3c
SHA1 fa21a6bad3a461c8f0e27b75913c8f1cbe0b2b62
SHA512 b250c2940f7ca24b763bfcd4d39d0022d6441bad54c415b9848ef949f8871f219289f044301de03313bf8cfa53bb2797c5590acc1b32889b0641f7a13b710bfe
SSDEEP 384:uRceLaaK+qr2dnfaZaP4bfQ/V3+pf2inZfWnFh6ejn:icKasqK1YFLWV3+p7ZfwD7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 72KB
SHA256 7bec2753105c16bfb8de69caa1ecb069a95698d3c4b5d5c8cd17d25c3897244d
MD5 0e203bbb83e307ebf9189804659fc461
SHA1 2ca8b6ec42cb2d927775f359b7dc5b9a4e75f5a8
SHA512 cc305c05ffafa4ebd67a1561ce19458acfbc1c2bfb05e7ce99ba6e80336751d62d2b0a957770cc9ac535a01f45e135b1d3623e46454168c100637722331f578d
SSDEEP 1536:4/nOLc3vQRWMP3nvqPmX27P3413lnNgFD69CAZfyTOj3x/bwx5Fn8:YOhRJnvX2z34lN2oCApNxq5F8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 50KB
SHA256 9ec9f50ac6a5dfdf7ace0a047ab4e86a7f8ff297030f93f9b8b4e27c57fdaa51
MD5 cd2f3074326840d55a3c3ea1e99e83fe
SHA1 3a2e1d1a93506526ae3ed2b44d584af7771ff8d0
SHA512 0685f7e50451e87f8d7d47f3373d653f7d6163ffa8ccd143a85b179d2c5c51cf494e8b5f7e561436c35bfb8ffb9304f0c49962a8bf7065830f0cc95281f4ae6a
SSDEEP 1536:ZNdpwzhtp8YDgVy18pdqiketpcTzbtwbS408N7q5mIc6mjRJkvk9OVtlj3sz:Rq7t4TbSl3BI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 25KB
SHA256 a9fc7baee3689f0331e46617f60d6e7c3ed631209b7211e7dd09cf20d22a64c1
MD5 42e84ebcf5470237abd1f9e322b751fe
SHA1 a828a45804554507d9e8521c36109e8bc3d5eca2
SHA512 36606d42aee5689819dedf221af3c6c0da06aeb9997b9ce84b42db42ab80a0926352219f1e47f2287dcc850fcc96e4eefd5e487e09e1f1228102eced11271e25
SSDEEP 768:HKQqk6AyfGKAhfAfEJfoEketsFoEVdk3r:HAcKAhEEJfoEke+6E83r
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 20KB
SHA256 27ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82
MD5 631c4ff7d6e4024e5bdf8eb9fc2a2bcb
SHA1 c59d67b2bb027b438d05bd7c3ad9214393ef51c6
SHA512 12517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e
SSDEEP 384:vXYnFjIYp63RQUuqmNjz2gLxWq97Eg+kvlApA8z2xUn73Sh2HGaE1k5J6IgD:/YFjIj3RaqmNjziq9L+AApvBOW/E1E6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007b
Size 28KB
SHA256 5510313ed00e6dfb9160c180f539220fec23e0eaab8b0368ee42ea87d747743f
MD5 dc63386872598772bfa124231e36a66f
SHA1 ecc423f54ce64710f2a71f4d4a492a0d6a21816d
SHA512 51b15285049fc20f948b40b9fe7db95add72b54c88855b748d3f653fecd7bdbcfff2d6b2fb138adb7c6b702ff041c58905a13202c652aed57f812c15051fc572
SSDEEP 768:5uoh4KUZQGF1YwH7USuDv1MKlYLGaBK7j9Z:5ZhMZu07USuDtMmWI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a5
Size 63KB
SHA256 14be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe
MD5 67e59a06ec50dcd4aebe11bb4a7e99a5
SHA1 5d073dbe75e1a8b4ff9c3120df0084f373768dae
SHA512 6364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95
SSDEEP 1536:WsCGS1R9yzm4itaymwx6r+4tStG81GtuFznRNXyrp6yYJL2:iGS1XEiXHx6r+dGAFnRNCrYDL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ab
Size 210KB
SHA256 04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
MD5 48d2860dd3168b6f06a4f27c6791bcaa
SHA1 f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA512 172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
SSDEEP 6144:841Spcz/R+SPtJWSzfNE8VJBThCtc1wLulygOG6UlwJ:84aczBWsFRVJBTLEupOkwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b0
Size 123KB
SHA256 9d39990daae223e1b8e4c1a9c2d777df9da2fa40c8a8ab52de6d60dbd1d79227
MD5 ac50a2cb37c8260a22f16fccb46a41ba
SHA1 78f6ba6bbb347684315e398bb8824bf4affa9163
SHA512 a85411faec5ee26fd38d5416ae414d4c252b041d4dfabbc4e558d1753b11530e59d2b35b0622bac31c9e384d709bc9358cb8f3ebd004b3ac1c7d4e63fff2dd72
SSDEEP 3072:KxNhUErs28pUPocSkKR85MJTTcZnyYof/KTHY1Ap:K6Er7yc085MJMhfYK7Y1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c7
Size 51KB
SHA256 8bef2cb55b40f46f7e2fadfe280e4c41b71a657081858a8224c6fb639d910e4e
MD5 0a7c0eb14fb4f288d5c61cba111e3dc3
SHA1 48f6448938e1b8df723a9f7c6490a78887f240c6
SHA512 a63a2651e36b03846d5818a4e03f7582ce95a34d9b4d4be9a5ee152ce22c305a14fec2618aa3f904495bed4c94a3256951ba75dbb0fd0386b3f570096ad4226b
SSDEEP 768:uz+23DTpqCoI8bpkOUtjdcUkLmqk6sQgVk5ciGgKOy8W0E0vghc1a96grq:f6/vqWMUSk6+Vk5ci3vWzCasgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e0
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 260ae6e7650abe30acb48af04d74d3b39ca06f1225815b3878d2341303df6a78
MD5 6c5eac29274140d3829e04fef438be42
SHA1 36dbec928092f42add2a159166cb627be4a54669
SHA512 fb1d418f6010923d97fa1a424da08118c7367389922eb189bc81df17813dca8d3646ae5c996d36f0815844c035ec068d961bdcb9d79a833ff894a16cbf998738
SSDEEP 192:spzUxp2oECL9SoEcIDwiX6Yca0tavaPgP/:sQpl9tiX6PsvaY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 048203f3f74210c67d7f142cc18a5088c9d73db7bccc8b34532015b5a5171f46
MD5 e44e8733c082c77a8f00269a33a8ed96
SHA1 f59babb9ce356f0e0f8b75fd56be26f68a0ce9ae
SHA512 395360c1ab035ffa5bbbd6bed8d39f3886679421d67e6c4414fee65258311dbf80b4762cc2d9f3b9c425c851c183fb2cdc52216e398bce10255b8e90727d8598
SSDEEP 192:oDhEkofCL91oLVYIDliXfYcv0tjvaqgPo:qEq9cJiXfK5vaDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 404c676d5540f461630db8316203d38153ca9e0226c2839eb8a9864b5ae3d2ea
MD5 a814c3f87d0094ceb89f3f99d9c9af46
SHA1 56f2a95be2ac9b3925ee57f0054ea2c6e48afcfb
SHA512 424ac136fae36ce26b267248c1903f566602628ebf07df53a50d4a1c5f24fb7f77dadc7172b7e14ca26743307dd3c2837bab0fee57055f7cc65e874644d3044a
SSDEEP 96:MkFoSVxMVCs8uhoTUOxIV9erNxQBzKLD/pFdOjvso0gShj:H/coXKerNuBzirYjvsw+j
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a9e4ac81ba58f10521e8a0e81075f6fedce1be21563fe8d79e8969200da7acbd
MD5 a62a24b047933f49c83dcfb90d5f03b2
SHA1 2bb4d6544f010f5ec69222f1ec06fe2b8139b844
SHA512 2faf4571e80b2918c7138e124636da7d474ded6a3010e2b1487ee7b29f94caae1a1698c36063b099bc99904e5d96ba144ef8f4219edb37a88863212c93658ee0
MD5 SHA1 SHA512

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 a602cd70b283f8d578b176622e250488c5087b53266b6104f34ba1851c63d10d
MD5 b3ec210b162a2e12643d5c4fd1ce5913
SHA1 06de7d9e24a154f83518db1859dbf4f0106697af
SHA512 a3aae09a77aae3d89758db11edd14b130759c01a77f6ad5c734f55311a44ac90cd4bc13156fc081b3762249022f9f14e26ed1d56a125f78149bfda04120c577b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Size 390B
SHA256 9b20ae2a3c1607cd6d8d6851b61221a1c9be1b77f50102eb212ab06c9d90b443
MD5 adf9a6b2fd9d1e96688a6d02f31649ea
SHA1 915cd3ff6f2ea29cc2797a29611531a9c066f496
SHA512 517a5830095b71d4d1c1fb36df6b01baa7098d657bc7ac54b41611dca93a073d4fe46637136d9fc35ea818302e8decd70bda28a2e33bc296620580e510dcb32f
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Size 390B
SHA256 faa5a197c60dee1633058262fe81c126df899ddc75f906127372fcb97b24e9cd
MD5 5ca90bcce039395a0196070229a940e5
SHA1 55a601722f59d9b59302cf881224a744b52b8f95
SHA512 8e6a79df6bf1ff950799bf241da881657b5ec209ab4486a09262b91fd2869e3ef38fd8fddc65ce766030b43eae47f5c1c7137baafe7f34b63f74388f6224b303
MD5 SHA1 SHA512

Submit Download

LOG.old~RFe5c487a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5c487a.TMP
Size 675B
SHA256 57075ea32cb8ef1c2a3c252ed691bc08b450337bb7455eac9e4b98ab19ab9aad
MD5 14c9be58a64f2e33f66171acbda65767
SHA1 2ca527fda1e2fef166ccd5a4bab5262486261842
SHA512 e8cf4c4e7428b6d6524c33f9f774c8b05c6645252ac51ae94f6a8abeb5aa34185ffeb39766f8f651e3a676e92e938ae015e73b22a7bc304323b7d6a1200df52e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 dfdeb41bef53aae56766192b58232c13612ffeeb7fd0261956acca21d239f402
MD5 18098abe67c07da8ba82a28c4f645264
SHA1 2a97539499c4cd3ad0225d9a42c711f2c26fbc7f
SHA512 8eb5efea4dc08b3bcba0cf06a6c183520d047570edb6984e0821bda40d90e61dd3ec1a5d54e906a33f4e7ec32d05ba1b8366330ea4e0da9f63ec8b7efb88e8e0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 a016abb782994d366ab6cc4c2987e556c48222c2a40f4d30e8dbdb7a0c7ded68
MD5 fbc776ea9f3a1e09b6a7baa2e5c07bac
SHA1 fd3a14a014d1e5e078ee1cc071aa6c909246599c
SHA512 44d5b02446423d638a4319f2b60aa8040e2ecf57d6a525086d70b841ec54f1fd2533023ead15c031ec6711b255c282901327608643dce781dfd82cf460558151
SSDEEP 384:SdX7ue+M6krAyFsDsAmoOxk87OxbKFGKJnZpfzMVKHsBH3mlFi6dGQtT/8n8V8mh:vL5yy8Kl2Sy80sBBAytg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 45KB
SHA256 f014f3ab3929aa20f14b3f31366e815f33839c2531ba71eb67ec1fa17628b30c
MD5 5eb3c3d586693c69ac8910087a356e04
SHA1 c31dff0b185bdf9035d4112321868057f8c2a853
SHA512 8c84c6b6dfa4604abecee045a69e05995c1404291853c8ebc0f565b9d5496f20f6b72517571723ca1d6c69643e7caf5690c283ffb5046bce87d6cd7d39ab99a6
SSDEEP 384:D4d2e+M6krAyFsDsAmoPdKFApZpfDVKHsBH3OyQ9/8n8V8mjny8xyVe8VNbGjR/l:HL5wu8Ka0k80VBhAG6d6xlOwQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 27207c1277d30328d3f4161b21ba1dbcf3ac55f26847ae18178c48c0387534e8
MD5 5c8dee597962ed0df078d3d554b7d6c9
SHA1 7cbe9b482ac1e44dedcd9bcaff1a0f7800002f32
SHA512 7f32d851b97916b5f4b87995d45fb64e717e4defca22aca0a36d80d52ce1c183b12d36e22422da681f83f82efff175f43f5df665f53c54fdc1f13a3c823b0e2c
SSDEEP 384:D4dDue+M6krAyFsDsAmoPdKFApZpfDVKHsBH3OyQ9/8n8V8mjny8xyVe8VNbGjRo:jL5wu8Ka0k80VBhAGRx6x6of
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 7ca8ad4293dd83ef07ebbd83ea90b987c0afb71297e858db4f5d52feee407efd
MD5 6b74941a288af457a71661aac3789401
SHA1 20d47de35749c466004126af8f5861162db704b7
SHA512 2094bcc7f68c043865de9c031d1dadeb7645360e719a1b1c607e21fca38a54ff263320417a56baaaf6c2a141cdcfeb69421565b9bab68e8fb3d2b6029e96db6b
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUwIUMU2sUXJUr/UToUTUZUx1UoUTUbUgm:0vy7ga8dAwLqkbaG1Ibrsc8vwI61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 aaebe23e06b3d283c81420530a45187b87d9e91d00dd5791f65ed6dc984fc273
MD5 3a3c69eb62e0b2ddbd6f1515a4d82088
SHA1 b1cedcd0536e52ecbc9e46390e3350c84712b3e6
SHA512 f4ec15c7432b5057c36ff638183f31b3dde3c8f85df4261aab7968d052c94f1a155e3cd972cbed20eb184aeff99489eee5099b336052cc6a59fbee01aa6bc45a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 fa7ad32ec8858354ea95b9ff30858ebfd005b2cf7f17a2a7d1ad21f58e58247f
MD5 b5cc65886e01129d60f412790bbcfc92
SHA1 e65f7834db2d1fb82ada52ef19d27fa463845f12
SHA512 92f003f898e717b14b66b0a5edfe634e058df266e7bdb3d62b1c2977cf75e886e7244b186cb9285b93acc96371906d5d1d3cd85ece51866d8721996317802c23
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGU/WIUJ6U2sUXJUQ/UJ1oUkUUU21UoUDUcUj4:0vy7+Q8dAwydQG0WII6rsc7LfF11BklF
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 b8d22109b0f985d67836697a8caf42e2cfe51d1404f363e1e935e30ece998fa2
MD5 d51e8ca5d02022e815ebe0eaac4d43f3
SHA1 da461b39f42efb236ebfb87d9432a2148406d40a
SHA512 a892e186b178390906dcb0468a1950332a877e223bb2af002921b2dbe4ef1088720ecdf360046e4eab079f94f29286668c6347c8ca5676deaba3ef4c96c86f73
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUpIUZU2sUXJUr/UzoUnUZUx1UoUTUbUgm:0vy7ga8dAwLqkbaGgI2rsc8vII61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 c716f23c2df7c3fc38ce8f093503e323fedb2bd88d2accc142ed10a5842e9bf5
MD5 12171c4b14f8d9344d1a548f6d20c1e7
SHA1 44520072507f8db3e32623baf5b69050644b885c
SHA512 454d1d58feda2094c1a377a052e75ae6a5ba23ea18da03e274f3f4e3473794cf6b4e526f11733049bb98570b41a13f3f3edc6a5bebaad906fa64952cd8c35f92
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUhIURU2sUXJUr/UzoUzUZUx1UoUTUbUgm:0vy7ga8dAwLqkbaGQISrsc8L4I61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 c550ef7210a9c011e64dc05a05dd242ff2a42e8fd57aa4b77e5313f657a277d0
MD5 e4a8af0fb780434f343fb7ad5eceedc2
SHA1 b67d90ad9670d496d6052a68dd80f30ad774e894
SHA512 54dd8ecfcee9d87ae642a422bd50dcbdad4ba3644270a02a4f3846f1f32a4e9c7ae18c22584d2e9c0b6d99bdf10ab4e9d66b0eae3e3792031434d444c9b39fde
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUZIUZU2sUXJUr/U4oU4UZUx1UoUTUbUgm:0vy7ga8dAwLqkbaGEIyrsc8aLI61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 408fb1c338253359ea71f4e86c8ffe6ef52b19bed08e8a435639f47276673226
MD5 a9a191f4600f7e997c473e38e73e11ad
SHA1 dd944b71cbd87af4b18b3c00999239563bdc68aa
SHA512 5a1bda2d352840539249c3abd3681887a27ca04fbfe1f5d8bd7456d6938452a1326cdaf4c8a51bd671f341af326d60368bc5a5fb6fdc54096101a3d8429de383
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGU/WIUJ6U2sUXJUQ/UioU5UUU21UoUDUcUj/g:0vy7+Q8dAwydQG0WII6rsc7QmF11BklF
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 0172b3177319df9e6df7fb8fce49659c595653ffdc7ee5defb480894ccdadae5
MD5 2dae230fb9d6ada90f2326ff5f6917b8
SHA1 73eded9ed8a1a2c5d3dd9d83088472cbb316eeed
SHA512 48da2cecbd32ede95794ef60eebb2c547563a4e7d1b70fcb3bc368c8af7499c30387036e6c68c0c30d70888bb2a6e8ad23c62d04f63ebca0e6cf396c01786b8c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 8KB
SHA256 cbef8760a7d8e5ca730fb11c78d4eadbcdf20febd1227ccb9f0e3e6c7eb2f5fb
MD5 c4b453379e4f3a35dc15a9a046d6dc28
SHA1 09dc38c9d42885c85fd80e010343109740f6152b
SHA512 5eced0547c7929b0433c931b59e8f309d84a5117e7e38a04cd9bd0d6cd5f0f6fac9a454b2050ad1457c0401b59169d31a38b3bfa127c02f0ec5547b293d562e3
SSDEEP 192:jAUcUN7U9UJURU4AUBURkUjUplGUHIUVU2sUXJUQ/UboUEUUU21UoUDUcUi/UlUp:0vy7g68dAwxEUGSIWrsc7rjF11BklF/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 400eda6b1d413cda05befc3bbf80d925af343000f3afedebb222bc7174338c8b
MD5 6b9829cb6dcc4b8106c1d7600756818a
SHA1 2b90a86ec01a0b63022e49658e5e5ef054f0f41a
SHA512 5787e4954ab77f8f85ac06fbda8f83b778ed787bf209192508cb05c7ae86781d0c64146354266c9cbeb79bcc498c46917b3a9d28bd6aff58d43297680ad19635
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGUmIUQU2sUXJUQ/U4oUXUUU21UoUDUcUj/UG+:0vy7+Q8dAwydQGrIfrsc7CsF11Bkl0/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 f9442aef55f7925feda6d85c7b0aca1ecabdcb2b81d804f209e1aae9ee9a9e6f
MD5 c2f6668eb27a27ab5cf4d4e698ae32a9
SHA1 567d3710b02f7af127ca42ba8bb832e84cef2a89
SHA512 71f88aff812862930cb342a3fa0990f92d547aff92ceb2d82419ba423fd3f9f38fe89cf8334314e7c33965711d1f5c7c33d3ab3f750acd0a5fea4066b2ba1aaa
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGU2UIUvU2sUXJUQ/UYoU3UUU21UoUDUcUj/U5:0vy7+Q8dAwydQGjUIgrsc7ScF11Bkl0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 a1cbaed57b0779608955f873c799ec417c79db96e021bfec3906c50048d19d3a
MD5 ca96023b3d311e950fc96e5c353d9a97
SHA1 37d157a8c963bf52c01723eaaf20da34152072c6
SHA512 6c730bc3183cd31e041d1b7c9a6868c841a8a0214c522c391e609548551fbb27a9850b86d9afbd968d6502c5cb7ac9b0fd0fbd2df13ccb9aa2b1683183f44f3c
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUdIU1U2sUXJUr/UwqoU7UZUx1UoUTUbUX:0vy7ga8dAwLqkbaGgISrsc8H4I61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 75199682b3b074440d1f70143b063e2cc65fdbe0101cf3cb601eadb23efa476f
MD5 38cb65ee1a9787926c721ef17a9abc3b
SHA1 0273c4b793d5e1b62ac9bf726a0d201e8a343520
SHA512 e504ec688f04714e6e5968c19e061bc7f35cadb3bc6742c2bebe0153d2d7c0c38911116d14e27a1630f0287ef296fa31f30537a319c39e734e0ade77a032cb75
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 0303a2535426fef0e0e66a779961777ace8e0144f2238b11d858d607835a5b9f
MD5 98e1e12064b53c81fc00ce0029861b03
SHA1 e1a51601225b9377c75151ad556e96c7fc4e1cfa
SHA512 1583148d8f4d4e3bdc2051be4b8fa32c1fe7106afd81cf1c311c3f878f512510b780a4ae436cfc827927901b93394a1da70aefa7d0d6a7f98938788c5043e014
SSDEEP 96:PORUeY7UgU+yUBeAUK2UCnUy1ieU/esU/IUz+iUC/UGcUicUopJUUcrUD7IUQZUr:WUN7UgURU4AUBUsU4U2sUwUz1UoUDULj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 3a2b8bed6a35d25899559134e44f0617f55c0bcf0675fcfecfa1730f013934bb
MD5 288b7918e50fba1373f601c9aa50e5df
SHA1 9a1fe88cc85d5ebc631771254d6a4052a29a9be8
SHA512 3673d65d42ccb172fd94da0bccc1807368abbc9db5d376a5f9f27916b767139a22f4bcc78e57d1a12370b33e9c4903298fe20891df12f8b350a9ea47218d4e1c
SSDEEP 192:WUN7UgURU4AUBUsU55IUTRU2sUXJUq/ULoUgUz1UoUrUYULU6UUuUKUvIUsUiU6e:Wy7N8dAwvaIGrscdDz+1BcPsVUHZwIlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 edefd3e008396a67917defb14b8e2b03781a01208be53ad00c678f8c6206b363
MD5 20e1158cd3e49b62670cb5cbe6335b36
SHA1 b3a8aea7942d458bae5e00704de9bd9ba61f81a5
SHA512 8f9f59ce8dafc53b7d746fa5560c6bb2fe80a7ed21d1b2af120441d0a4c143d740cf93a0493ce56390b9fd0b7640d0b505e21f8e03cc4501e0f72988a8aace73
SSDEEP 192:WUN7UgURU4AUBUsUwIUMdU2sUXJUq/U3oUzUz1UoUrUYULU6UUuUUUlIUsUMUgUN:Wy7N8dAwvZITdrscdL0+1BcPsVUHnaIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 229f919bcf3fbc0376e8cbeaeb1d8296dab858254c3d9f6a8b844c94b2579f16
MD5 ba5fac58db832e522f38b5dc85184fa9
SHA1 8e356a699ed496dfdfd0cb67007db31d68c0a854
SHA512 9e04adc8695c9e118a2fc8e505c9e9d5f5231b649cb0aa95481b3fbf99781346c781c12a242cd66eeeb560c5db67ee04a07b86c4ddfbbb160c307c3852e90298
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGUnIU1U2sUXJUQ/UxoUiUUU21UoUDUcUj/UGg:0vy7+Q8dAwydQGmI2rsc7dFF11Bkl0/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 b70f2913eee004a1b82f1cdec483115e3b17c7a77d8260915d904cba2156a234
MD5 89a7345d54f3bbec5bb3a9159fd7e161
SHA1 ff8ac7b9f237391f56068544ec6843e053fbac11
SHA512 6a76e5eb4f1761e787bd8bc32da640ae4c2112baac6f4f161f1f3e2d8288ed12f2bdfc9641aae67acebf30e7813f8fd24ac12d97e482528a73eb547878a86b14
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGULIUlU2sUXJUQ/U2oUFUUU21UoUDUcUj/UGg:0vy7+Q8dAwydQGyIKrsc7k6F11Bkl0/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 67b2216f701dd922984a7f86274faa900d8fd2d107b5324623134e12607258df
MD5 36a515b502c3a34dd9e8c49a0be88073
SHA1 7dd04c0104ee3a16f285ff46c984364870d8fff2
SHA512 defe441600138a257d47a205b4db87a22d94474e3b5a0933edbf20f3a22e727f7295b92cdb6ed1b7c4f6796d4ad5b7c96da930f7e65d83178b0d3c5b04869d1e
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGU9IULU2sUXJUQ/UcoUTUUU21UoUDUcUj/UGe:0vy7+Q8dAwydQGAIorsc7+EF11Bkl0/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 98959b6a47c503b2c3d47b89a8e573dd304a6d60539b36f1ba2989655c99f3a6
MD5 ea67a6d95f9f2e11ab16e21bfe6bee66
SHA1 99feac20046612e70065b5f59fe28e979255c5e7
SHA512 0e7f1f08b6ae94db546db9b22973964beea00a94542dea96b5b5bcdd7416d81e5ed9b3a2734c1780d7758abfdd2020f279dc800abe6cea30592e0bc8f718b610
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUhIURU2sUXJUr/UxoUVUZUx1UoUTUbUgm:0vy7ga8dAwLqkbaGQISrsc81+I61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 77430830e8b025f991121e69ffce093e7f6d1d08b902b103c786918055017580
MD5 13ab54bb8afedec24716665abce533b2
SHA1 a4da4fa5fb2d5a1415545fcbce6136dae6973634
SHA512 c70e3ea982e069cd39fbe3fbf3843c64af160d80798d82cc3d6a45864e6f422618abdbff1826bc3ace9a964c5f084c04f73905778c65a157519a6f2563fea6d5
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGUqIUubU2sUXJUQ/UGoUVUUU21UoUDUcUj/UB:0vy7+Q8dAwydQGPI/brsc7ciF11Bkl04
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 e2b81aa4e859b0ec2c63ef0b9643db3075277da2a8ee1083bf5e8b5ac314cbbc
MD5 b6d818f0317414ef3a0aa11b53bbc5ea
SHA1 1d56930fe0cc80dbf4220e41289e0fdbcb013bed
SHA512 7f3ae9b1919cba97991279bebb0a549abb3f12ba72c591f28ad34dc50fa36716397530e97ce0e9fb77298732a258ce9cefe8bc8fa38c5416e5d3a89817a6fbb7
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUOIUyU2sUXJUr/ULoUXUZUx1UoUTUbUgm:0vy7ga8dAwLqkbaGTI9rsc8/YI61BEQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 330c7df371c9082c9cecf71bc7d70328f2872d37897037034796223fbdc4a8bf
MD5 37048b08b9a53aab20a1c96328955a7c
SHA1 ddea0710000d630721eb79ead5220aed60ed3d55
SHA512 2a316602bcf15bb60af8d4c0147501e615d437b40f3f14387921ea0a9a3cd77a7fa72586bbfdbd8f7c4109d1256fa8614547e283c6caea41542a4551a26a3320
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUSIU+U2sUXJUr/UOoU+UZUx1UoUTUbUgo:0vy7ga8dAwLqkbaGvIFrsc84xI61BEQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 70174e36f18379703b477701806f2d622a94ad7856c304bb86785ac8497122b5
MD5 f4e750795b8efde6cb553c9adf21ac60
SHA1 bc468de462dbff9fd500c6e75b4c0ecfc770ed60
SHA512 498abc862e1d8411720200d6287efbd5956f2cfa18c6159f013be139bbb9cd39f8282219f9fb1c13bca4442d14bccc06de690a033b3be734b1e2107f1aab542f
SSDEEP 192:WUN7UgURU4AUBUsUl6IUguU2sUXJUq/ULoUgUz1UoUrUYULU6UUuUCUIIUsUiU6e:Wy7N8dAwvo6ILurscdDz+1BcPsVUHxTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 33b799a9290460d2f30d409ad510477c6855aed9c0de5876c48aada231bfda8b
MD5 7070b11f2915c06d738020f4638c07f4
SHA1 2d63882a74875230d7d3e60b5fd63939aa9f8479
SHA512 1ca27165afe05570b1478c4dda93b590258ef86db7df4fcec4a94b3933f66e6a4a1e0f843046f17aa8d4da911055a90e5d5fe9b5f0436a950e08af71aa0a910b
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGUqIUubU2sUXJUQ/UEoUbUUU21UoUDUcUj/UB:0vy7+Q8dAwydQGPI/brsc7qgF11Bkl04
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 e2b495cfe66493e21015960db6b6a73c38ebf9e023480c864e73f7e5f1011a1b
MD5 b731019f44cf2fede802f46a627764ee
SHA1 ef99387cef15da8c02474fa6d0d5c8f53955ac57
SHA512 b9be131e1d969a6abb9518f13402e1d4b72ded64243281d532535a0a31b606ac39ae38e526925dde8d69df60c2ed8b877a071ecbfd3b386215c30f80317e86b0
SSDEEP 192:jAUcUN7UfUfzURU4AUBUikUqURlGUHIURU2sUXJUQ/U8oUzUUU21UoUDUcUj/UGe:0vy7+Q8dAwydQGWImrsc7uYF11Bkl0/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 aa68c8f080c508086457b4a8076a2d86b5299bc8bdb66a0eabc1552f63354a70
MD5 68a034be4a43340d19f6349be98a3049
SHA1 97d9811de8c0c9a827bef9427b7084f612826a2b
SHA512 c52fcf41871b74800d62826d721ee153151665931756209b75bf3dba5e9b4e0e495d0795a95415c473f75d76f5c0ecc9f1008dbd312d609f0203146b302a3d18
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 10KB
SHA256 a7672679ebbb9a3e04611bc6650505da567a1446db7a9feec01d5b6fe6e36292
MD5 7170735b16de86c5c742a9c72b4d9b8d
SHA1 d31e7db3d3d91ee8ce9e72051981d25bd3422030
SHA512 6612a474a9e4af64eabb7ade259bc001d4a00ffd1a40a1b8c5372f95c838bf9da90c483ef9cbf59f0e0e0257f71c9beb6db1a729f6cc988cf549929125cab42d
SSDEEP 192:jAUcUN7UZU9URU4AUBUzkUfkUoU5JlGUbIUDU2sUXJUr/UpoUBUZUx1UoUTUbUgo:0vy7ga8dAwLqkbaGCIUrsc8pOI61BEQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 bd47381c4b3cc94f490a89a9d5b25ea516e987e3aebb9c8ca60abf520bd07823
MD5 779f96d95777b3c66eface9c2c75cf73
SHA1 c8ce8107e880213077bf89246e5448c3062a3f48
SHA512 14c5d5e5c05c069d8512b36b323e80a8560dac958e48b5c8b2d8b0996ba2ff3bd814bc2d6fcfadb2ba9f3498c35a7444d6cb07319e9961b4d9b982aa8f49f802
SSDEEP 96:PORUeY7UhyUBeAUK2UCnUy1ieU/esU/IUz+iUC/UGcUicUopJUUcrUD7IUQZUSC2:WUN7UsU4AUBUsU4U2sUwUz1UoUDULU6O
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 8KB
SHA256 0f6c04fde088bb2b7920d962505735fa957743787840601cb1135224e6542d86
MD5 7b06316b0f3dd583e3c86c735052242f
SHA1 540a4f9f6d6ddfe8aaed32b106452e33e0a8f9af
SHA512 3a08da6ebca700e5954b7959dd072f7ee5c739ae800215022a42eb206fbc356f7656d3cb0b7cf0fafba3e61fb8c68bb641a34a52dcb0f640722392bab69ba56e
SSDEEP 192:jAUcUN7U9UJURU4AUBURkUjUplGU/IUBU2sUXJUE/U2oU1UUU21UoUYU1Ui/UlUP:0vy7g68dAwxEUGOI6rscrciF11BjoF/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7bf3012dd5abe5b5fdbc1d3b99d4139b6162fbd32d26757ced8a1f7743dfe8f2
MD5 39e22b70fc673f7441f6e2bb05a1cdb1
SHA1 2a04fad6c2585c81a0ae2f4df075a84c1fe13bea
SHA512 5fa267f6f958efe7cca3515404cfaf1dbbff071553b521167dd868e10b5db71ffbff95eaaa6be7335c89f9b1e68820881bf797d8585f1a0afcc91fdc06f418cc
SSDEEP 192:t8gpgup+Ijq2ejSTBF5CHC+F0Yj8yJNty8dhXQ8zB7xkwaFPD6yIsnVdgy:Kgpitkb5mBUGLLA8lt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f60d1871b0908624038fa9988a7ab7d37acc126e8541bc4018c3218669b6df69
MD5 83c16ae664dfe024d60e97e2c9d478f7
SHA1 68ecab8a6fa2900af4073cd3ae50b9d7540b3104
SHA512 0df68b6c3442dc6bbffe8645df0da12996a60512df9283281e47232aeeba59398df2dd91df4029c9d3298e389af8c68708d111b2e7bae2a5339e350ac7b53110
SSDEEP 192:t8tpgup+IjW2ejSTBF5CHC+F0Yj8yJNty8dheZIiB7xkwaFPD6yIsnVdgy:Ktpetkb5mBUGLLkIit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2fee850b35b728d117109f1fc92af3887e054d061c7e11fc51f26f6e27441c13
MD5 bb6bd7785f906a1dfcb7f2575f5035cf
SHA1 607a1868edc990aa9c73250d04453dee57e58008
SHA512 a7b1efdf5e4c2e4640dd32e73757a4332b3cf066a561e55af54a213f4fbf79758282ac49f4495f7234eecc04daea805dd04d6e235887a15ccd32ea13cbf177e6
SSDEEP 192:EnIgup+IjDQeU/CHV+FnJk5B7xkwdFPo6yIsnVdg4:EnI7o/mGJkTt9X4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 242767db80efe9ffbb50d6e3a69c60c70091bd1148a57fd3cf558ce3089c7de3
MD5 252c4135c2d99b9f74aebce892f034cc
SHA1 8ca61045c520177c2cfbbdc2ff6e09c8f79a9163
SHA512 ff66e19ae435e032727f3b513f4b93f0568e473811f4ac4dc612ece3946b12168f36a03f8ccc1281e9bcd5fa48f9c122695bdfa717563882d3dc7803d5a9cc65
SSDEEP 192:t8tpgup+IjU2ejSTBF5CHC+F0Yj8yJNty8dheZIiB7xkwaFPD6yIsnVdgy:KtpMtkb5mBUGLLkIit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 32d9a2569e895daf161a069603d38cfe3a93f7d3b7a1f2bfe983a987d1c40e31
MD5 4ead77433a6c77a089420e00cdd8d29e
SHA1 69402cd57c6b947e5b000384f8acf465104a2fd2
SHA512 0d330c78dbdb28df92167a7c74d45f3e453db6ee39b1ce97dc27c9d9997ee949005adfbfcae203774ba485e32cd2b445cec76aeb0082179c2ef8288787111890
SSDEEP 192:t8gpgup+IjH2ejSTBF5CHC+F0Yj8yJNty8dheZIiB7xkwaFPD6yIsnVdgy:KgpPtkb5mBUGLLkIit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8bfe8f039a1ce2de67b4f5b6b6963a43f4c8e413549784caa0584932a3fff4fb
MD5 e58a2128bdf93303d98aeeba8077233f
SHA1 98e5eae88f25dcb4ebf4dfbeaf7117637765482e
SHA512 6426301617fc06edaeac4cbcdabf17d76232eaddef12d51fa2bc483599f2d64c45fa994a90eed696381eaa7502434c7cc2aae3e08ebd3d6d200166971484259e
SSDEEP 192:t8rIgup+Ijn2ejSTQGCHV+F0p8yJNtk6B7xkw8FPD6yIsnVdgy:KrIftkQGmGvGLkKtc4y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 842db6fb70c2b7b7f28655e81a564d330b0feb24b9761b7e688396806c1d6ce9
MD5 3ad438406da0b2b1213b3eb555bfcf14
SHA1 7717341a58d73c373de9fa17dbc37a482b5256d4
SHA512 5714374da4bbb86ca299d16cbe117607b0106b4eccabbab7b59a3db7f4aedf234d931109decfbc5cacf5b03305ece686d20d3aa843d60ec3df1b01f428cd6535
SSDEEP 192:t8rCgup+IjZ2ejSTQGCHV+F0p8yJNtkIB7xkwaFPD6yIsnVdgy:KrCBtkQGmGvGLkwt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f9b21d5016f854e4a32b76c2eb5f9260edc746de0d7999e39a0f7fc4d849080c
MD5 c8bbaa201fab888df44e65ea39506edb
SHA1 f62ebdda02cf503214ec424afbdff7a6e86b1268
SHA512 d6889a6306698f69d4ca6911826acdae70e60604db410ff29ecfbe19cb50aa09d7826846d076be0b016b5b28458a402773c2e0f57db5df58c30b609bc41a09f6
SSDEEP 192:t8gCgup+IjL2ejSTBFWCHC+F0Yj8yJNty8dhWR6qB7xkwaFPD6yIsnVdgy:KgCTtkbWmBUGLLM6at64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 73cfd9d2a2e1cea346b8614ef79df3f1c0552dcc4e5dcdbc907140d597ff692b
MD5 adf49156dcf914748bada1dbadf61e30
SHA1 113985adeebe33cbadca29cbabb42856ba070351
SHA512 51714a9035ea8a831373f609417909df89e13e3cadfdcbd37b8ad028acf14ca5cb027c407887a7c85e4e59231dd32fb130338cf9984a0997203a3d57d6ac1c89
SSDEEP 192:t8gCgup+IjR2ejSTBF3CHC+F0Yj8yJNty8dh83usB7xkwaFPD6yIsnVdgy:KgCZtkb3mBUGLLIu8t64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 97ca220281e5ca0f6289ca8b1b712244626ec3d9058e8d9c6ae62fbe15f4f575
MD5 b29ea8d28ca868df1137c18aa0193db1
SHA1 ab590b86429dd2702db307b83fe477120828c7a3
SHA512 70e19cc8498908705e3055359cf6e490b2cb5f088e68c9c9611c8753875f4fc1a034b87a415d5e28ca78c8047f0bb5a48debf1afd8abca0d7b6a5fddc83274de
SSDEEP 192:t8gpgup+IjH2ejSTBF3CHC+F0Yj8yJNty8dhgDiAB7xkwaFPD6yIsnVdgy:Kgpvtkb3mBUGLLMiYt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bdc29f7a04803938157cf40bf3e6198abc1c018b3a2123664d635b8061b96640
MD5 5538dfbbcdc0da68b5cc238d650aa069
SHA1 1c1c25e4a77501262cd3462cf0a91c253ccbc34b
SHA512 950e953d827973d4f8a50de6bb23ee2d19a1565ee0f6d6dfd73a827f66f40ba2653a09c33d81409d07d5b6fc8d0163b6ea4741a5834e9ef0fa33c9b9ea039548
SSDEEP 192:t8gpgup+IjI2ejSTBF3CHC+F0Yj8yJNty8dhgDiAB7xkwaFPD6yIsnVdgy:KgpQtkb3mBUGLLMiYt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4736bee88d8de53e32b6f921ca4204831a402c8507b771468ed0cfa81d1ddf26
MD5 1dd5a410025e481327dcb9d36fa5806d
SHA1 a28e1e4282b6bc5e7fcaa7aead9fc6f09dd6fa3e
SHA512 1fbc8cbe787f8501894efad81094669f9b9105c374f9b630318bd23cec9334c76c9664b757ef247db7aee7015043980e8bfa4340efc891e308dabefdab44783b
SSDEEP 192:t8gpgup+Ijui2ejSTBF3CHC+F0Yj8yJNty8dhO4GiB7xkwaFPD6yIsnVdgy:KgpZtkb3mBUGLLFGit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 193193ac96624db1fc7f5eabe7e0b01844bdc81db34d2e40c42790182f1bc756
MD5 631be390fbec3d5e0c66d7716a86a65b
SHA1 da4d29a89ac843d4683508652bb59b10a8c7d4a7
SHA512 3623a21a8faf5affe37d9e46aab42d285a863cdc7c0ab3709abdfc66c000f6b9b3ce8c0eeb14cb9495c65692b8636a79672594b1b3dfb35fb76f16cf669391d9
SSDEEP 192:EnIgup+IjoJemGCHV+FVhqJkPB7xkwdFPD6yIsnVdgy:EnIA3GmG3+k5t94y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3e2ad9ac5aa7344cd23851d935d6570f10048bc2bf9a8a7dd75fe27e778afb88
MD5 6861d4dfa5987b177f8abf05b73b1e4f
SHA1 6626efde6d758471e2b8386152675e54f61afdf1
SHA512 772b591848886397308d091d8cbd5eb92cb04c1605cbd6d10a22ba473d4f6940bd6dfb3e929a1b05236712d9beb6fb67fc5f6752d8b6d28c9d2da8e9da6e2beb
SSDEEP 192:t8nIgup+Ijt2efGCHV+FU8yJknB7xkw8FPD6yIsnVdgy:KnIlJGmGVGkBtc4y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8696616145f397a7d169b92ba2eed7b0123d5f974f74c9c54c45b97e16f9d1d8
MD5 1c765e1deddad75831e3b7e8c46fa668
SHA1 09cbc0ee046350efe2168eb6e924a9ccfb18b73a
SHA512 945287e8aa9e68b01bd42125950ab80586c4d1a9659a935d0fad48a0f165717ebc0651684716241178298081c3070e3923d8e88e26065a5ada7e0618f1ad68fb
SSDEEP 192:t8rCgup+Ij82ejSTBFGCHV+F0Jj8yJNty8dhkhoB7xkwaFPD6yIsnVdgy:KrC0tkbGmGNGLLkit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 731a1a0d3cdeed30043e6f3fe93cc91489ec9b2f69638890cb88d7da17d85e16
MD5 a4a89369a7079988d31bdc62d5604803
SHA1 9b86dbcfb45bc4bd12a0a7eba58cea7c191db5a0
SHA512 80d0a2e3e1c842d1e66410c757814645a0b8ae5f114ec5ef292cea02529d6a9d4433f083eeb53b632bda60e343c5373197c1257f31b6576cc33eaa60e8f5fa77
SSDEEP 192:t8gpgup+Ija2ejSTBF3CHC+F0Yj8yJNty8dhO4GiB7xkwaFPD6yIsnVdgy:KgpCtkb3mBUGLLFGit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ed5c46fe940680d83a29eb91812c9f0d53ed9ca9bdf4122ffd5591dfd5bbe592
MD5 f09cb7e1c4e97060fb54a85eccf34f89
SHA1 629f99b51641fa5668fbda1e25f0cc4d796d6bc5
SHA512 6d25f6692f63f43b49a4eda9b249d05fb6df392d261b1e08d4ab3709c16c5e2e0d2aeddb07e46b6d02bf910d773f73d5a1771199d19f7af32b4a53e74ad441e1
SSDEEP 192:t8gpgup+IjJ2ejSTBF3CHC+F0Yj8yJNty8dhIqsAB7xkwaFPD6yIsnVdgy:KgpBtkb3mBUGLLJsYt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6d7c0e31e11ba01f7247eaba1e6829cd58e2f230f38b7f2ebcb73eb5ef78e992
MD5 c148170ecfbf0ae82c72accb6049146d
SHA1 3299313eabc23254ee39252d8a539ccd99eeb17d
SHA512 c18e20e773343f2a00061f9823386ce8fbb7259031cade09970cc369c881f262796da262405ad6589c6c1da5ebc52dd40d9662c4064ee2de64c4856578880883
SSDEEP 192:t8gpgup+Ijf2ejSTBF5CHC+F0Yj8yJNty8dhOZ0KB7xkwaFPD6yIsnVdgy:KgpHtkb5mBUGLLc06t64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 98638f688cfd86f3f4f21d8345dbb12b36b14ce4f442f78d675f71d353e0c86c
MD5 aa6f65f9f3278a207a167f67532d6aef
SHA1 46932475f95c445c7f3452c4bf59dd15b2a41218
SHA512 52175222a0ba0351e22d0eb52837d5f292a53941826a32ec436e33e398416121794e5b9285eafba9564d0fc8ef39136d89a194854f11fb5b00b816a9a44c7ec7
SSDEEP 192:t8tpgup+IjQ2ejSTBF5CHC+F0Yj8yJNty8dheZIiB7xkwaFPD6yIsnVdgy:KtpYtkb5mBUGLLkIit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a2e4d4eda5ea9a617c3ee5a887305a2f44a8f26b84e50edb4508b22b63e9f5a7
MD5 e1b763a70b652650af22c2c795490242
SHA1 68c39e587f503e70f83d5e6a071e2d310aeabf6a
SHA512 023a31f4d772e0490abc8dfd9ed85b91675f469b5784a554e64ef73fb845f0e322ae30c392241d9d632d1770d9bcf08a60b221f8cc678d6a9bdaf3fd10fa43b8
SSDEEP 192:t8tpgup+IjV2ejSTBF5CHC+F0Yj8yJNty8dheZIiB7xkwaFPD6yIsnVdgy:Ktpttkb5mBUGLLkIit64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c536358dba83b5cabab664e2283b47824a6bb2d7bd7e6d8adcee68154fd2c51e
MD5 7b08b744dbbadf4861b4bc98b3b3c4c4
SHA1 cf61648ac12de7e66a16d601f5693988a4155cf5
SHA512 98f31c8609cbc3bbf4360559278e57e4486240578c3acb2854214f5372510bc71d30f09dd0dba94fbcc2f66215bb629ab5d586266c1e2d2ce0fdf96db01685b6
SSDEEP 192:t8gpgup+Ijrt2ejSTBF3CHC+F0Yj8yJNty8dhIqsAB7xkwaFPD6yIsnVdgy:Kgpzttkb3mBUGLLJsYt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9c07df0c48203af45fb60bed176eeff6ba41336b70640114f6af8b9e182d066e
MD5 bffb9e3e1577fdf2b94c2e73a0abe0a7
SHA1 ea07a9e9d2a58dface6bfb1b66672c6e23a33924
SHA512 fe4aa220df4bea53bb47ea02602b5150decbaf0a5d9f0aafe3c9a19f821d18d66c3b62e1fca20ed477a78ef01fcb4ab2f1b193c04afb4361c4189b9c17a88d17
SSDEEP 192:t8rIgup+Ijb2ejSTQGCHV+F0p8yJNtkIB7xkwaFPD6yIsnVdgy:KrIztkQGmGvGLkwt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 491842a674421f607558c6ebf5eb9e7fdcb1fd6e9ad149fb00a7f967bed14378
MD5 cd7f02054e6ddd8a807a9d56964b9f6a
SHA1 7dc1cc5c44bac6f6222b06601b6dd4ad043297e2
SHA512 5f0515a05c7846fbfc73b3db2cbb0cf7810a6d2b7f1b57b5e22a811e0dc2e84c084e2a1fe12602fbd4fdcbd4266f2cf62a84cbe6eae623b8692861eba4016cb7
SSDEEP 192:t8gpgup+Ij82ejSTBF3CHC+F0Yj8yJNty8dhIqsAB7xkwaFPD6yIsnVdgy:KgpUtkb3mBUGLLJsYt64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 13a5a2d34a066d154b53b34103a1d715ab4091959daab7a6c780fd1bb1c22f59
MD5 65c303d951afd893892ef30e5a7d1853
SHA1 c06f22c266dba6f653ec3b89b4ce5e48a0bdb1be
SHA512 547f243714355808a0d84764703c4741f485107c14e5baec1debbc32fc075b8b7c5e5d90e9b1ce0e9b87e24006c070d6542499529edc8a282a1b56429e09bd02
SSDEEP 192:t8rCgup+Ij22ejSTBFOCHV+F0Yj8yJNty8dhSzkWB7xkwaFPD6yIsnVdgy:KrCOtkbOmGUGLLEkut64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fb5105d19d897865774f3eeceaad6a8be3f056daa950269a03e84278b1d19638
MD5 37f80fc772fe16d407b7c78ede9565ed
SHA1 f3a868544fd337480802af83d6a4790cb1f41d39
SHA512 82dbf24393e813a49e9d9e3763b8900fafb911bf8e1a0064976a1b166fc3e18ff983e022ae686a3862ec23e4927f747c17cc2886e674a21df9cb73c8ad6899a9
SSDEEP 192:t8rCgup+Ijw2ejSTBFOCHC+F0Yj8yJNty8dhWR6qB7xkwaFPD6yIsnVdgy:KrCYtkbOmBUGLLM6at64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4ae9dcf20fab0ca28d1770499e8e68f3fd0b89fa717a8f733292ce1e3177d039
MD5 a09507a3e61839dc723edec4aa4122cd
SHA1 5de9ae58601bedae60c162c3aa0520f6099fa256
SHA512 48c9df5c39cc6ecc049a54aa7e92e70f4cc88885d0744c88657b23bb59e04fb7723d184c93eca5ccaee3574e0527fce90b27a15346fc1f9664a7d4c96827e721
SSDEEP 192:t8gpgup+IjD2ejSTBF5CHC+F0Yj8yJNty8dhOZ0KB7xkwaFPD6yIsnVdgy:Kgp7tkb5mBUGLLc06t64y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f2324cb2c441b1f251206e20251d546a3075687447b9aeb52e05538f7d9d3f3c
MD5 caa0b7fa1744e4faec95f3add2ba5eab
SHA1 331581e11da5fd7b4ffac9c98784bdc6975282a7
SHA512 80dbd9933e9631e30a0a77748dc2941d4b163cc63ddb7ccd2bc9b2678b9486cf403dafa5d23b019d1e3bb69228d5883a74048c3384d116291c012e719bc4159d
SSDEEP 384:Rlvs7pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crUqWTY:Rts7pLhLnyemo1kXqKf/pUZNCgVLH2HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\03501080-a5cc-4d52-9d8f-c92d2a733353\index-dir\the-real-index
Size 3KB
SHA256 8d66e2d63652cfe2f7ea50dae0f1da0f926c7195ae027bcb7902bde3c94c9caf
MD5 035a70094cebfc3c31415b827970386d
SHA1 eff414d8cbf02cd27e85464449ba51cabdf34dc7
SHA512 77dd0645e6998cb1f2ed0d24c455766b31fbb4a838eb06f7cb3e09ae83c7c3085c43e473c34319545e870e5037be374eaeae02b350510c2116325a658218fbe6
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58efe9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\03501080-a5cc-4d52-9d8f-c92d2a733353\index-dir\the-real-index~RFe58efe9.TMP
Size 48B
SHA256 60324438dc577217a8fda90b728f529b782a4dbbcb02d4ae9facbd39600753c2
MD5 76975f783de69725affb366b3b82891b
SHA1 709c2c7ea6a36d0e4dc5917fe48f7e4b5b4cc603
SHA512 0b0300f53ee02b45aba829b4f0dafcd4cf48cc8cde27f9d2ee02e9d0169c27b6c86cfb5d1515a2e0b3ad1ebf3fa1a10f291571b22b0235d9a24552a5d01f34bc
MD5 SHA1 SHA512

Submit Download

925a02cd30dd2ad1_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\925a02cd30dd2ad1_0
Size 125KB
SHA256 71d4442afdad5eb59d55e04b13959bf2553c561abecb08cb5d17849eb68c81ed
MD5 c8cc908e95fec7002292a39fb4683eff
SHA1 e6179771e2fda24969966c02e35c760989ebb407
SHA512 770fa23569fe9e720ab56f4a5e5a97cdad7381a777da4f206ebe921b32cc5111307e435fe92d89e151887ab11f4206a504cf62ccb4884cc32e807d224318c1be
SSDEEP 3072:wh16riCOzkTbiyauMygWPjMKru/nYeAWdWYX2W2IQK0TyIzD/J:wiriCOzkTbiyauMygWPjMKru/nYeAWdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\index-dir\the-real-index
Size 72B
SHA256 ad3e059ffff2eca48849f12031e6c6052e2907516281a1aeb932b5a2a087d8ac
MD5 aa0d12e7754faabde4bdc2edb8e56562
SHA1 8fefd9bc97b9fffb0f7863afb5ecd8eedf18a2e7
SHA512 e3174a79a079ffe401afb25bd047dc56bf2d502b94349a8661c61dff807976cb402660ca9b16d962807f57af4d57ee61c94ed0cfc247c3759e93ecb34df233df
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58f056.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\0e30d903-f19c-4a7f-8007-1cbe5546db82\index-dir\the-real-index~RFe58f056.TMP
Size 48B
SHA256 935ce41ecf3e8d81e16d3827c64200e290e0ee3dd24cead24fa96988a361b636
MD5 b6ffa6decbe05a0fd5b5478009ce9205
SHA1 ea4a0c72f5e97f30107c6285277593226051a8b0
SHA512 76fbf25de2654715a7f76bb2f94b31c7a17e68a48b3c26677bba5ce72dc5451f0e2d50908a539a4f49089660c6e9669c766d37a48b418b4cf5615ec0b584977c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\a9976c73-1fea-4f73-9b28-c78cf6f37053\index-dir\the-real-index
Size 72B
SHA256 6763bd58614f37ce19e039c25e2397cea7f62599d6aef0fc449a8d11fb23850d
MD5 5cfd4093b69fbdd4cb5bad521b363b08
SHA1 ce09e3b6d5401a76f2017c74a54706cd6d0db034
SHA512 4025576bca95e08bffd57ce474e669d6ab008e307052c05aa867c9b5e9c733fbecc3f66ccbc5c4f6596cb157765822eaef25dd8091d55ecf1b9b71e4a0a01a38
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58f085.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\a9976c73-1fea-4f73-9b28-c78cf6f37053\index-dir\the-real-index~RFe58f085.TMP
Size 48B
SHA256 0a2e66fdff25e5814ac54f56e25beafb745f92205ec7714c5c3037aba3c18eb3
MD5 1de43bf211cee30963029ca7b7a14569
SHA1 8ad806f7570c7f23b275e282d7b15ce9a2487108
SHA512 67061ac809b3660401ab795309d5440f29cda0d11a252419696154e5c27d77dbd3a6094a243c9d09eae374cc529d57303f20cb004b0b72b7e47adcefc5f39243
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt
Size 202B
SHA256 517904cad16dd948e8a4284185aa29b27ab1198356604f89bb9321219db6e1c0
MD5 2c3187afaabeb3b2c2de22303970674e
SHA1 806a43984e4634e46e417448b132746735eb7723
SHA512 3356fee69d0c69b48adde8f34f1feb258b824cd6b8d297a307dc968e4a5e4586b81affe9ed9ee7a5c50dd286cf296f141461e834ae807620025e623bbefde8c9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt
Size 262B
SHA256 33e39300ae164bdd9c539851d64941bc08ccb06fe1584ca9113a09a1baa7f73e
MD5 d3a6fc733364c1752503d7214090a810
SHA1 88cb94ab421c87af73a5cedbea4d838ceb9f2488
SHA512 815c1b8ede79b5ed509b0b131dd47b621295bedbd882cd6ea531cd33c954712c4488dc5196bee81457e0e0531fead072cbae70733bf761381ae61f8e8edb23cb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt
Size 256B
SHA256 60543ec24e2a4b42ed4a6a0c6680d25243f039dedadfb1a13ba998a9973b9484
MD5 4dda944d1b9b8b59e1147c5a77702409
SHA1 15ecf5f14031096e9ca48c6d81e8dc5ada28c0c6
SHA512 94e0202cc18a3721f2643966362db4ca31e604331c3a9ef6c3f637e641bb0e075579580412c22b2d00fac1df7677a7d602438f50b98d6a896b4f2433025254b1
MD5 SHA1 SHA512

Submit Download

index.txt~RFe585f13.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt~RFe585f13.TMP
Size 112B
SHA256 013bb18e5c60b2ccfeb5a46305a76fa54d2fdb62bd4883970c54ae4f3e878739
MD5 f8e71f24d8c0f08a2a826ba8f7fcb189
SHA1 d1c436cd63d3c46c204554fd2093a6aa294cdc64
SHA512 fbc2d0fd857b4dd4ba60ada6a143f9daf48c035fb9a1d4024ef004c64987e7ec076df85e89d664653c6909a1590ade2a6d80bc010a0d0a4c31027fd56d4da852
MD5 SHA1 SHA512

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 19KB
SHA256 bd9d13363efe3ceedacb9114de16cbcaa1dd2cc42de37bcd3c4fa1f9de02e119
MD5 bcffb6a82b239a0f4fc0cd741bd9ee6b
SHA1 669a2ffa2052ac667ef41b880ca00819383e97ac
SHA512 71cdc9309c6d76a93464817db4efd3b66d799474848ceb598687d8e0f058f708c5a0b2a27f0d4309611ea54105844c61e97ffe2fe8f79fd28d7529402208ed41
SSDEEP 384:UvYvNwPghwMDAMdEGB7tzWoZT+s+TRvPvSvNwPghwsD1uu7hauoGVBmhB7N:UvYvNwPghwMDA7GB7tFtpmPvSvNwPghC
MD5 SHA1 SHA512 SSDEEP

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 58KB
SHA256 63f0fc0d928b408cb2b22e824929b9d7f0fed78480b12bcbaa48f60c079fa387
MD5 c3cc11763e8e8992a61c31e4a61f008e
SHA1 3c14b70f10482d9e30be9f6721cb41a90d21983d
SHA512 4637118cdbd8863c747a153afb245d1837fef017f685184596a460b8efef3ac9c77b575656d1f407045e6ccf22e19523adfae94395725ba73acf9464a4b28385
SSDEEP 768:Dg9pCAmbZKxjZ5lrSVKnUy3xYcnRCYvy4+L:KpCAmbZKxjZ5JSVAxYcn8YiL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 17KB
SHA256 0c4a1593e219d18ca47964bad027e3a0a7a9e6336ae6d472ee9e94df3d0900b0
MD5 32235cd579cd534703091fa5a17971d3
SHA1 3d87b637ed1b31023b07d2f89c13bf70452ece2b
SHA512 b368d2ad25cd3d3dd95307efdf6369da04d5c4d1edaa0d50c3529c4c46b217ad907a16894ed36276f320e685b6c931eebdd759fe8b765e2e3279fabe6c7385f5
SSDEEP 384:jPC6Y/JTB3MJ+MoBHrb0CfOB4Ge2pIGJIPJLh6FAaC2Ojyh+FjVv:jPC6YDNCslhlNyhW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 21KB
SHA256 cab6c74dab6b9483b6ff4288a2096bd0310908091ee4b216f2245ac814e046b3
MD5 b91cae7cea8d4027291e3f7794e830e8
SHA1 904cc5a79db9beb89c4d64d98649f9376b2540f1
SHA512 e745e8b853295b5e0e1d4702d6d987d47d058a0a2cb7f2ff90507cb2bec70bcc3dad0aac5056d3116a7a6c2b69f387e903d2e7cddd2663485d1f5ef17e081924
SSDEEP 384:ieXCol9U7MbYMhMGq/BpuUMNI3EpjJyh21dtPRAz:iICol9UaIL8HVy8tPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 14KB
SHA256 64deef085bc6ad463b6b44e8a4c54c2941f9befa5dc2b7e24ca6fd30096f37e4
MD5 a500f2f9535b832cd5db93a219175aac
SHA1 ee8bd33619d5f6acbd7878e2f9f816109f2fadb9
SHA512 fdf3689ff14b95cce2e172c650633a57b846a1c31456bd4e42cf50eb046e9cd8f5807c502f9ae6ffa5d959c3be30eff6a7c52f7d4b0e9077cd1a474b88a5b1b9
SSDEEP 384:QvG1WiGHT+B1bWN1eq5PQB2HKiruaGunp2+WYzDWAZ9VlUNstlrJWkKxjrCjJgUZ:QvG1WiUTENrQ51Gunp2+zzDWAZ9VlUNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa813c9ad67834ac_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Size 40KB
SHA256 07a781ad2f2ceb3f5e8861d2c07e1b88c6142e551672c6f82777429acd0011e5
MD5 5f85ab4b4342c7e56cd396f79fdcba96
SHA1 fcd047bea513845ac3283a3414eb55e6dcee900b
SHA512 bdc0fc77aedf5ed04e8a2c434f060bac89324b3063ddad448666bf025c921f6376d4ebf9d7e57a70c511d0c148252b784a01a0999845e5a04839addabbe393f1
SSDEEP 384:ecXQpCu728CIYmh81TgcHA+HPKMe861RsfLaS7hhw/h72lDEcBjMpowWl3wZU28g:5XlKCWSNFyHGnfWmfBjWazdV5aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 144B
SHA256 f6169f1c35092385553b624d7a641cd462fcd84802b4bf3969c450ad322c4b23
MD5 4cd0bf2347a05e4ecb377535a5da747c
SHA1 3f1d64445184a1f5b56ac5341063001364e7caeb
SHA512 245b1dca64cb0a55e891d5c580f037bfc380cf355edb4f8060f8049eb60d2c80aca06058fda2fd28235eda34a45989f16fe5a18d3c9539550fd2a8a08a0fff30
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 22cba29f8869ac9ab3e036b7835980339938f74dbfffa307cb238e17d9baf296
MD5 198912312772a71a019ac120516be5c9
SHA1 fad1b228a7959eacf6a90641bb9ef02b8bd64b93
SHA512 e104b6945d34598dd02f31da74c149293fd66212c5dc79bbab82a41a2e89ea2bd689d53d1138ddd6af9893ccfc992ce349c8fde043cf504b4f6f22ebd685ad40
SSDEEP 6144:Gav26cp6ZBA1M74+HRzr4ZlTFqgImLhs6Co:ZxP8ZZFqgImLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 eacdc27d9fde1834b0be1e8fad31440b2ac9769fb71ee0e2145c3ecdb99c489d
MD5 9e6598db73339c042fdce8fa48267ea9
SHA1 e44298651691749feeaf8b72681af50cc62fe36a
SHA512 6a31d469f8fb2c16198d0ca8c9774e3e07c9a12426731c462bbbc48a7f1388b3b7b7834a261dd8d5dc45b31b986b0f4441c76b0595fe728f47dc5e33a4ddf283
SSDEEP 6144:Gwv26cp6ZBA1M74+HRzr4ZlTFqgImLhs6Co:LxP8ZZFqgImLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 492114560898e08a4b5083df828563a47090c0f7660518f6ca06abb29ffec81f
MD5 ecb6b2b16445ff25e23ca07799ae3439
SHA1 fb67de528d8f8548cee7b459818528527555c2e4
SHA512 1e5c39c2b733374298a9302efd195c01888609ca39886b5efb27db5ffebce59fdf53bdd727ab77466a0c77552c33cfc82e99c6a10d7e9b0a1bac49554acfbc94
SSDEEP 6144:Gov26cp6ZBA1M74+HRzr4ZlTFqgImLhs6Co:XxP8ZZFqgImLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 1efbc04684cbd94904c048a71ca6475b3af6e951a0ba1c7f27087bef1e56d95b
MD5 0894653907152ca74cd73d0a686f988e
SHA1 80009456cc1008a698f6ac5baac3d525982f3e4e
SHA512 3df9a677e6ea2b36987c9e701b4702dcf38cb234446f1e83c634489a4a88c4996d3808840c92bc4383c2081176e78361698d02fe76c7abc96b85559f3702722a
SSDEEP 6144:dfv26cp6ZBA1M74+HRzr4ZlTFqgImLhs6Co:BxP8ZZFqgImLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 eedb07ca8359790516b74184112cbdc2baa75d0dd9a9b61c1fc0f96e85c18fd1
MD5 d69632b779c0fc5db2fe5dbffb7404f5
SHA1 c2b6228e33d66737f6d19e1ae85091afadd79a99
SHA512 0333749e37b710054205b1596d365d484c087db20aa9ad0c26a098d08284796c9fa517f58fd2b325864e5d5451fbad6c0caed835802c12bdd7c237130c6900a9
SSDEEP 6144:Ggv26cp6ZBA1M74+HRzr4ZlTFqgImLhs6Co:jxP8ZZFqgImLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 37e5a2e4a233ee91c768ea827e48832f6a66892f1c63f27284735bdaaccfc983
MD5 56eada2ca2f2913cbf0e4ddb82dc9aa0
SHA1 e9da169fa37537e4be8ad40871603e04645a8d95
SHA512 de43823501d537a648351b6dc59c5e9e4ec8d57825a5fb6b7547af5ffcebd882ce3ff12bbd661086dca5196470c63c284a40863cb515ec2f4ac5c4769bb9f620
SSDEEP 96:nZk/Dxm/LQYmqS1PI04wpvWMoiVmdeHa00eUWQyV+VDCziEwb:nZk/wAZpn4GWMXV7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2ac756f03d1619f231cc6da540e5813f1cdd70e00723e73bcb6a64d88a5bdfc9
MD5 5e631b89044e6e80f728fb301139a954
SHA1 1b4ef30eebde1a78f91cbd3f68ba71aff1bfcdfa
SHA512 08f9cb80d89576a832a11e4e76c358048d4f0de509813cf5e99c7cf726800cd5d54f4fb509e99f7270f84b65037d479eaeaaa60b29a758ea9ab80f4594d8e2f2
SSDEEP 96:nZk/Dxm/LHmqS1PI04wpvWMoiVmdeAguS41ja0F7dUWQyV+VD7AiEwb:nZk/wiZpn4GWMpuS4hVnrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 412aec5dbe1b0b22196778f35ad030bf22164b744133de4698f7ca87479ff5f6
MD5 10596c550a3f02cd952baba8b37ba309
SHA1 56ac4c28cefad4f9d5d32bea6899e610945eab0e
SHA512 9011ba6c6ee81f9f70147727c0c9c9ff4850abcc5c6a8c0707aee0f109eb0742bbb0c02cda9272ef5d86b8333221217a5919dd40adbc53e8486ba4502c95d2cc
SSDEEP 192:7AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcte2RUt9A2ru8z8ZJJ/p:k9iIxuERzA83h09RZxYQN2Pz8h/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

576e1c153e9a4c8db9cb845a7679bfcc

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\576e1c153e9a4c8db9cb845a7679bfcc
Size 5.9MB
SHA256 da54941bc273cb5ea3c50a3df7983f6560114d0e9f6fe196a2077e3810f561dd
MD5 576e1c153e9a4c8db9cb845a7679bfcc
SHA1 7fa5235289c1eb038774cdcf30be21cb72771201
SHA512 a4d956c4c860ba9b652647c4fd94ba0a617d1ec3436a8fe267292d36b38805acc4f484aa65e9c45e20c10536365a13645d25acbdc4c23e7506829a6f603820af
SSDEEP 98304:zUvQ2IjlfUfHQuUkM3bDnWZPwpgnt0ntFw8eREAgsVglum8:oQfjlfaC3XXgnLRwsell8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
Size 83KB
SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
MD5 5bebc32957922fe20e927d5c4637f100
SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 122KB
SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
MD5 fb454c5e74582a805bc5e9f3da8edc7b
SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_decimal.pyd
Size 251KB
SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
MD5 492c0c36d8ed1b6ca2117869a09214da
SHA1 b741cae3e2c9954e726890292fa35034509ef0f6
SHA512 b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0
SSDEEP 6144:vnXBJvhy8AJOMg4hmRWw710z4ez9qWM53pLW1AW/ZJJJWtCk1mGc:ByJJOMiRW+10EHFpNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
Size 81KB
SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
MD5 dd8ff2a3946b8e77264e3f0011d27704
SHA1 a2d84cfc4d6410b80eea4b25e8efc08498f78990
SHA512 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8
SSDEEP 1536:ldcydNgIznrvGvLfo4o7zfqwXJ9/s+S+pzo08/n1IsJhv6cpISLwV97Sy7UxV:l6ydrr+DgxjqwXJ9/sT+pzoN1IwhScpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_wmi.pyd
Size 36KB
SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
MD5 8a9a59559c614fc2bcebb50073580c88
SHA1 4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d
SHA512 9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413
SSDEEP 768:9mqQhTcYv/NxO01ISCiO5YiSyvoAMxkEzef:9m7GINxO01ISCik7SyOxvef
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
Size 30KB
SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
MD5 d0cc9fc9a0650ba00bd206720223493b
SHA1 295bc204e489572b74cc11801ed8590f808e1618
SHA512 d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b
SSDEEP 384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\python312.dll
Size 6.6MB
SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
MD5 d521654d889666a0bc753320f071ef60
SHA1 5fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA512 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
SSDEEP 49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2948_133676969628445431\vcruntime140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download