60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4

Analysis

max time kernel
431s
max time network
434s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17-08-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryInstaller.exe
Size

822KB
MD5

0bd82e264be214414d6dd26bac3e1770
SHA1

5325e64053dcf599a9c5cedec532418716f9d357
SHA256

60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4
SHA512

842a80fed2286d06987cd2dde7ae94fc6c7986eb49cc62684f62f148973e5080df7866e1d2f81d53cb5ac95ef9d88489f6765265e29104be0ae349c6a3164592
SSDEEP

12288:c5SsIg0ZvkY29slOLJFbJZXM1Eg/2QAu4NRFNxIg0Z:Ru0ZvkY29+OLfzI2Q0NH10Z

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

pid	Process
4404	Celery.exe
3148	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
4872	main.exe
6000	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
1452	RobloxPlayerInstaller.exe
3308	MicrosoftEdgeWebview2Setup.exe
3664	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe
4808	MicrosoftEdgeUpdate.exe
2052	MicrosoftEdgeUpdateComRegisterShell64.exe
400	MicrosoftEdgeUpdateComRegisterShell64.exe
4468	MicrosoftEdgeUpdateComRegisterShell64.exe
3856	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4300	MicrosoftEdgeUpdate.exe
2852	MicrosoftEdgeUpdate.exe
2340	MicrosoftEdge_X64_127.0.2651.105.exe
5200	setup.exe
1752	setup.exe
3420	MicrosoftEdgeUpdate.exe
6044	RobloxPlayerBeta.exe

Loads dropped DLL 57 IoCs

pid	Process
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
4404	Celery.exe
6000	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe
3664	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe
4808	MicrosoftEdgeUpdate.exe
2052	MicrosoftEdgeUpdateComRegisterShell64.exe
4808	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdateComRegisterShell64.exe
4808	MicrosoftEdgeUpdate.exe
4468	MicrosoftEdgeUpdateComRegisterShell64.exe
4808	MicrosoftEdgeUpdate.exe
3856	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4300	MicrosoftEdgeUpdate.exe
4300	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
2852	MicrosoftEdgeUpdate.exe
3420	MicrosoftEdgeUpdate.exe
6044	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3148	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
6000	CefSharp.BrowserSubprocess.exe
3432	CefSharp.BrowserSubprocess.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	CefSharp.BrowserSubprocess.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	CefSharp.BrowserSubprocess.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
6044	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe
6044	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\TextureViewer\replace.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_1x.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\PlatformContent\pc\textures\water\normal_20.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\button_hierarchy_closed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Chat\Chat.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Settings\ShareGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-6x6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\icon_warning_ik.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\MenuBar\arrow_up.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\PlayerList\OwnerIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\elevation_service.exe	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\sky\cloudDetail3D.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\fonts\Roboto-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\sky\noisefb.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\account_under13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\fbximportlogo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_7.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\MicLight\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\TerrainTools\mt_regions.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\TerrainTools\sliderbar_button.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\xboxY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\triangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\MenuBar\icon_emote.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\fonts\zekton_rg.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Emotes\Large\SelectedGradient.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AnimationEditor\button_zoom_hoverpressed_right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\SelfView\SelfView_icon_indicator_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\DesignSystem\DpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\TagEditor\lineargradient.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Controls\xboxLB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaApp\icons\ic-add.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\AudioDiscovery\ok.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\DeveloperFramework\icon_backward.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\GameSettings\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-60x60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\advClosed-hand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\models\Thumbnails\Mannequins\R6.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\_platform_specific\win_x64\widevinecdm.dll	Celery.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\manifest.json	Celery.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\LICENSE	Celery.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	Celery.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\_platform_specific\win_x64\widevinecdm.dll.sig	Celery.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\_metadata\verified_contents.json	Celery.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\manifest.fingerprint	Celery.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CeleryInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3856	MicrosoftEdgeUpdate.exe
2852	MicrosoftEdgeUpdate.exe
3420	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133683739524933394"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CurVer\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Celery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 986385.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3148	CefSharp.BrowserSubprocess.exe
3148	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
5056	CefSharp.BrowserSubprocess.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
484	chrome.exe
484	chrome.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe
4404	Celery.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	CeleryInstaller.exe
Token: SeDebugPrivilege	3148	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	5056	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe
Token: SeShutdownPrivilege	4404	Celery.exe
Token: SeCreatePagefilePrivilege	4404	Celery.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
484	chrome.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4404	Celery.exe
1356	firefox.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
6044	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4404	1832	CeleryInstaller.exe	82
PID 1832 wrote to memory of 4404	1832	CeleryInstaller.exe	82
PID 4404 wrote to memory of 3148	4404	Celery.exe	83
PID 4404 wrote to memory of 3148	4404	Celery.exe	83
PID 4404 wrote to memory of 5056	4404	Celery.exe	84
PID 4404 wrote to memory of 5056	4404	Celery.exe	84
PID 4404 wrote to memory of 4872	4404	Celery.exe	85
PID 4404 wrote to memory of 4872	4404	Celery.exe	85
PID 484 wrote to memory of 2940	484	chrome.exe	90
PID 484 wrote to memory of 2940	484	chrome.exe	90
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 4748	484	chrome.exe	91
PID 484 wrote to memory of 2016	484	chrome.exe	92
PID 484 wrote to memory of 2016	484	chrome.exe	92
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93
PID 484 wrote to memory of 4924	484	chrome.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\Celery\Celery.exe
  "C:\Users\Admin\AppData\Local\Temp\Celery\Celery.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Local\Temp\Celery\debug.log" --field-trial-handle=1952,i,9978064332264063659,9533780160915164223,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2 --host-process-id=4404
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Network Service Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Local\Temp\Celery\debug.log" --field-trial-handle=2400,i,9978064332264063659,9533780160915164223,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3 --host-process-id=4404
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Network Service Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Celery\bin\lsp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Celery\bin\lsp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Local\Temp\Celery\debug.log" --field-trial-handle=3768,i,9978064332264063659,9533780160915164223,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8 --host-process-id=4404
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Network Service Discovery
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Local\Temp\Celery\debug.log" --field-trial-handle=4436,i,9978064332264063659,9533780160915164223,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8 --host-process-id=4404
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Network Service Discovery
    - Drops file in System32 directory
    PID:3432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebca2cc40,0x7ffebca2cc4c,0x7ffebca2cc58
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1832,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1344,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3560,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3796,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3124,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,18008452515873239933,4722755110074955396,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1700

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:904

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2032
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1892 -prefsLen 23600 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf9aca60-a0f1-41c5-84e9-837d46dabbe3} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" gpu
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 23636 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3349dd5-f5c7-4dce-aa76-011af3b6e976} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" socket
    3⤵
    - Checks processor information in registry
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3352 -childID 1 -isForBrowser -prefsHandle 1624 -prefMapHandle 2916 -prefsLen 23777 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {008a60ac-5140-4c56-b871-def28abcec34} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3820 -childID 2 -isForBrowser -prefsHandle 3836 -prefMapHandle 3832 -prefsLen 29010 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de67741-0356-414d-b6e9-62e180079888} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4572 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4560 -prefsLen 29010 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2146fd4-48bf-461c-b05a-6faa1cf95698} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" utility
    3⤵
    - Checks processor information in registry
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 3 -isForBrowser -prefsHandle 5320 -prefMapHandle 5416 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e73fdc27-807c-4150-9b81-7d051bd472dc} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {296dc75e-6895-43b5-aa21-013997360f0a} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5736 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e92a4d9c-ae89-47bd-949b-172e46bf7ea1} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -childID 6 -isForBrowser -prefsHandle 6240 -prefMapHandle 6248 -prefsLen 27132 -prefMapSize 244628 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b29e6b56-f983-49d1-885c-04021a899398} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
    3⤵
    PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebcd73cb8,0x7ffebcd73cc8,0x7ffebcd73cd8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7392 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2616
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1452
- - C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3308
  - - C:\Program Files (x86)\Microsoft\Temp\EU9A34.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU9A34.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      PID:3664
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4808
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2052
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:400
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjMwNEFBRDctQUI1NC00ODU5LTlGRkMtNjRBQkZFNDM4Njc3fSIgdXNlcmlkPSJ7MEFEQjk0MUItRkJGNS00OUM1LTlBNUEtQzc4OEVBODI2RTg5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRDE4QTMzNy03NkVDLTQ2QTAtQkYyNC1EMTA0RDlGMTBDMEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5Mjk5MTU3ODAiIGluc3RhbGxfdGltZV9tcz0iNTM2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{2304AAD7-AB54-4859-9FFC-64ABFE438677}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4516
- - C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-55d6e65f478642a8\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of UnmapMainImage
    PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,15178949550310495652,2141870813181779267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6260 /prefetch:2
  2⤵
  PID:240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004AC
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4300
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjMwNEFBRDctQUI1NC00ODU5LTlGRkMtNjRBQkZFNDM4Njc3fSIgdXNlcmlkPSJ7MEFEQjk0MUItRkJGNS00OUM1LTlBNUEtQzc4OEVBODI2RTg5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRUFBRTZCRi04QjQ2LTRCQ0EtOEQwMS0zMUY0RTZDNEU4RUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5MzQyNTU5MDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2852
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\MicrosoftEdge_X64_127.0.2651.105.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\EDGEMITMP_559B4.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\EDGEMITMP_559B4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:5200
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\EDGEMITMP_559B4.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\EDGEMITMP_559B4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ECC57A9A-8FCE-4335-ADB5-4E4FD1B3D7B2}\EDGEMITMP_559B4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.105 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6a73bb7d0,0x7ff6a73bb7dc,0x7ff6a73bb7e8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1752
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjMwNEFBRDctQUI1NC00ODU5LTlGRkMtNjRBQkZFNDM4Njc3fSIgdXNlcmlkPSJ7MEFEQjk0MUItRkJGNS00OUM1LTlBNUEtQzc4OEVBODI2RTg5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQTIzMUM1RS1DNDBCLTRCMzktQjExMy1DNTQ1MTBCREQyNkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjEwNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzk0NzE0NTk2NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5NDcyMDU3MjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTQ5MDQ1NjY5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy84YjBiMzIzMy1kYWFmLTQ4YjktYWEwNC1iMzRiYTllNDI5ODA_UDE9MTcyNDUwNTMyNSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1rWGJuTkdrOHhHQ0JHOTBBdmw2JTJmT2dPUE45bUxZcXQzeW00UkJXTm1haTc3OHBLMFFmNmNEZkVTdHdJUDY5YmtrVTZ2T1NlSndmcnVzMUhJUVdxYTBnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjEyNjY0IiB0b3RhbD0iMTcyNjEyNjY0IiBkb3dubG9hZF90aW1lX21zPSIxNDA3NiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNDkxOTU3NDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTYyODM1NjQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NjEyOTM1Nzc3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODAzIiBkb3dubG9hZF90aW1lX21zPSIyMDE4NyIgZG93bmxvYWRlZD0iMTcyNjEyNjY0IiB0b3RhbD0iMTcyNjEyNjY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NDk5NSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3420

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3848

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Installer\setup.exe

Filesize
6.6MB

MD5
96937bb70ddb5b3a89651ad8391ce5a1

SHA1
3d5ee58c00667b4dc63da7205c20b1c335c3efce

SHA256
60ae19e62277efd9bbdc93ccc5fa8b4bc1f8f6537115d4a7e8e8df3c2014315b

SHA512
d3b1c07157817bfbcaee4bf196a3743dc177470f82880d5bfdd5fce573434a652f7da5f1dbc40a086e0cc6bb9ae4bdb4f8ce86985c8dc01923418724caab6c0e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
658a6b0f3866e63545503fdff59d000c

SHA1
e5df1309e574ee77ca1727bf64a269f376d5ebd9

SHA256
61b302dcf209bd7a3288a6a9e478c6ad0a5d6b195f5328f827c938d5122f679c

SHA512
bc02baab236cf4427f26dba22fd3ab977abd8df1eb7d30b20d7b36f410f70877872a85f6d7bfdccc8b53c5e2ff5a70cdd056ac133d0bb7ec5a7596fbb7144e8a

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
48c94c8c574c7abc7495077ebafee58f

SHA1
0c643736fc55790e17064ed696b8a8fb79c2d6eb

SHA256
52aa43a06a7b1abf144c9551a3558ba90f5232d1b787e086830b0de95d61f3f1

SHA512
3426b86c2b3be6746c89f1fcbcb15a3638350ce76607cc9b2b005fb2e459a996367371c80c16fe27f25dba7c0cfc87fda4593ce96a098b675f22caedfa8e6ed6

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\bdc3ca3a2e68f96b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
f71640f58f92facbda48c1a419a7f172

SHA1
a2041d4b17cacf37b2755d44950959f2fb527057

SHA256
38089b9b3e939c5c9f1ee86a05120cc037ea43938d16ec643515d9eb01b53587

SHA512
52ce079ff0842622c5a67e698a6e648acfe5c23db41fc494186808f7607b9ba28c60f0143c7aadd880272fd68ab944cec525e8b4c6ec0c0afad8d452b088e8d5

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\bdc3ca3a2e68f96b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\bdc3ca3a2e68f96b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1KB

MD5
91319e6f4bfa8f862480dbb598ca5b4e

SHA1
3273abbf34459bfcb13734d6a9f53719f7d3dc40

SHA256
b48ce6bad544afadaaaa19bfce7a90dc4187f807f98d6ce8396d8144efa7f3e1

SHA512
150d1136348e50d882d6f1c2e6d463ac0a33678686a092df4c44297aa2c618131c314acf8aedc319386a825c870d33ae06e0e58c8fd752cf8d8a3aae3d3911c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ad92709c4dd982de098e3d9975601aa9

SHA1
ba803cc3ac73a81d37571e724e87c849e5a7581a

SHA256
4566f63439b93f0d396f95da93acc42f9946c9bf96f902bae669ade9f151bdf8

SHA512
9d8ee9d6c8e520e0c0fcc120578b313f37de4aed0ba777f5a291bf38a0de7f734389bb57d1c59158752ee7a315a63d8093333324485db0ade2cf860e6759184e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9887302fa24f3c10126b223e56713fc5

SHA1
13c29c426534c7abcd109ae11f3298822b8af543

SHA256
3883296b9bd9f72c6cf513ad02d12985bdce48cea5d46a78832d1b1186b8de97

SHA512
82110a00efe04ba5f958d59e893c41ae41e228aa0d370da59fa211c8493416635f85b2941c45d8aad75b3c96b92fc91a802331dc786eb5c554581e138d1582a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
d48a376a6fcc2936737803da0cf026a0

SHA1
90caaab5ca194e021a3482bf0109dd64093d4318

SHA256
6555148e56435091fed3d0eb231ca22c514ee713e665cba88f3a8fe42665fa3d

SHA512
d25e61aae3e121eef398beb9702bf7e56499c0029e22cd62e7e7fc49dae90fdafde53cdb1df0aa856227f28a670a806f7f76c007c93fbd5a8717df6fb51bbb44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1188f0769baca9908116d9e174d85cda

SHA1
7fe6927d7f15c614575701da119fa4f5b0f1cc1b

SHA256
35175df808f98bec23887d990ec517f4637dc48c328e2e6f89cd33d31d2d4049

SHA512
e4e94fde3b50daffd8fb0cb9dc9501bd6eb36e4c02802996aae96d67b1cde4ce5da9025ada5bd5c204a0a60cd040ef45fa1d20da7dad01bd64b430c28de3efee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d7437de7743f67cc204893a3d13d76d7

SHA1
10835818bd51df5c0bcbcc3ca8dbb241972de816

SHA256
56378063633a824e7d237f8e0a6cf218a6c028410a4bbff1ac455bf3fd865688

SHA512
0ae14d73d724e2e13e7dfe2a2651d9afb56b1abc84f98baa6c9b6625096eeed01996f8a11a89c2bf97636d60d743ab418b47969036cd545406b30baf7eb7d732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
61423abc38eb3bfb1b81b5c9eb3c3c0d

SHA1
53fb50600116f525351edaeec9d184df0b0598aa

SHA256
3177bf722c04ed8d1d662d26451b897034eef055b43937d3eb72ff28a75c506f

SHA512
4837c3bf36655ceed7029d07b2aa12637e5a87e060c1b36b3c7f8ba77937aa36ad731096b6a1ceda40da4c7da5767171f538543ac82a656728eb0d5a2c93834a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b613ba95ae075dcb70f8bc206315eb6a

SHA1
dd714c9aa2e54a32a2393c831f125360c8923b8b

SHA256
e8db4670514663f147be57c925c0e4354c5ab48352ef7ee56afa048c20abeb6f

SHA512
f90701c4eb787bb81a36881f0f7d7847deaf5ff0856cdde22b81136f4d9f7e4e995145c7912249683336ee812cf66faea1daefbf70326bf9896cfe5d41c44ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
08074e5c9c5046510e9c5d64b53903f2

SHA1
404b98ef56b93e41c44949f2e7a3ad541552d4a8

SHA256
99730937dd379cd17b0c43048beb6292322b7d58a285c361abadf0e4f57dcb13

SHA512
fc325bfc31bf26e32e6561d9763fe5b15300d1dc2360a35cb9eafaa273939a14a268bea86bd4a21391b2ef6ef649013c628ebb63c1b0a4574c6ac8cf971f6f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
29522daf8c0135fd5128ddebeccb2fa7

SHA1
703711c8058f7a569ddb4850198eafb153fbf14a

SHA256
5c731d9124adaa4809959edc9dc3071dc0338a83e62b94f049a19d31231869a5

SHA512
1c87c3f9c97ff2745eca7b0b58caabb807504c0af6e594bef7e61346dd1821d088a37dd103d3a75588112c27ece0e6398859617139db70f708e9c85713672ad4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
2ca20112b73a1b3e5f253161dd04a314

SHA1
49265c5169c46811e124bcd44968556d2bfad07e

SHA256
40bfcd26b723e8631dae5e662444a754d170e7329737c65c2b2806eb85dea051

SHA512
6f4a7ce09adc1f617e798f331295326b733d9729cf3206cdadbaaee8a3bc1a90746d2dc1fee0188f564b134165ee05767e012104229b94c3c4df5902d2c0d13d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
34b2e9ff972639971e21a696d2761352

SHA1
b963d663ba0bcda16bc157d735111288f2c0b21d

SHA256
8d064a514bce47ca3ca061162b561b1c75e8699545a5712028767f0a4eb4a8bc

SHA512
6a3d6173bbbb442993b757cc815d9b6b946a706dc24eb860fa2bc1dd648dbc9018ee610d6462dbdc0689998af75a6545fea7fa236d1769c927d6d568610314e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
5a3615252e138a9d64d7e6931baefe34

SHA1
fdc0ccf1a459c871b64f0124eff394a65b542f25

SHA256
e25eb70429ba1da79f66f007c6e3336862322ae83814f8238b98fa30736fdb0b

SHA512
507d57c563d9d23b4e64609c384d41d9a1483824ce37ff1a2456d87dcfd3d44d73b7f575b58fdedb32c10cdfec99560be089bc4a637cb419fba0fee2a4aa5520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
41KB

MD5
c79d8ef4fd2431bf9ce5fdee0b7a44bf

SHA1
ac642399b6b3bf30fe09c17e55ecbbb5774029ff

SHA256
535e28032abf1bac763bffd0ba968561265026803eb688d3cb0550ad9af1a0e8

SHA512
6b35d8b0d3e7f1821bfaeae337364ed8186085fa50ee2b368d205489a004cb46879efb2c400caf24ba6856625fe7ee1a71c72d2598c18044813ecde431054fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
0aba6b0a3dd73fe8b58e3523c5d7605b

SHA1
9127c57b25121436eaf317fea198b69b386f83c7

SHA256
8341f5eb55983e9877b0fc72b77a5df0f87deda1bc7ad6fa5756e9f00d6b8cac

SHA512
6a266e9dad3015e0c39d6de2e5e04e2cc1af3636f0e856a5dc36f076c794b555d2a580373836a401f8d0d8e510f465eb0241d6e3f15605d55eb212f4283278eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
42KB

MD5
ee86a8fc4037979eb95fa138d706d0f4

SHA1
f3971cb21c6ce9836e6fbada8b1b2efe338bda94

SHA256
78b16dbfd1e958f81531098311375ef6d9f22b284611993113468729bd295915

SHA512
07b0ac11283803f53d17ba18c050b11e0941d389ce1a2a730b8b17487ad5746feeb8996a4be3535f03a7b8f43f59db4e721febf458d9bcfee952357188cfca89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
25KB

MD5
9db07760a457f806bc52d3cebd20bddf

SHA1
ec098009fb984d8f08fd26aa6d0c7fa8090d98b5

SHA256
03cbb4ce81c0f8acf377c2bc66b9788bea7fd7ee543763dab425419f5eaece84

SHA512
b0b349f305993475164581775fc294d495acf5ed9dc07ffcf4ec64a3bba714610463ca699f740bc0f40644f35efc6d424e63ad8f57b5a5cbb4164fc56f1ce7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
22KB

MD5
9196e81f8ed7f223d765423c1f9bc8a7

SHA1
88f9d5c2a6908cf36b8daae803578ca9e1fd2929

SHA256
a4e2bcf7ef3c6c614c2142d3c1fd44caac4eafa86a1779ac31cba164e2d89cbe

SHA512
e7d23866fcac017762d2e2f18597124e9147f458d30038f78ba9f3a2bcbe479fe4792573894370ce2d6f93a00401231d9f01955fde351ff982a82ba87a8241f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
69KB

MD5
81f3f9af338b2c41e290947b196c0966

SHA1
18b9ea8fd7fe17c8758b689ae3ef6fce01366249

SHA256
f4734a755d19e1059d01175b35e0b52c901f4f2a45d948e89532fe9c175eb2b0

SHA512
91721f44165bb590cc1d862f2c906379dfbdf7969ff65859cc467d4ce73ab5292e32a10a8128d206e416dcde263cdec609eed2576c601d2aafc27e11f1d5891e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
74KB

MD5
4cfaa55dc88a3a4ec7146483b1636fd6

SHA1
780e16bd01e895d371d8b1eab5431cd3fac929e0

SHA256
4fb4865f9c719d815717f57d0db57d542f19c7ab607a61fafee32c03fa2844d9

SHA512
8b44639754ccd0fc5bd2bd22b28da3ca7dac41316d574f634477993134d22fe171cc5fe12e76fa09dfedbccb73d75d6835d640a670ed3c5a654fe462da31b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
149KB

MD5
33ea63643ef4d040e0ab766162837035

SHA1
790304d5915a808ec8e21026f12ec9f1a20e8fb1

SHA256
6ff46aee75e2436373e4bcf3b97b580423e1c3a888a5beeaf237e6dfaf0cd789

SHA512
548009ddb9ba97acd82b70a98f81068ad192de2cde5a84bc4c8cf85eadde33b599209e5f3ef438ac0202df70565c13625d54509eaab4aba175afa62a9fa056a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
326KB

MD5
b304fe9cdd1ae8cbb84b0ec3d47cbf9d

SHA1
1a412ad3fac4f36b6a54b3c6668da1b8f1febb22

SHA256
4449c8d979bef64b11979cf9bd38aaf77bff7dca8c745e0292a2dc99ce3b17df

SHA512
83d90ceeae1a45ce1f69a2c7c1314cb69eaea93b91aab12284793c0c7a43c19fdda4e9b0c8530dc482026ab4f8817b638ff7827474f3dc1d4ad4598bfbf62186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
46KB

MD5
901e91903191d83a4a8ab3ceae5fbc78

SHA1
f7cee61c87058e7b973279d31a5b63663a31585a

SHA256
ffea2d8b849ee478d511b0411af4b92a16d977830dfe9bf4c45e39b3e5e75db0

SHA512
ff46ad6e1f21d9d5b3c1c7fdb74fbf208ab6f35c297855b0872f993c9dba565781c4219b0131b6fc5be360b891dd9b11f838c151ab546c0284ccb26132b98ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
17KB

MD5
db43283e390fb4261300a6d1f6b640d3

SHA1
9aacb0ac17354eabef1d56a853e2cd4c9adef7f0

SHA256
fb46950119c610b7ac4002b92980e8fc3e70c861932906c6428db73419495a21

SHA512
3afe4a5b1c74798137d5c89a382b9eb708912dbbef2dd10e50d5bcf92c31f40d2c884f6be13f9d72231fccb049751a4f0b240a1e063e02cf357f81fdb3d24221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
40KB

MD5
b786554392ab690a37b2fc6c5af02b05

SHA1
e7347fa27240868174f080d1c5ab177feca6bd84

SHA256
ebe47cc89c62447316148809bda9095bd07bd5392a99ab4b8ac8b9f6764cda51

SHA512
b71cdb76464a775fca909cabd0a7435c34de3ee4e19c40f5bebba6415295f0be2f82532a2ecda043c787ea4e8c23fd4e582a4d4322923fdf603a56e3fcb8b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
16KB

MD5
527d64e50a31837d3e4a8cae00bc6c05

SHA1
fd00c7767110783e9bde75747cb13f3bd7ebac44

SHA256
c48fe6f19f555019c78c8b160125fa8d780ad0378017545f01cde56851a665a3

SHA512
f76f36c8918a49b22a34374cb1fc56d856ea04666cca429b7c6746d06ac50cd4d0df052aa196c7b3cc6e74242064becc67b373d74e0a391c52561b74311d84eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
23KB

MD5
7ca166ac4b46f8724db08c88a17f82bc

SHA1
5e510319277f2a1769a351aa8a2ca18136402b3b

SHA256
b906f86bdc58f5cff02e21a79e9cbcc717a866a74f4272f160aecd35b798fbaf

SHA512
8ab41e4f90991f368991d5364aa9e861443b316017a676ee4854148e675721bc57afa0959b412f207aa0cef7f27e3e5dce0668b631c1b8cd483893c63bc3fc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
30KB

MD5
8c97835882fe13bc8934c8292b4ca23e

SHA1
1b707b5aede297909bc65a6417ec1c554aca6e32

SHA256
5c3d493599c063da01568761dd24f6b9423fa778f77ee7d7eb53af671dd01afc

SHA512
61bea89096656eedd4d17af0b6fcb6be8a7b8e5cf72df199b78a5574b0771f38cdf2e6be6e5990ef09d8efaaade956302efd5b74c46c022b3507e92b492627e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
44KB

MD5
9a9b3c88a4d8de826ff88c82cbce1316

SHA1
f0f60bcc972b4a64937e880fd770966242587183

SHA256
f392990f0cd84dbc2ef97aad29552d64471272b0c8074eaf50320edfcc0bbb43

SHA512
559d675f797b9b4009fc20c9fabccd02523e6ab9724a3b0e8f8e5786e3725fa36a7b49980dc7f54b58d0723d4b6bf0ead4d3ff696597f21922e77ccaf01ebdf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
16KB

MD5
5378f67e316e5abeaf3383ca55bb51ee

SHA1
10c7096e5030f8e912a1f2d4dc78c4ec1a854c8f

SHA256
6003b510e802c6e597d399ae3aaa716e09e413983d69489f82174c3d33d2a77e

SHA512
ec76e9c3282d060752eb6d01530ecd1d4e1403a05c1c56005ebc8a4f3f078879353b28d622715a7a48261e8c3ba6236e226075bf4ba73e019fd0a456c0e84445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
203KB

MD5
89685e89c7a11f32170445b71b8e0710

SHA1
8649bf3a69d5e981c0a75103e6eda45c3b980297

SHA256
a88b911c40030ee20ae2cf635ce2e64a428d418cf30391b4e11de394dcd22259

SHA512
c920c1527691dd623288c0abf82de0e2522c007a95884e68a2d4fd8196e0867c30035a98ef849938003229345f3bc52e059131f4f76daedfc55044f05dfa5076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
29KB

MD5
c703189c6ae5c9cf60a724515d682de0

SHA1
e24600a7450317ad60d51a8cd7077d18003246db

SHA256
f626c61ef3daed56b00eb240f5513416d39ff233866fa20345561739bc1b1184

SHA512
b029c1622639a4429741c767cbc8b5882a237b3190e9e872a8a0ad7e938732cdf40c520a835705d83d888634c5deb8f970a3537f9e04c9e47b252744ee1812f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
169KB

MD5
96c87eddb9c136adcb990d3d231ceba1

SHA1
74b7981afc041fc0defa01c063a41f6f47521f2a

SHA256
6dd8619e9fa7df78cff909e83f783a33f9c748bd33263459548a47f793abf1c1

SHA512
4b6516402f51bee8bdd49fc67b378869737d08060e4fd34dca76b2409ad69a2694ee837d2974091ae92189d220b23e3c960724bef11c5b8474d005417777a341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
69KB

MD5
2f57445dd3ce373d36b19136fbf566db

SHA1
6baf116b5886083afdf4145ab132da08eef7d583

SHA256
81aa5fd9e012645395ce283fe366a8e83d2584a4611574c3884d8d088c8858e4

SHA512
0cbb0f18f5eb6cb348adf90565f4830690935074835a17f57ded89bb89bbf5f1f2d3d88e9befcccfd72265af36fe25654f551ea961430d24f727f5f590b03283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
27KB

MD5
3d518337b00fc8e40e6cd4f719dc0dc9

SHA1
fed3f3452f1619211e3cc2e5b52929d64dd04b7b

SHA256
5663e51a5971a2c740b14a1d4e304e8caa4702e1fb3c9dcc29cce18832ced827

SHA512
8f14be81c2cea426e38af25664eb39cd4c47075cb17ce78b0a29e07df2f741efde4717268bb24676e5e621cd83173e7100a3316399fa95caff7e3f8624d9be43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
102KB

MD5
a9773c94b65d5e18a03c88dfe358ad69

SHA1
5d33334d531e0db7628ae2b796d1085ddf67a50a

SHA256
a99a7e88af51e1816e2e52e3a77e0bc109e6e4e7f328783203bd13174c7f8ff1

SHA512
8fdb6b4a1fe3ed7551d02ff2531ffbb01b09c7d2308977202e909f9e3a3e92d02bf91254cc2dc166b6a93044a332d757cbb13cd513bd723c225abedc16017540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
49KB

MD5
30033bcafbf30f708c6797a42e9a34a2

SHA1
7b6f5e333c27adfd63d3486e53c13940627a6c5e

SHA256
0ffff04338d5a3ca40980e65adcea217cdf2426692872360739a432a0b72327c

SHA512
28443ac7df079759c04f3178c1b29ebe3ac16eb29bd3529df48010bc69e9d4d44d67633542db02eacbcfc3d9f54514cc1ac3fd9a3d893b0b889a1aa234990d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
60KB

MD5
9921426afd25027cca286ec58f6a56fd

SHA1
5b2c33b1984baa17d3a1e083e3feda907d69b264

SHA256
fe0dfeea5c13046fd64b53d94b094ba5419fc3135abdb21cd184e4b911db0d51

SHA512
01352b337edbfc591bbd62c0ee07d90def5e8e4a0b957bb7021c1b4e33aaa5c5e54b2ca9672f73d00d2d622dfd564ef5a0c3a8a11deb0fd3ea0a1639b2601b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
51KB

MD5
f206f8337a187dc42199ff6772838d22

SHA1
cb3f334350c77fc705d9dc3db778dc1b4a03af0a

SHA256
40163312d820a039fbdd57dfe4de9036a06c844474c845f357451706b7a20f2e

SHA512
97666a93f1a12426dff44c283ce0fb3da390a557ed53d02d5c79387b346d2f2bf77d0ab89c7d138848bf268330391119d9f1c8ea5032a93486c53c913af0a651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
31KB

MD5
a186e2e28a27ebebcac089aca8dc149d

SHA1
6c9800a679ad6794a29f847810fc69722c2ad68e

SHA256
24f2b438b27de098f815d645e33372c1ae9fe3310337c1cff623ad2c2bdd7999

SHA512
752c06e6b339dcf58a911dc098e6a2e682e1ea58710e48e9412d9f65af3a27c0bf9fec30b76c5d936447d42bc4d0124cf32759cdb546d7165c6f69b73b3cb716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
93KB

MD5
976c9e87ddb05b7e23583e33c2617341

SHA1
f0156c5ff3ad0ce953ea94d3a08b94797b4524ab

SHA256
35a0ee1ae74fe2fdd6a1f03661def75b303adfef0b361a98e41e44c119f156c1

SHA512
a68d40b981b7a0e6ae651f7681d5b2926190d18514533738b4245dbdd56fa639245ca640226aa9d188c11dc22bf130751c22737bf3efb8749150bfc79fc13474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
16KB

MD5
a13ce6d4582874c8ac060669900c3601

SHA1
54730abf831063af13cffe68c57b459d0ef79af7

SHA256
4c5573af163d80b030d43060da78d5fad006326dc6a2318bb5e50ae1c4579208

SHA512
eefbbe1b45b0bd97e64ff4f78531d5b57270b97922c02faeb04183cf6f099404e90e26ae4c6a80de27eb34d10c92143d3f0275c87518ae095ab2a7a68db1ab22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
21KB

MD5
7dbd5dca202b651abea7db3d092712f3

SHA1
cfefa958e9cc089a5355b73145f8bc834a00552c

SHA256
16c7b582088cd626101f338070c7046b3fe902a4ffa0069651392314584a4b46

SHA512
eb9ccaafa365a2965ac92a9b34a065913825aca5fa1dd8db772a97fa5928bbc5bc80ff6b536d66f523ad7f0f5304ddab861e0e5d1f19ee7f2b633ce4b41d9c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
35KB

MD5
5009982b60a0f93eac4c1728e5ca17e2

SHA1
c0f932d333b91a4b971a52ce88bc96320745064f

SHA256
2ffc0ec332938cbce14008ab246c3d918800189aece932e92bedd8adb8332fe8

SHA512
401dd0a45c177130628787b92a17642783d27b1a977833af4110d81cbf2572a159a371beb473baa07ad38ac8297551aadadd2ebb80401a73acd580fdc03964aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
09c5c191f78806b71f321920da259b60

SHA1
1ea95e45c87a36a2b2ac3de6fda3fc2e10968c58

SHA256
703a6e7b54d9fd4ecc780570c81c990a0406c2b7f463003d530008bb24999984

SHA512
955070264d980bc3926069d425a87601afbcb009088a0cb7e6a6de6183e69cdcc33993a391dcbd85e93c6db0a008c020f1c8494a4fd0b2b6ce46e4c778ce73b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
71c3de12fae9a789c20673d248913777

SHA1
655c09ce928e4a4ee7ee60a2f333b8389944bdfd

SHA256
15b843c3f5581fcfc05dfc2c3f2f48cb22be8ff8dac9df1b756894a52b450067

SHA512
4240d0c01b899fc8edf02d4304a541302dccd61e80fc4b8910ab40aa3491334ab3e506b4eaed1d31064bb2700900f3f1e869d06a9d9ff73de3f691e74347773d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c3025df195d70648a1ed6149cb2d4633

SHA1
81e76f4200f8d496d4b9a6852af548592f9c2ff8

SHA256
77f0c995304ea493190fd50c06f943feb4a0412c0ca4737d9efee7f94c48401c

SHA512
2388fedf81be44040a5cea2c87df9d9c2eeac74ad706aba54ff46483ddef86d2dea83b2cfc446c8c60e043cc1d59446fb9df386ba96d6d9d2c154fc189ff1307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26cb2139341925ea7be4fb682556523a

SHA1
e6d2520bb477904fbef291d5d3a3a9581e35ff38

SHA256
409c1b0a73c041972a455f7770a21a41c9a7a03333082eaf75c89bc853db7f1d

SHA512
a8b0e783d083e51aef80658e96e509ecd9f311814bad5b47827a9511badaed8971288c3891206a92f731b8fbf93095922493be04f6dc56579c9ac081adf592f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d092a3776bcc91953572ba35488c0d7

SHA1
77299af3c57cfca905f413fec0f46c4e6767fc7f

SHA256
987bd70f9267d226725f24943f158f745951dcaf73ac8d46afba729a591b59b2

SHA512
951298b64671562a0acb8652e5fc1451694f552983fa5adb7bbd4dce88d2c4353382c6f1c8df1e5718e5228760a76f31cd8c391c2170268ddb173958d8e1862f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88a99d2b1d76c554fcabf3991f65554f

SHA1
20e8454af6867a3f89c70e6627e08392c70587b5

SHA256
0c0b1541d5699386203a8af9d03079861d0dfa766b3736c17f02ebb35551e4d1

SHA512
0a9e51330afe222b9b5ec0d8de8c5c4bcfcad315222978701adca9a7f53a98842943364093a1fbe52d5d5bdf36636bb7d28cf35fe06f26ad112e6e7bd94781e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6b3c5a7e46ae34b255bac754e46b0ce

SHA1
878a393fe619f0b72a9116a732b3c5560c88bcca

SHA256
b5103e94829e4888f612cd42a08efeaacc487e52f1c9122961e5097d79ef2dfe

SHA512
d36d0c2b38d841e991e703103e75dec3c10ee52c25e833b3d94a0c52afa6aab4007a05ffec5660e28e292d1eb0010f34b54e5fa8a514252c8c7e7950827ef774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b2506dc75b17a2618c570eefc80a913

SHA1
b71386bbce11b984c3d4c98baf2cb35c4e813cc4

SHA256
b50f9dc7053ea6a5b8fa7dde501944c39b7cc13e04cb568a5038c22c2d223760

SHA512
3a89b75f897d982e3a0de0c11c2ec8804c83cae45dcdb1cf84e059535051807a4e463086c265d552b358a6259b54b8db8dcc6ff89628b195e1e0cf6fe5298d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0bb7a9242ff26d49ae95f0cee7b0763

SHA1
1653751c4af951f366248858f6ced8c8fd60950f

SHA256
5708c57901c4bd6a1df9a252a50b48af173f553f26bab4da8703d32eed839da5

SHA512
fb41abdb0860eafdf48917d2dd30f714986729e4b49f3fdcce03c606cfd05842562b1f2563910c28db432f4c28e88526b3e60f8d65abd8e271c37933ea9df83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e091ad9cf9a296620a7fd7e0f0c33412

SHA1
33b6a2c617ca3bcc004b14b79bcd9596e3fb04e1

SHA256
5e34fc72e07f55fccf83c91400d5757632a5fbc0f744066dfab0c512afd1d809

SHA512
2a1f12d043dc50a202f9ee85c5714a6d8cdf21c0dab73090eafbbf420c30c76a98508d60f734fe011a3315d7aadcc0150c2f7f0d0afa399629e0a2fd078c3f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37933ea23f1207e8e221754f4f6fcfda

SHA1
7b04eafa4e35c31fb162d918dbb92a4acccee262

SHA256
3ca0ee777d7771a7744638e6ff357b9062e08d9cc45c9df49b6690f228ea6c01

SHA512
319f15c4518a5545c0f56da426870674595320237cbb743aafbc66e53703f07981425d2f8ebe8008c10aa0746e1b6f02569c623f2d6ffb15dfcd4fd655267bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f427c5dc4fb782127e3963e5b2cd468a

SHA1
f874c4c0d31605d07c06bea946e3aab41d94288c

SHA256
359a31121cfa3066a36196eaac073e9da4280a7196890f7276552d1942a910e6

SHA512
abcfc54ff2dce54af3ea92b4c1485483ed261e4377abf68ba1ea2d71a79adc7f5d4e45ce2dc8a5fbafae84035eb5fea15f404f40520075feb53faf68c8e6d517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b3bb30c59e967da586923b9cf5207f23

SHA1
760b23bea4949141df3dccd7578d913a97a6d105

SHA256
e5b19f306dc2af30cefffd92cec835656de84f8ab220ed5fedd20a3a730a1047

SHA512
29be96e9f328295c17c57fbc447439af2ae216cc2348913defb6acb897c535afbb7a35f230b4b23c746bd8fdc408d1dc8b7398ed7d804f35be43d676ad66b43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
93e9f1632477e212004f0800659cb447

SHA1
8704d5ac05c54708d037cc50f3e2201f9c00da2a

SHA256
4c18060de493609ffff8478db9e841dd2eec25b32caccfed8539dbf47c7cff89

SHA512
e5fe763c7fd20ebd74105bfe65be72ea151b29f312867266317db1403552181d06fadc797ef0f6b00ec6b1cf8c057258e376fc685245dabe7f57f221af21f0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
734ac8ecfbb0e94d8a10d4738f342851

SHA1
ecf4e459a84ecf8939fac7aa63c79626a864a676

SHA256
fe9218b74a3deded73682f4c802ffb0a6b668108f7100275fdd7a050558a7d62

SHA512
f7d943ff3617da70080194324caa8dbec883b09d84e4444b31bc1e6d28975d11cd5ff38a3cd47e5d545589b99deaceece0f2ef0e326f8a55a622bd72f478479d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
66a5d987bfb1247d2410f8aff81cd714

SHA1
55b86b22e1448a0263558f294f50e0576a79e28a

SHA256
7f7bc7e2eb0974ce19358d8efab4525935547cdabe469c085a1c3d5077696988

SHA512
eee0500e838d65fc1cf1075b665f65f98f165806fdf6c6eebdebc533849cab6502c5a961dda2fd08298c22f7f7f9a57544f64216624afc77e533a408a413d5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2ab4308ac8764912394ad5fbf1c3643c

SHA1
5fc5afd5cc4f7a55b9eae2811de4e449e9fbcde0

SHA256
593cf8fc0812dcbf7795c8fb3370773d8d834a5e5b7e6d5680467c5a364f8e6d

SHA512
46c43d0b176e287382b4a07e82739406749ef5158739390de006db52a9ba4db94a4ec20786444082707c7699741ca1f48c88b66c34946bfb4c31a04849ac927d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1590f55a2c52a64882f60f35594ef13c

SHA1
f8358c0481379d94b470628780e459d661d94c37

SHA256
b264c5dd14b2f4f1d549edf3e58c504c775aa892be8f977f0ab584edec4fa182

SHA512
1d82d9987df192bbeb41407d7075162895c8bf72b7670b5af1484fc8a4db2e73d48383600c3bf3cbf5bc45f0c37d9bc50923d07fd8339ffa430a1afd91551ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26cba74ec9360402b2f74400286e12ac

SHA1
471a36b34bc6d767e4cbb228496eae70251f855b

SHA256
f48a990d849ef8a15849979a17f502498784b22c8fdae551551fdf9ec328c43e

SHA512
6b25ab2e50b03169acba47cee9db201c20ea6325fca47a6b2b289dc2a7f7d9bb557720400778c6757287bcf88220d366210e3cfbfeb6fe12208e54f9ccdbff12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf8c274db2388f48c38d0b74b956677b

SHA1
d94d6af4d47e5031d16d33e8910dfe60cf12ba95

SHA256
38b05dc170320d43bda80f1e7fdd572eba1003217ba52da7c5af8b278f486ace

SHA512
7cd8ae3f79f3be608a1061d7c4c2857e5a9940ed51892dd54e41dbb682f05164f30b731a56e381115324371724ceabc694eef94295b4b358c06a30b60934367b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b6dca.TMP

Filesize
538B

MD5
5d3fe5b30b538a30c292e413d7a5dc7f

SHA1
5370bfca3f2ca6498a10b69f54d39d2f2c43ba9c

SHA256
01d79159bf699b8136102d4e469b2069056034ca8120f4fe19c5a8c9525d5e25

SHA512
54d31953e61ce8c0e425e44053cc4ab5e0bb5eae69379580b017b6fd6aebe91cfdf9326ee4ba469923318598686ca0bb0a5fb1d31ce664ea97fc2b603aef9f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
557faa6171bea07c2e10a0a1d548ecab

SHA1
d31542d18453d64b97bd6feb774983b70569662a

SHA256
b0dace5b56367992a5d19cdfa8450c107e20f3e0226aae3b8ced64c58f596a16

SHA512
a253a590a3a50f9c494c3bb2eb6fea0ce11b7e6cb14a8babb113d23bd69d9b2de196df54ce734c4720d320ebf5bf965adb931c54a0ff026700551fec1ae38d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6423f1ee45cd84ca7e1643d78f9e159c

SHA1
738fd0920383f114d7c4ac9ae990fda134a1839b

SHA256
81cc0fc5134872e162ae3735ef7f67240b729308ed39f2a0a1eb8602f0aa6eb4

SHA512
54c425dea81cb9a886c7fbc885463e46dc9b8258c1344e94cfd3d4bf175f098fa44d02f9f1e443d54b7190840eed2726c6f2eb202edd53252aef8227458f31ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bcba7ad72bed55e29384073d7356a78

SHA1
1edc3d45eac61ca0847725b46c5b006297e0eb30

SHA256
39cbb7ba8a3a3f2b6900bc1876b784ebe970c1c60aa1545cdf0ac27a4af2e4a4

SHA512
e3eab3f640496d55e2d887ab4cc2dda41bf08f7c172beeff878f5663e131149169374dbf369a50980e55595dc2e5d180eecedc286d63c7c8bf3e6f766c2ab4aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\cache2\entries\8709E8A0A3A140D3BA059C3A07420EF01DA5FB25

Filesize
32KB

MD5
d5f217ae3f7543c2200f885db79c2521

SHA1
ee50b6d8220fd964af4009dbd5638c1140eebd13

SHA256
c4f98914c24656634e479c18f884cf30a778102d7af8d45c46dd8c7e8cd53d66

SHA512
d48657a945eac6036a8f8f77035183181ebf4e91a1c9988116e35ccca0394bcbad593950039ba30682e68432f7326aab4308ff8c0e8297ed8ce3e0b7036b254b

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b93f42f728fdd67f390b066d6df035e0

Filesize
5.9MB

MD5
b93f42f728fdd67f390b066d6df035e0

SHA1
7c7f3e149096ce743262cfc30974689afc5c5152

SHA256
f32d067a66abe3ea7761ca4f698af726e82234088f3e4218e026d698c9c5f6c3

SHA512
17fdbe368d9f75e2b0f1d2c7e8730d398d3e6c8b4bc4e424d3519910d7756e622d2977fec60a8613f4c4062f4afc5d1f2da0f6b97b03ae7c1e720852ee47d804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.Core.dll

Filesize
1.1MB

MD5
5b745ee879e65f7a47c56265881f16e7

SHA1
e6a90771b8f1bf53beeb7c9e4268756ff07a088d

SHA256
c8944a83938c39fbea72700485db8a61ab82e1c51d8e16d5dd48de4e36a6f264

SHA512
3b4bef98a1f751c3a747de0eb050828bf8474efa68aa7a26d0369f1c3b42829eaab221cb612c005a54ed5b84f19180700e51aab39adb84fe7246d9e91e6899c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.BrowserSubprocess.exe

Filesize
6KB

MD5
bcd22b9511d5383e23d875e2cf3c339e

SHA1
0ef86afaef536cc4b046ea2866414bb193d60702

SHA256
95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792

SHA512
c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.Core.Runtime.dll

Filesize
1.7MB

MD5
21719cf581f5cc98b21c748498f1cbfe

SHA1
aaada7a02fadcbd25b836c924e936ce7d7ee0c2a

SHA256
6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6

SHA512
6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.Core.dll

Filesize
897KB

MD5
16f8a4945f5bdd5c1c6c73541e1ebec3

SHA1
4342762c43f54c4caafaae40f933599a9bb93cb5

SHA256
636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a

SHA512
04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.Wpf.dll

Filesize
114KB

MD5
36946182df277e84a313c3811adac855

SHA1
bcd21305861e22878271e37604b7b033ec347eb3

SHA256
8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720

SHA512
80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\CefSharp.dll

Filesize
272KB

MD5
715c534060757613f0286e1012e0c34a

SHA1
8bf44c4d87b24589c6f08846173015407170b75d

SHA256
f7ad2bbbeb43f166bbbf986bdb2b08c462603c240c605f1c6a7749c643dff3fe

SHA512
fcaec0c107a8703a8263ce5ccc64c2f5bfc01628756b2319fde21b0842652fbeee04c9f8f6d93f7200412d9bd9fad01494bc902501fb92e7d6b319f8d9db78d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Celery.exe

Filesize
17.3MB

MD5
433bb23192adb1d78a2fd99ca652eab4

SHA1
40087ada7a5020046c30d8ffb9fd70949450151e

SHA256
06a7351cbbb9e794e8ee5793114cb74cda3b55f23eb634ea3b994adf851ddd3a

SHA512
d74a2156ea003640774a1139aa4c1b5b76f0f97ebbeec1dd3cebbf902eb667d369f7ea8e1d3c6aff140da6f75e5c64cee23cd1e2cb988873db95723ea9cca93e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Celery.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
ff34978b62d5e0be84a895d9c30f99ae

SHA1
74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

SHA256
80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

SHA512
7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
62KB

MD5
00053ff3b5744853b9ebf90af4fdd816

SHA1
13c0a343f38b1bb21a3d90146ed92736a8166fe6

SHA256
c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e

SHA512
c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Microsoft.Extensions.DependencyInjection.dll

Filesize
94KB

MD5
3452007cab829c2ba196f72b261f7dec

SHA1
c5e7cfd490839f2b34252bd26020d7f8961b221b

SHA256
18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698

SHA512
a8b83a8582dfee144925a821d09c40f5730f6337b29446c3bce8b225659bdc57a48778081fa866c092d59b4108c1d992e33f9543ae2b4c7554b8ff27b5332cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\System.Windows.Interactivity.dll

Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\bin\Monaco\assets\theme.json

Filesize
390B

MD5
53140e18fb33e7e9a25e13f57a4190aa

SHA1
dd72190319ae2b7ddb12a137f50fad2579fcc897

SHA256
1cbd08945e5e8612b690e1eb663917cfb4f84f0083bf7d2c2a61f43e6c455e9b

SHA512
fb9b0456c7c9d468b14db242659d2cda36f7457f9035628d92538850a509e78116972e9890edc3b69d4379aaafb6da76ff2876b446b6953e14914cdfe7dc7b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\bin\lsp\main.exe

Filesize
36.1MB

MD5
43ad962c7acda3e30300e7d0f1add3fb

SHA1
362c217d315f288f375fec7289a2606ed6d4f432

SHA256
534e6212f155fba25a38fba248ce7970e69335492d57443d04037b617260dd9b

SHA512
3822b6b426c85a61c4d754de7c33fdfbca45c9e80f2ba52f4c6ac98ad726109e276851af3612ebb39a6cefa4de9589d412e2805a3bacf7845d2aa22189396e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\cache\LocalPrefs.json

Filesize
755B

MD5
24a347c999003a41a3e5e50c22917cfb

SHA1
f6b7ff4e1829e2556bc7925829fa442cb1f8ae60

SHA256
73cdef6c15acd8625a2ea099047de10c9c9fc45d93d8cabe6ce558da2acd87dc

SHA512
fe382d3ea00e313f0f48f26eb3ae63adf0dfd0fb2e48c08fefb3876b14f0bdfdd37d1521bef77949ca8408eea0bda6d8956771aad7474974f5ff5ff505997891

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\cache\LocalPrefs.json

Filesize
643B

MD5
d150a1d1716301b165e55ae2edf99eba

SHA1
7df7ebd786bfb0ca0180e13570ec66ba6682da94

SHA256
8bf8dd8ca8025cbbd2908c25e6c017785a40684c0844814e2a0f42ce5244d292

SHA512
42fb928f36c137747bf963561905f9f7756f4da59bdf3ad2c7f101f1f54cab5710478dd4f746331d4950956b892801396fe2792fa41b9cd17e1cc4efaa08f712

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\cache\LocalPrefs.json~RFe5a610d.TMP

Filesize
434B

MD5
519ff95cdb7d277ccb79b211eb43656d

SHA1
ef5bcd58b205b29d972120ca719a9524e65c9d58

SHA256
3bef6e55e5a685e1702afa0e6a1129429e278fd0864c38f3c4558d433bfdda80

SHA512
6ca498c123414e11dcd69a7b0a79eee18721507c5f90731b7b6212b05879c19f7a8e83e7476c623c0c62da75b61c02abc05ed5b5434ed3adc3abfd1859793b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\chrome_100_percent.pak

Filesize
682KB

MD5
d3e06f624bf92e9d8aecb16da9731c52

SHA1
565bdcbfcbfcd206561080c2000d93470417d142

SHA256
4ee67f0b0b9ad2898e0d70ddfad3541fbd37520686f9e827a845d1930a590362

SHA512
497126af59961054155fbb8c3789d6278a1f5426000342f25f54115429ff024e629783f50f0c5350500007854712b07f7d8174ecfe60d59c4fdd5f3d72dac262

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\chrome_200_percent.pak

Filesize
1.1MB

MD5
34572fb491298ed95ad592351fb1f172

SHA1
4590080451f11ff4796d0774de3ff638410abdba

SHA256
c4363d6ecfa5770b021ce72cc7d2ab9be56b0ce88075ec051ad1de99b736dbbd

SHA512
e0e7deccb26b7df78d6193750bfb9aad575b807424a0a5d124bd944e568c1bb1ae29f584246f753d619081a48d2897815145028ffedd9488e9a8f102cdc67e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\chrome_elf.dll

Filesize
1.3MB

MD5
5b3802f150c42ad6d24674ae78f9d3e8

SHA1
428139f0a862128e55e5231798f7c8e2df34a92a

SHA256
9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799

SHA512
07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\d3dcompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\dxcompiler.dll

Filesize
20.8MB

MD5
141f621285ed586f9423844a83e8a03f

SHA1
9c58feee992c3d42383bde55f0ff7688bc3bd579

SHA256
5592056f52768ba41aad10785d21c1b18baf850a7e6a9e35526f43a55e6ada6d

SHA512
951a55bbe86a7ebecfc946bf1c9a8c629f0e09510089a79a352cd6d89b7c42e0e23fd4f26232b0e73bd6d4ec158b86728cda2ab25745abcabfafadd964b55896

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\dxil.dll

Filesize
1.4MB

MD5
cb72bef6ce55aa7c9e3a09bd105dca33

SHA1
d48336e1c8215ccf71a758f2ff7e5913342ea229

SHA256
47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893

SHA512
c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\libegl.dll

Filesize
459KB

MD5
ce2c45983f63a6cf0cddce68778124e9

SHA1
6553dc5b4bc68dcb1e9628a718be9c5b481a6677

SHA256
9ca8840bbb5f587848e66d08d36cb5eb30c1c448ef49ce504961ff4ac810c605

SHA512
df81a3356168e78d9810f5e87ca86eb4f56e5f0cb6afdb13408b50778a2d8b18c70b02c6348cd7ba59609ab2956d28eed324706eb65d04bce1159a2d8f1e0e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\libglesv2.dll

Filesize
7.3MB

MD5
c9b090ed25f61aa311a6d03fd8839433

SHA1
f1567aa2fb1fcad3cde1e181a62f5e2bccadaf68

SHA256
c7a7a59cf3c26d6c8b2505996065d49f339764f5718e6f53a9ecec8686c489db

SHA512
21cd4618b6ad011afa78abe8fbc42ecafbb992322912c4a77e5f193a04aeb97a5655dedfc513e1a7667db55b92a322e3d9a6dfe7e845af25f37a6666a1798470

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\locales\en-US.pak

Filesize
455KB

MD5
a8d060aa17ed42b6b2c4a9fcbab8a7e1

SHA1
16e4e544eca024f8b5a70b4f3ca339a7a0a51ebf

SHA256
55e4ae861aa1cacb09db070a4be0e9dd9a24d2d45e4168824364307120a906b2

SHA512
8f3820e3c5aca560344a253d068936bdb797d07eb22711020d287a949c97d7a98879ff9ff5a4fb2f3fe804bf502300b6f4c92918d973bef351d587483bc43723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\resources.pak

Filesize
7.9MB

MD5
5955471c84eaad269c23f8a22b71f781

SHA1
d625fb0b12d132fec9f91cbc7db54887589f202e

SHA256
b8ae091d95e927a75a9b0a367a8ee9bc5fae0a10427eb77cb3c3460097cd4f5e

SHA512
537fa6f414c7759e70ad6e70350571221ba69afaf89427c7450acf117e58a97fc7beb2a1758cf05b2ef76a14ad50e762f01b1c65d1ccbc63e4d714af445988df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\v8_context_snapshot.bin

Filesize
672KB

MD5
12c20b1ea7dccafb8250e13e46bc9914

SHA1
6ed3625dffea1ad3e1aceae4c55caaf195fd7c18

SHA256
5591258720aed178de57b4e61eb59b2c4af2566caa1d18a7157cf8d0feca11d7

SHA512
e520e67eba1dcf236a0daf43ec57182821b1e9142592ef471c724caf74292ed85291bd3b84fef6107ee2c258f93ea4fff2df18485537d73ddfd973b863c76727

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\version

Filesize
5B

MD5
c7ba27130f956748671e845893fd6b80

SHA1
86f389089f8cb6f58aa87561bcf7bec9d700c40b

SHA256
f0b8c77d978d7b4aebeb1df5a2c0a6aa70393689819dd4060826ab6d36b5ea90

SHA512
f2170cb5d554ef10a286c0754d0ef8acac4a47317c98e315ad092261f39935db861719a29ad1e8235806753619c975c1748572a0c49a1ef784088cd31d8d98a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Celery\vk_swiftshader.dll

Filesize
4.9MB

MD5
3262e23f3fef8b021b93c801f5649c92

SHA1
de49b94cfc981a0af5a4e134854f69620e7ba566

SHA256
1c9098e8a6f21462864a91e74555f299ebc41d3bc79d6ee1b9c577c929957285

SHA512
54b0b26b95f6fc799b3e24863a65ef3896786811be3cc9fffa2a06e95e98daf32b16f0ede6b8a87acc319ea17650cdd089c56798236476b894054195738e1797

Download Submit
C:\Users\Admin\AppData\Roaming\Celery\settings.json

Filesize
95B

MD5
549e0849b62ac1edd0e200f6821cf237

SHA1
c38c5e610a29fe868404c0a6c1dd28dc46c32654

SHA256
45907882a0e460ceb2cc46205083aae3eae5b874c1863bc6ff332d683486925c

SHA512
318d6c6f86460742f2890734d39d1c5291c3e0d18f6ba0bf22e7c8f327c2cae24cb1b468ff89f422a76eea63e6aed18e07b60159c96c0243f9f48fcfc631c243

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\AlternateServices.bin

Filesize
8KB

MD5
7773724a4d1246f8cf8a1759831fe154

SHA1
599585426dc7aff71f7cb08aa56b1a24fef28b38

SHA256
e1fda04af2142480d3a963f43b0cd93a77a2e77d8587b08714e9b6a677b127fa

SHA512
f6b9617caad984424bd9442c6ed78667c19b3f3234a39f88e32e7803ae7aaa459ca5d9eaca54deb44d2bc5f2849d2b54239180b089ef2cdc109962f898180a12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
591ca6a2c03429bd809386079725e331

SHA1
9a9862aeba778948ce21bd16f3a719b82a5da182

SHA256
b82ae0fd986152c6d15ba263b566cb9ecca5d33c783aaa8e657f026dbddff12e

SHA512
c5d7bde74790c5f0fc73b16eda30597aef575008d84e3b6c8b75321cc10e481ca0f5d81b484bb8760ef84af18571155ca1eed53e3323e49df99c35e146657b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
56daeeeecca87c39a4a6bf6988805f2d

SHA1
2ebbf35da3f0aff20da95dbbe1bb6f95f20ac189

SHA256
ad38724762837b7d8ff0f634a3f154bed3676e2a158e61683371ea03130877d5

SHA512
eecead484f17e25b9d0e92ed1869c3f4e56eece8a77568a89742b46be1e6631b9a25414719da7bb18fbb58c5749aeb99545f4ed48f5ecedfd5cad647f61ec42c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
0777308ff0a8cfed36cb6720de2dee2c

SHA1
cf53cbfdc486660a52bb84f6ffae52478b02f9d0

SHA256
a29e74ded1463b72542b1bb0ac12f2bfa51eb4a258debc0f3b892c721bb205e5

SHA512
9ac4b17d831dbd56a585c84e761d2cdc883f5397dcd06cd3520430d59c3f52a18e8826c711be515d261fdd3a008e761137305e77f61a7fa0266eade430c5d1c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\53cd44a2-869d-42fa-87e4-bc4f41a7362c

Filesize
671B

MD5
97e7fcba3f6776de4d28d16f14370eaf

SHA1
6cec320afc5964ff54b14cb562d6a8814a5c4d5a

SHA256
87961a690b6c73d86446f2faf638ca1915d80e7d88a12a7b3bc5bcc57f7e0bca

SHA512
2d0adc17052935cb68d86ccf17d7cd18c5aa3c8f05caeb087ac1d76e9e2763c05e341416de4bb37ad26ea806c9ad68b070187be290153d6eea1528b16f32dc62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\8c1e4df0-ed96-4bb2-9e35-4f3b5421f5f0

Filesize
982B

MD5
07c430d02ff41f39dd90ca460e519225

SHA1
77b2d317d9927a8313cc5251d20e84d579302535

SHA256
067b8d6b421cc683add1ac3f98df3bdc44ca8b861891d620ff9eb7759d7511b9

SHA512
10f454e0016fa30c200e1675f228b3a78f334383f2d448762667aae484581099e64c80a1463d088af52545a56e930f05761d51015501c851dfff1ff50f45d749

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\d4d322ab-11ed-417a-8ca8-0fbaed5fb22c

Filesize
27KB

MD5
21c9620fd3d2ea118274b86c130ab4d5

SHA1
518ae209a4505e50384f191cee21e32f8769ef76

SHA256
90cebd3408cc89ac9bf1701fdcba96423afe22dc6c3671d9123f57f6eef23e41

SHA512
0370779be6e0ea049af98c1559a38737e1f5c73561fc013caa5deaffb1e8b5f3c0b0c1e1f10a15f60d5ff28d88667d3d927544b53f89756aa43622f7493ef868

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs-1.js

Filesize
11KB

MD5
c964bb2183e187c9dbf303a4f8207423

SHA1
58ceca4ebccb3de3098f6a9a6ed44da026224565

SHA256
9135fd8b1f4a953161932090da1c866dc97788b20fcdda8175bf3f72212dab6b

SHA512
31cdd0f768e119b37fb2f44bebede9a641e997965294806743c84baac1c32712374b476e4cfd69ce89a74f09de519e2fc4bfeea864c5b53ce4a5326af8c4a2b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs.js

Filesize
10KB

MD5
1d3d54dd34a8db138b3e44289f19a383

SHA1
b25bd8e7a7b35ab34b9e40c2f4ad30807e2fac9c

SHA256
4711ba26b9b5a0b029ee4bff371b11c940db408a823118c4b6ca7b69d0bf9c90

SHA512
1a22d592bd1918679763c74e3cea337522f0d270d7fabdf7b8e30412ea8b9b4e35011fa0fc0c4b5c553e890039f6ecdd2d15b2930377c5fa19fe78fbcf9eed53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs.js

Filesize
11KB

MD5
3c2b53114f26fed0cfa433e32cbc42aa

SHA1
2d3592fa994d74b08bb900997725163b05053e70

SHA256
42043f3b3e3a5733d0db23f16d811379a6bb356f2574630b2d8e2299f3adf0f6

SHA512
634fceb90cabdf225081bb58130d8153731c60112335b7651ee3d462ee1962e11f09dbf81336e5141fae15cca526bdf28eb9c81c2fb73c47521254edd04b36e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 986385.crdownload

Filesize
5.5MB

MD5
6670e5c270db13d474d6f93c38303245

SHA1
ec8566078f8b1aaa425f59502372be14a60c3ad1

SHA256
80cb35cc5a9750f74e8b005e4a52c384527c2d2510d38069f32b023c27f62033

SHA512
5a1354134ac1765ecc3d85dd94baddd4ffd570e9935b68f6e43a1179f8a0f6d0e664989bfb42b409a6b0b2c6a53e6d33bc9dda723632e0a658fef5275578ba26

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
fb9716257759df4e02538a70399c00a7

SHA1
36ef7d363028bb6e703c2fd2df4012003ef5b5d0

SHA256
071904fc8d0ac9e86b17493bf11c4fc6ba69e130e252faf423b747436b7b8d84

SHA512
fa04fb1c4d1474a5cf7df6a5486f0dc62056a7d2fe2be834bd3562a471573150dc13825bc3c0ebabf73a358054914c91ea3d4a0992d9622525b26a1a1a149953

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4404_1619665095\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
memory/1832-2-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/1832-6-0x0000000008E50000-0x0000000008E5E000-memory.dmp

Filesize
56KB

Download
memory/1832-204-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/1832-3-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/1832-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

Filesize
4KB

Download
memory/1832-4-0x00000000065D0000-0x00000000065D8000-memory.dmp

Filesize
32KB

Download
memory/1832-5-0x00000000091A0000-0x00000000091D8000-memory.dmp

Filesize
224KB

Download
memory/1832-1-0x0000000000E60000-0x0000000000F32000-memory.dmp

Filesize
840KB

Download
memory/1832-13-0x0000000001B00000-0x0000000001B0A000-memory.dmp

Filesize
40KB

Download
memory/1832-11-0x000000000A170000-0x000000000A2F8000-memory.dmp

Filesize
1.5MB

Download
memory/1832-7-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/1832-8-0x00000000747EE000-0x00000000747EF000-memory.dmp

Filesize
4KB

Download
memory/1832-12-0x0000000005440000-0x0000000005452000-memory.dmp

Filesize
72KB

Download
memory/1832-10-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/1832-9-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/3148-247-0x0000022279150000-0x000002227926E000-memory.dmp

Filesize
1.1MB

Download
memory/3148-243-0x0000022276C20000-0x0000022276C26000-memory.dmp

Filesize
24KB

Download
memory/3148-443-0x0000022218000000-0x0000022219000000-memory.dmp

Filesize
16.0MB

Download
memory/3432-1424-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1429-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1431-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1435-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1434-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1432-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1433-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1430-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1423-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/3432-1425-0x000001F0A9490000-0x000001F0A9491000-memory.dmp

Filesize
4KB

Download
memory/4404-410-0x0000022D58C30000-0x0000022D58C52000-memory.dmp

Filesize
136KB

Download
memory/4404-264-0x0000022D58920000-0x0000022D5892A000-memory.dmp

Filesize
40KB

Download
memory/4404-213-0x0000022D2F340000-0x0000022D2F35C000-memory.dmp

Filesize
112KB

Download
memory/4404-211-0x0000022D2F320000-0x0000022D2F334000-memory.dmp

Filesize
80KB

Download
memory/4404-207-0x0000022D2F2D0000-0x0000022D2F2F4000-memory.dmp

Filesize
144KB

Download
memory/4404-209-0x0000022D49590000-0x0000022D49676000-memory.dmp

Filesize
920KB

Download
memory/4404-205-0x0000022D2DD40000-0x0000022D2EE8E000-memory.dmp

Filesize
17.3MB

Download
memory/4404-221-0x0000022D497C0000-0x0000022D49981000-memory.dmp

Filesize
1.8MB

Download
memory/4404-201-0x00007FFEC42D3000-0x00007FFEC42D5000-memory.dmp

Filesize
8KB

Download
memory/4404-217-0x0000022D2F300000-0x0000022D2F30A000-memory.dmp

Filesize
40KB

Download
memory/4404-229-0x0000022D49530000-0x0000022D4957A000-memory.dmp

Filesize
296KB

Download
memory/4404-215-0x0000022D2F2B0000-0x0000022D2F2BA000-memory.dmp

Filesize
40KB

Download
memory/4404-263-0x0000022D58940000-0x0000022D58952000-memory.dmp

Filesize
72KB

Download
memory/4404-398-0x0000022D59160000-0x0000022D59212000-memory.dmp

Filesize
712KB

Download
memory/4404-425-0x0000022D58E60000-0x0000022D58E68000-memory.dmp

Filesize
32KB

Download
memory/4404-427-0x0000022D5B7C0000-0x0000022D5B7D0000-memory.dmp

Filesize
64KB

Download
memory/4404-429-0x0000022D5B7D0000-0x0000022D5B7DE000-memory.dmp

Filesize
56KB

Download
memory/4404-428-0x0000022D5B810000-0x0000022D5B848000-memory.dmp

Filesize
224KB

Download
memory/4404-440-0x00007FFEC42D3000-0x00007FFEC42D5000-memory.dmp

Filesize
8KB

Download
memory/4404-439-0x0000022D49990000-0x0000022D4A990000-memory.dmp

Filesize
16.0MB

Download
memory/4404-448-0x0000022D5D970000-0x0000022D5D978000-memory.dmp

Filesize
32KB

Download
memory/5056-444-0x000002389BC80000-0x000002389CC80000-memory.dmp

Filesize
16.0MB

Download
memory/6000-1006-0x0000020A6E860000-0x0000020A6F860000-memory.dmp

Filesize
16.0MB

Download