cf4afbbe58f7a6d7f1888b0a0e2da4f57da6d3ea329dc577c230b806f74aba26

Analysis

max time kernel
300s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/09/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootStrapper.exe
Size

149KB
MD5

dd742c42283806d63458be56a64ea254
SHA1

bb252ef14c278321b1a6f474a686e224269dd457
SHA256

cf4afbbe58f7a6d7f1888b0a0e2da4f57da6d3ea329dc577c230b806f74aba26
SHA512

7b3a2ca8518f5cd27de93733bf20958053fac4bcd00039f8f73979fcf8fc2e6393dcc7f10bed0971cac15d090375b7292ad9fcc425e29687b04f8b033b197121
SSDEEP

3072:+czkitvo4BpYN/6mBPry8TXROLdW5m4mURp9OOGF0kmGwY:+A4NCmBPry/N2NOOInw

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 18 IoCs

pid	Process
2208	FluxTeam.exe
4800	RobloxPlayerInstaller.exe
2536	MicrosoftEdgeWebview2Setup.exe
5484	MicrosoftEdgeUpdate.exe
5772	MicrosoftEdgeUpdate.exe
4664	MicrosoftEdgeUpdate.exe
724	MicrosoftEdgeUpdateComRegisterShell64.exe
5416	MicrosoftEdgeUpdateComRegisterShell64.exe
2968	MicrosoftEdgeUpdateComRegisterShell64.exe
916	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
1840	MicrosoftEdgeUpdate.exe
128	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdge_X64_128.0.2739.54.exe
5884	setup.exe
2352	setup.exe
2344	MicrosoftEdgeUpdate.exe
2304	RobloxPlayerBeta.exe

Loads dropped DLL 21 IoCs

pid	Process
2208	FluxTeam.exe
2208	FluxTeam.exe
2208	FluxTeam.exe
2208	FluxTeam.exe
5484	MicrosoftEdgeUpdate.exe
5772	MicrosoftEdgeUpdate.exe
4664	MicrosoftEdgeUpdate.exe
724	MicrosoftEdgeUpdateComRegisterShell64.exe
4664	MicrosoftEdgeUpdate.exe
5416	MicrosoftEdgeUpdateComRegisterShell64.exe
4664	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdateComRegisterShell64.exe
4664	MicrosoftEdgeUpdate.exe
916	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
1840	MicrosoftEdgeUpdate.exe
1840	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
128	MicrosoftEdgeUpdate.exe
2344	MicrosoftEdgeUpdate.exe
2304	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
22	pastebin.com
87	raw.githubusercontent.com
93	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
129	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2304	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\particles\fire_sparks_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\fonts\BuilderSans-Medium.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_loop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\Close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Settings\Help\AButtonDark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\models\AvatarCompatibilityPreviewer\headPreview.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\DeveloperFramework\UIOff_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\graphic\Auth\reversevignette.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\collapsibleArrowDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AvatarCompatibilityPreviewer\test.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\MaterialGenerator\Materials\Pavement.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\identity_proxy\dev.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\advancedMoveResize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\TextureViewer\refresh_dark_theme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\animation_editor_blue.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Menu\rectBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\Locales\kk.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\Button_Dopesheet_Darkmode.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_lock.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\DeveloperStorybook\Banner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ViewSelector\left_hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-back-android.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\9SliceEditor\Dragger2Right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\StudioSharedUI\spawn_withoutbg_24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-alert.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\button_control_reverseplay.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\MenuBar\icon__backpack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\PlayStationController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\XboxController\DPadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\Controls\DefaultController\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-48x48-dotted.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.54\Locales\km.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\loading\loadingvignette.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\VoiceChat\MicLight\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\fonts\Guru-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\AnimationEditor\img_timetag_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\PivotEditor\SelectedPivot.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\ui\dropdown_arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaApp\category\ic-popular.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\msedge_wer.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\content\textures\TerrainEditor\volcano.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\ExtraContent\textures\ui\LuaChat\icons\ic-notification.png	RobloxPlayerInstaller.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\81708b68-25e7-422e-93a1-44d0aae604f1.tmp	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxTeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
916	MicrosoftEdgeUpdate.exe
128	MicrosoftEdgeUpdate.exe
2344	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133698386225319997"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ad321ed0d27f48b2\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FluxTeamB.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 497138.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
3908	msedge.exe
3908	msedge.exe
3196	msedge.exe
3196	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
5480	msedge.exe
5480	msedge.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
1568	msedge.exe
5612	msedge.exe
5612	msedge.exe
6132	msedge.exe
6132	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
4800	RobloxPlayerInstaller.exe
4800	RobloxPlayerInstaller.exe
5484	MicrosoftEdgeUpdate.exe
5484	MicrosoftEdgeUpdate.exe
5484	MicrosoftEdgeUpdate.exe
5484	MicrosoftEdgeUpdate.exe
5484	MicrosoftEdgeUpdate.exe
5484	MicrosoftEdgeUpdate.exe
2304	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4244	BootStrapper.exe
4896	identity_helper.exe
4800	RobloxPlayerInstaller.exe
2536	MicrosoftEdgeWebview2Setup.exe
5484	MicrosoftEdgeUpdate.exe
5772	MicrosoftEdgeUpdate.exe
4664	MicrosoftEdgeUpdate.exe
916	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
2304	RobloxPlayerBeta.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2304	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3192	1576	chrome.exe	85
PID 1576 wrote to memory of 3192	1576	chrome.exe	85
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 4604	1576	chrome.exe	86
PID 1576 wrote to memory of 1980	1576	chrome.exe	87
PID 1576 wrote to memory of 1980	1576	chrome.exe	87
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88
PID 1576 wrote to memory of 3892	1576	chrome.exe	88

C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe
"C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"
1⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8608ecc40,0x7ff8608ecc4c,0x7ff8608ecc58
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2172 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4372,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4564,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5112,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4268,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4520,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5304,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3228,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5448,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3260,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5056,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5208,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4940,i,8931172008528685800,14082006619494397416,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2952

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4808

C:\Users\Admin\Downloads\FluxTeamB\FluxTeamB\BootStrapper.exe
"C:\Users\Admin\Downloads\FluxTeamB\FluxTeamB\BootStrapper.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4244
- C:\FluxTeam\FluxTeam\FluxTeam.exe
  "C:\FluxTeam\FluxTeam\FluxTeam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-hub.net/336183/fluxteamexecuter
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff85c2b3cb8,0x7ff85c2b3cc8,0x7ff85c2b3cd8
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6704 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6860 /prefetch:8
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6876 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7172 /prefetch:8
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7396 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5140
  - - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
      "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4800
    - - C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        
        MicrosoftEdgeWebview2Setup.exe /silent /install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5772
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:724
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5416
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2968
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3RjgzQzM5Qi1BNTAxLTQyOEEtQTk1Ni1FNzRBRUVBRkEyMjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3NzIxMzAyNzIiIGluc3RhbGxfdGltZV9tcz0iNjI2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{05905CD1-9733-4C68-BDC4-3C10F49B29A6}" /silent
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:400
    - - C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\RobloxPlayerBeta.exe
        
        "C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of UnmapMainImage
        
        PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,816950882641172063,14285812221681367274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
      4⤵
      PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-hub.net/336183/fluxteamexecuter
    3⤵
    PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x104,0x12c,0x7ff85c2b3cb8,0x7ff85c2b3cc8,0x7ff85c2b3cd8
      4⤵
      PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5528

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1840
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRjYxRUQ2OS0wNjJFLTQ4MjMtQTcxRC02NkUxODFERUVCQjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3NzU5MTYwODAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:128
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\MicrosoftEdge_X64_128.0.2739.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:5884
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.114 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9E844643-E3D5-4782-AFD0-EBDA0F4119D8}\EDGEMITMP_55A64.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.54 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7acdf06d8,0x7ff7acdf06e4,0x7ff7acdf06f0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2352
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU5MDVDRDEtOTczMy00QzY4LUJEQzQtM0MxMEY0OUIyOUE2fSIgdXNlcmlkPSJ7QkQ1ODQwODQtMjY2MS00RjBBLUE5NjQtODIxN0Y5MTA1QTQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNjA3N0EwRC04NUIxLTQyRkItQjg5Ny1DQTQ5Q0JEQzlBNkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjguMC4yNzM5LjU0IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NzkwMDkwNTM1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjc5MDA5MDUzNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMDU0NTMxOTgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzZlMjFkZjA5LWQ5MDktNDU3NS04ZTI0LWQ5NDU5MDllNThkZj9QMT0xNzI1OTcwMDI4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRhRHhuaWVUVHJQY29NUXgxeTNDT1BzUGdWJTJmQlNMUDJONVpuNVNsMFpZVVU5ZHhmOUNBYTRoS3FTSGNqaktSdW1TSWxWWXBnOXNBNFUycEtxS0FjV1ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3OTI4NjQiIHRvdGFsPSIxNzM3OTI4NjQiIGRvd25sb2FkX3RpbWVfbXM9IjI1MzQwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzEwNTU2NzcwNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMTk1MTgwOTciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1NjIxNzQzOTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5NDkiIGRvd25sb2FkX3RpbWVfbXM9IjMxNTQ4IiBkb3dubG9hZGVkPSIxNzM3OTI4NjQiIHRvdGFsPSIxNzM3OTI4NjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MjY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FluxTeam\FluxTeam\FluxTeam.exe

Filesize
443KB

MD5
b6e04da5eede61b18938203e5c46a5d8

SHA1
a7d3bad06862f78635a78e6298f0a0507234bcbe

SHA256
36fd27ba0feb91f99c1fc416d5314f5b52f2173615037064da6106c53233a4b6

SHA512
9f432c830c82ac1a4e3ae2a7d975060be21209bafad82243a86e52cda3ce5f296abdf93bd727f263bae7f9f64cae87ce3c354670726f5e0a6256cf77069d2c16

Download Submit
C:\FluxTeam\FluxTeam\FluxTeam.exe.config

Filesize
184B

MD5
13ff21470b63470978e08e4933eb8e56

SHA1
3fa7077272c55e85141236d90d302975e3d14b2e

SHA256
16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a

SHA512
56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8

Download Submit
C:\FluxTeam\FluxTeam\Guna.UI2.dll

Filesize
3.8MB

MD5
846a7e5993282e220b26b82e7a39a40a

SHA1
e37fe15d2fb33753c042e16d1d008d412e7d99e7

SHA256
5613682635617cd43720807448f69b10090932e8571a358b92361d2a2c7a4597

SHA512
fcf608391d7f8406bb538aca0e9dafb804cceda6c590dcd98d684645bc3bfc0c1d43455a74854988b4b30e56a68ef8be886e92e993f1504b49f0e4baa1c0cc0b

Download Submit
C:\FluxTeam\FluxTeam\Siticone.UI.dll

Filesize
1.3MB

MD5
750c58af2e56b6addecffcf152520ab8

SHA1
14995e7f1d12498606d9d209d78d55fe6fd87802

SHA256
27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26

SHA512
2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5

Download Submit
C:\FluxTeam\FluxTeam\workspace\.tests\appendfile.txt

Filesize
7B

MD5
260ca9dd8a4577fc00b7bd5810298076

SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6

SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.54\Installer\setup.exe

Filesize
6.6MB

MD5
179438f9d59850f9810b884efaae32f6

SHA1
63d91c28509aca46120cebaf93903320943c9b16

SHA256
b03811daebe54e9832cd00a574b3ffc52119f7275d8f56c322c199215c5a0b7f

SHA512
822ef4662274de1d8f8e0eefa98878889a7747223d769584ddb898a5a8d4b75602a01719e9729490ef5dc0a7fef5f789d0d76afa1a3002fac60aebd59ec29f20

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUD747.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24bcceca8b115ff5d0060b2d9def17c6

SHA1
a06ba5c1f6d64c9a95627c4b2291806d2b5cd300

SHA256
c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde

SHA512
d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-ad321ed0d27f48b2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
a7b323ff78530599ef1d1f2035290af2

SHA1
a4c7a628906f0ca45d7196f6c62f42b2defd7ac0

SHA256
03b843e98a23f4d9025aab8c5ebeeaaba6cd7511ed3b2dd0fe6f2770fdbdb596

SHA512
e3fa82c5c9cebaa9cf84be1753ec7e07fd9c3f76ccc2fb6279f272d6bf9543572399f97a1de0a821b7befe762bb92787c400543a119d1e32421c1c3c930494d7

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31e774db-5f0a-43cd-a03b-42580144c165.tmp

Filesize
10KB

MD5
ea1c768e7be5102cb05b783b050eb091

SHA1
fff49654e0b084b597cc9c95aaac679bf01819fa

SHA256
de9a7844a3a7901cba02c12104cb53725aa94b8c23b064262cf6f7b964e51419

SHA512
909f45dad8e8d355435ac246bf1057570a5cf13db266d1aaebd88168a66dc6e5325febf78f6c2bc2eeee29db07d358c0130151564f69738c4782560941a81f8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
55efe65492d212ff5919f009589120cb

SHA1
9cf890e4e2d5631b614e11fae1c25692d9942bf7

SHA256
ed15f9f58f860efcb6ae104c21cf9d31e533c2f1b5491458c7f09a80c6e9bec3

SHA512
2311878bb26835492d2efbaa8f09a99a2629734898787f88dc613a040cbb2cc7ff1419a6e89497f0d1a3cff27b7a0e5c4435dc0b428f0d6e7b3aa509661c4dd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
51KB

MD5
baa5818fd1e51dba8b6e55992e5358be

SHA1
30ccb7eab50b4623eac05ae86c1b38b6957fe8fc

SHA256
f21051e384e080852e23555a0b3de7ca37f5786ccb7b30ab197c3ea5f0a1bb93

SHA512
02ab1e65a9d93396f07c62de811b79f0ee1d7826808050f0d451388420f77e6f33de56eefb4df5779bcaf952aabfd192ef69d6bcd50e6f6e8b6e4a3a1562577e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\965ffad020381297_0

Filesize
3KB

MD5
edfcb2ab656ba6a7bd36d40a1a10c43b

SHA1
a363862baec978f01ecf9f8b42dff75a0883040d

SHA256
9d60abd2e08f1ddbaf44789dd67176790c1b1dfdee4edcecd7c9d601a16cef13

SHA512
2053e6172fe3880c6d824904dc43c1e7f8f9295c18c0ad31c779c8608a072e4af9efbc0d8322b4f09e02cd2f4a3c841d19d0243a3950adc8496f34ee0f0701c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
b9a7bf2ec8e4ad59d4b3c1215ff75bde

SHA1
931d1e883337bfbea5839f5a37362fb0b6b4ce2e

SHA256
a81b87911c9ec1b8ade0013dbe3429a988dc85f86a4fc07a84c5441784978810

SHA512
439f12a8557edfd1d48d68d2e1023a493237662dd6596fd28f0d15a703ad213a01e08208fa2cca53b789ab40fcfea28fda2b5820ed871067f4b6fe3cf425ee54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\32747b4d-97ec-4d8f-b6bb-62fb7a0f2ebf.tmp

Filesize
9KB

MD5
1e3ba500e2a61075f0b9b953e5acac34

SHA1
8967597129991e9c1ecfea69c683c35ec08b063a

SHA256
2b54917e50d6fd4bee2c2c05885c8b14f4558ba35ae9ec097e68f8d9217e64d6

SHA512
9f0206d9cf7c719aa1b5891593d913a06497b8bd8c746b7a152f3490df6ab1c45fdc4afaf3c0217f1970c1e892d948babd2fa654cf5a811d08c7ad92c220757e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
72022557a659e17b68226ffc6b5d030d

SHA1
08039f53b82b64221a3bd58d8267940716633926

SHA256
c9d07e6805b7d964fe8f6590dd41ad7d3ce91f614e1b3a8ff401d01564ece1c9

SHA512
1b2e67ee709258b3d9310d91b6f05c3ba2b3bc6068a7c984a33848aa0f683391fae91ab3ca17f0aa701715e73ac9401162e73964f22b53bd006428f4ff2712f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
422e2caa6236f14fec4fb90abfa9bcf6

SHA1
6604c9fa5cd122cfad413a3d86b2012252a978d3

SHA256
bd70728f26486eb5801c0fb17b918de04c477121ad994e3f3e1519a764e910ac

SHA512
6cf843fb26ae2e56216be5dea76bdfec13a98fa50ddc81a8864cb7e91df367c9d49d94ca57dd8922b806105f766f4a5aa0360e824da7b9b8d594e58308863bc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3936189c6b75a0251778d0b80239a22a

SHA1
9c269f9df1c23703219c8087f65db64ecff4041c

SHA256
7bcd1568e3f0be455ce7861fbd1c65f80d86cb78ea319083762e27a04373c5df

SHA512
5c6175c2f84b41fdfcd6d5b5c113129c7563832d01b658eca29df1cd94439c4dabf6e24f546e8a497cde60ecda45a5df6b92ea3d284c930aa994f2d3a3b49b03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
1a97f375ccadf0a25963a9a27f6a8e80

SHA1
c6b682da7e9e247d381a2cc94f9537525ff7beb5

SHA256
b88c04e95c853ed40d9b747a859fdb4e891870fc9f021a34d108d7dac81a98d4

SHA512
ce103b68d2f570498f63ddd48d21e47c91494e74ae839a528dbce40b3a653540b51668c227aeef6b5c27d54fdbf232e9048215b54a278b446fd4588100169dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b7b6a994689de468cdd26e5ef22a4ce4

SHA1
c2e2ba195713afb7198a523e0ecf94e840d00046

SHA256
bd7deb1bf5a337e777e40ac413665d6248554ffdb62f885cea332bc7e91e720b

SHA512
fa5190494b077b769ef4f52f31f708558dc1311d2c3783139575e4f097402cea2692c58e70c5aafef01bc94882490dd8eda8412dcc5588fe5aceea701c3b036a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cf3b083ed33646ea0a1d844100ea36cb

SHA1
be203cfeff7626c25deaa9369acce9c37834065d

SHA256
af3623f76a82dacdfc5d703c4d27c412e9f7dd421b41e7e86e1b5d309897db11

SHA512
f523e6ab3a283afbc443233a019fa3fe26cdf4760d4740b6747d509e0e3461a6b749d3feee4940d5fa4e185cfbb381cbccae7db4dfa1b2f669540bae3788ba06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4f7574bb89f01486beeea2d0ea46e52e

SHA1
7ddc85cd1fd7f647fa30fd581ef2d3443df50f38

SHA256
5727835488872b65c851922fd2cd5e89354cd08fe426be6076c7103b887b589c

SHA512
e823e297d2b6b81c8c2645d2c3900d5b756c26a2f12a0ea2d35ba9504be662febdd1754c4429c84f402c4505546ff034b7a8678752b8bbb8302ee5c7f6b41d54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fd61eef8fdec0e7e01bc2cd62fcb31ec

SHA1
bb1af80e89c7b53b9017b86a591224c1f72b2ae6

SHA256
bb220359456b946acc4699dbf114de286c301014938942d0f1bfdf0cdf4aaf64

SHA512
08397d616e26e10295c4146392b85d80fe112c1d7d3521a25de66ee795172ad32c3e755ab7b77f76fe0b080d59c1d329df473318aa6f36460efb61e5706840b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
abb33370d5291dc1abf2cd3caa12f406

SHA1
94c97a0d33f45d0f7d909d919e4cac8af9498ab6

SHA256
5b31b2ed04c7d11875df189c8a9ffd52cc4405ca3d136cd13eebf2d1a23d3077

SHA512
64098d2d6cc00ae992ff6bfae51c4e8e0c8baf306b3c68168d811a17ad4719b04599d9102e55dd83f509367d9c44be3c61dff0bdd38ce1e17316f0354e7612d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ab1f2e9d8b79ffc6ea37a5294b7896bb

SHA1
74c189bb5e08a74e190837adee6439251ee84938

SHA256
bc295b5b5b87d9e00c47649b2fb13aaf5634c5f12593ea0d955733a254c2b8e9

SHA512
68d7979239168ec766d9c6d49ac395d3571629c5ee3f410f53e7d8f78b023680ca54c18e533ddffc31650b9abd04aed23e6088116daf3a82de64163719f8a110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
79e5b0ef8e931a4b7f26795b1ba3c3f0

SHA1
297d30f3f738652939f5a531acc0e1ff85c545de

SHA256
52a8232c69110b7829e1b82020a73fbbeb94019aadc8505b96040f4e5ca32159

SHA512
c6fc518adbd8f673fa5582ebc79eeada1888bcee567cdcb4c112512dbda55eb5a84ca1499de9167ceb3825197303e5726a17b6138bdbecccccf1a165a6a48d9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dd1ae3fecdf598ab0de441ff25a91b47

SHA1
812a69a1dde6af803c7773aab8d7e57330171c1c

SHA256
57f02429c3af461aaf5620bbc1b4c03e1a3d07240eb99e7756ee84c9f8185ff4

SHA512
2f5c0c0cfcff9bb476c4abf2a4cf3e7527faf1351069ad77410cfbbe7b1fef5938fdd180b26563719e8a163ff769b8dcdfe1839c5ad7c6a03008a673b7779565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0a28b9e3850cc990d89dd83ad11aea75

SHA1
df497f0af9ee166474a6587af14cf4e670db5379

SHA256
812b7f002f86108d61ae529cacd45a4070ed4487c361a183b33f53cdedfa5b9c

SHA512
9dca5b74bcda449ddae494136ae41efb57bb99c16e367945f6504fd078cc969fa172da710182eba0173ea03483e456172857d644a1621d9d82b54f863ebc6bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bda7ff06598fcaa0c2483ae8c5e200a5

SHA1
a6e7fb6911f52889153413f94bb4a88639295a04

SHA256
61067182b649e8e6f2db1a069f48417a8e022b203082b5d90437872b60d608b4

SHA512
845c2dbbec7db81828a892c623c8ba667a455942ec05e313653b0f523d699dbdaaa3b683ac617cb3109a61d035e925f770cad5b2e0cf414684fdde6f1b30c785

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9c4dcac0cebe682f50290a15002d8365

SHA1
48e582dc23c91ec0e847a6e74512a6ada2962773

SHA256
ff2844a860a09d5bf62cd835c995e1f19db0c0625339889466d0c7d1ced4e750

SHA512
bf3ad6c35e55b9f44eac4ec126c99b47e1aad7ede3ebeac0557e62832eca6b2a8f5c20e8876e717a48622e5169221a71642f7304406fe28ae23588342d056b49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
046e30430d1ec43105621e9918aa270c

SHA1
e20c6d112fc789c74acf45356c096e11394e62fe

SHA256
a49a5d798b94679658a2a9e3cf84a2c65f7429867ab50aa49c75bb6979b9513f

SHA512
1bc3fec46dfc7b4d10cbc77373fd329505e4c8b91e40ed2f6dbc4c4e9b7ee9f9ae8ec9a968926de0fd7f6f36d0105181e61b5b3505440fcecd325ca38b4b82a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7dbe6c73e04315c405c3b44b71f76197

SHA1
4792136473a5bd4875f52188764a4552ec01b610

SHA256
b4abaf10582fe2a1952a1834892e0010d53bf04dedbbbaee50bf5ae04fa2f367

SHA512
981187fa6e64ea377ba4e5e71ba1f2e6fed3eb579482787159af0bf80d7a736f78f54b2d783826a71352f96df247c8d13e2eae416f0af22f6a4829e3215bda96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
34319c7daf5a0aa7edf53d14ca5cf7d6

SHA1
41c90af2107692bd5bf001cbfeca23a34103a419

SHA256
4dbb34651634d27aa0d8de129e1fb92639b858bc5d7bcca18cda75caa376d940

SHA512
bdd4d30a44448731afe6438f730b73b34606b1fe9cf3ce0f471daab32262a3f4d43d203fb11bb727fc7132c83062f0d0c5dd922cb8aea7992f429439b761c6ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0de2dae8915ab7af813961f845ca80b9

SHA1
7fdb9a774aaf0b3bd3daf36ffcd287178ca9fd6d

SHA256
d972a41518aff813f9bcf2155068797126eff7f613b68ec1e58eacd5caf3e7f5

SHA512
f12494fcf062302763be4845f837ebc3c47b9c97438f85d64ddb19c1aa106cd39824ff4c8a8a9b3332af8cc6e654b439151a34035ec97d1d10a8eb6f70377d5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3e6ea74b54fcd7c7c6edab9fef7e4b88

SHA1
ac22034f60cfea1f0cda67173dc7e8d222d73b77

SHA256
2cf33af01a9d85127109a6b4670257780856a819339dcf02fb253de5291bf4bc

SHA512
87eec13c62fe17745f428722d093289c14be90d3a38ff6f7b02c1da4e6a746fe8039bde87e304749886306090e09ee85329362150d9898f830c91f4d22a25ce5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c68c7e84076dfeed8c739b606b492952

SHA1
a1ac5b9412eb1a97b52f60dbdc1ccc75099b79fe

SHA256
749dc9a17d0fe39f266a9cd6014aaab0bcfe709457567c230192dabc798c2749

SHA512
cc57fe8c73d29d66782ad87b807d8238792eb37cff43fe551336994555639d7e7a6d36710093c257a6ba0ffb46bc300b1894ff723b200a201520b982bb320c11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6ef1f04e11ced53328673f7bb1db35a1

SHA1
d062d780d17c3fe89eccd0e44b8d10e70e2515ef

SHA256
122e446b29964faa702043aa7f5dcdd1775d83a67c78e36c8c555eb2f045bb17

SHA512
e5ff9a248532e5751901315724efb881b70a22ca5a92e6d3571e918ac50edc876be59a67fa3ad4784e1400ba7dc4af6e1d1d612980970411296a8ea312d366b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b00ef1a4555d6a7030cae208303a33a8

SHA1
5b197f6a40c1a6bfa7ab2ff70a02c323bb945eea

SHA256
36ec23ffae3a9295eccfd5574007c017b8b53bbec80cd4fe6e243807ef278224

SHA512
03fe78c1ed641465fc673e5eec4b2d3293104e4d9f25fabd3958a69dd3b2ff0b633eec612ae61b01033a1e047d559f1eebbb96f4a61e7108c5ecad0fd4e74ccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a0e766fcd61eda26acc87a237d3294a0

SHA1
53b767cbf0e5c06ffbc910c5780adbb6525f3499

SHA256
4ce8c7005204be6aad3822a5e869ab9408a8fc0561127e37ea29bb926e22d091

SHA512
cdbf9bc8a560c860b92481303704eea8cb5abe1e2d6e848c1110524589a71ae14822ee324572dcc24fdc85777c8316ca8877b5e6b17c6723fe97e82e00dbb7de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
206KB

MD5
d2e8e697460b3b99f97fdc6931272bb5

SHA1
58afb08251d6885dda1a6279f343d76af4ec3459

SHA256
f3671cba2281a1bc0f8f5fd7f3430c5b4bedb1da9360b8668b7aafe3a955b160

SHA512
42b13833430301687a2978d2f256bb1b293f4ed342b974e7e12ede9feb24c73cd3766f1358a58e1796d5867590079df6be27427663107bb63b57422d440b31e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
206KB

MD5
f9b6fb6e6b4c057df62f3a8fdaebe1b3

SHA1
fd8eafd36803e8e40475bec6c2748e1241d3e9a4

SHA256
63d81450b74475f184151bbd479770fe0e699ede2bd228230e69ec60d7c46241

SHA512
882dc0bf7b560b92bc212302c203275f3e2e15d74ba8d376ea8868c07d47a6fd90bc125bf205a4df9d5e5d3b87b1f4fe7effa463437a17b30c43f746811290c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
235KB

MD5
3159011007cfdaf4b608ecc016a59e35

SHA1
4e8f43c210c48564923c267b0182523d453de86c

SHA256
d8718812a9d37f035e444ea7507297a783f911183dd3bb4744c5dad1b334ee50

SHA512
ad69ba910b382cf0156df7b9ee4148ac6e8a5db5e511e1f26a05c63db48bdf87578ba0fb2a3adf68d2c9b538297cfac23bab1ae56a08c6c740cb6f5da4423ca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
206KB

MD5
707e4e21fac3d7cb632d99fb45b0c9e7

SHA1
7012d60d2498004c18875ef129bcd21a2bf2a4b4

SHA256
6c20651ca80c03106e7f19a25f9838b2126c4e8efc358e23230782cba077cff5

SHA512
d0dcfab62f2cf28a53040026d44c2e6b7b2f0c85d3655fb1988e1bc13b22d6f94ee0ee1da0874ce3e6ce289f005576326fe99fe4d2314f3ed54d0be613ed0bf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
206KB

MD5
0d9bc33bbdced34205ef1488b4f0d452

SHA1
c5ee287ef6c6cba1a8d667c5cae34cad8b1a4407

SHA256
24807ab75904397be4f9ebf8658a805afe005b3ee16ebb72d4d7981e5fdf8d73

SHA512
b860e14a1f61987b7ca45508a14473d9f40ad09b36cc5bfd698bd8ada62dd532a43b8b1f1803ac4f0ed691baf8939082028a9f914cc664e40ab1b24de848d80e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
bfffe990732a00abb58de91ce7c0f8ae

SHA1
8b7bc68cc88dea534e5032843277b49734c64813

SHA256
a66fbe6c9db6d42a1bce23762f92d4a54f2429fe189dc769a21fd36fe087d567

SHA512
5d5e6d6353ea9cd4189a96f855fd9b543d7b79c07ea4f6c5dc466d5a02f55c07fdd29b7802a77baa58fb4e9b14a10fb5d0511c2c68e360febfaf916c88443c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
50KB

MD5
cd2f3074326840d55a3c3ea1e99e83fe

SHA1
3a2e1d1a93506526ae3ed2b44d584af7771ff8d0

SHA256
9ec9f50ac6a5dfdf7ace0a047ab4e86a7f8ff297030f93f9b8b4e27c57fdaa51

SHA512
0685f7e50451e87f8d7d47f3373d653f7d6163ffa8ccd143a85b179d2c5c51cf494e8b5f7e561436c35bfb8ffb9304f0c49962a8bf7065830f0cc95281f4ae6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
050d96fd978cdf15bfb99fe5b858f749

SHA1
a3e5c4537dd46e93ac08368a57ccc48ff8d3c692

SHA256
70ede7cab9dee3aee40f5bd309f0f321fef66666bc5527ea5995b8665ac29ac4

SHA512
456295c8a20a6528699e5f47afc42837953b3f8b84c235c5e5daa8e30fc9ca6eb209f610d2635d1492b85cda051c7abfc0723422761423f936e84fb9e839c62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6b531e5534ee2b1d2d848c981084bc20

SHA1
9c78c95a118dc191162fe51658fd0e5ec5a927bd

SHA256
0fd3cf55a59568941cd1f8a083b26ceb464541987bf8ceb4e040c22610cf54f0

SHA512
dac52ddfb5f6b548535395bf261bf5f6ffc05a52a99db452c294d21b5bc41f0c5f596afd9a465b4ff3aa840babd5675ad735d86134062eda657eea7870b803b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0fed0aef7f1e44596d421e573907aa6f

SHA1
f7d40db0dc154db7398e8e35fa0aafce137b1ad2

SHA256
bb12b8f1777b0de753ecca52ab0b0bc785a8977aa232532f44fb01ec5e977e5a

SHA512
e6d572f8ccd1f236e4b14f208e977ee4f07ed62f85e9a1367ea063f2d5e2330cccb3410fd8b5f55e74cb088e6db3e51fc1d6b2199cd7e7a6021f9e279137e069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
e9d49294ce690745be37d0422a06cf80

SHA1
b351edab43358ab314da3715436548afd575b239

SHA256
fbc19efa18d4477cd6b66ace66f80964d79507ad2141d034e7de9cd3c6b88b1e

SHA512
7bb59ea1b45f2ea4c17c127331d61040a6ec98d5e542dbfa1082a6caa1474f0ca88c4c0923c63264e316f92e621cc59d27cd2fd6f621862d98ae75ed76680c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
9dc313b8975ab5fad7a311395cd2a4c2

SHA1
2c73fd2b65d1c9b1b46e046e2ae6a0f636f3a003

SHA256
582488b41636128e538285ce2161af2f224277cf3a90e8794fea117fe75bf82c

SHA512
02127fa9a63710ef044da6992ef965a688c4233003d7aa6f7bd8b899e6228b7eb47d1439b93c5b35cd9f957acc865b1adbfe742c230117373907d4290bef6242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
91e35468c7e3258c10b564f77f3d8a55

SHA1
79f37dbe3a029a1dd980a73812397afcf807998c

SHA256
a5bf400f813eecd0a7ee0eae4af83ff0bd6a93a0573db117afc35b11e8a49b36

SHA512
8c3656ee3464ae55b48372c7d13db62491f24a015134dee762676d75da3851ced11d9ae8feefb51732f0b6b6be3f49e1e2594b1893f292055dcb289cc41f7595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9efe5bb42642122c665d4f6437a845bc

SHA1
bbae1554ad55e161adedaecc5015501a8f056da0

SHA256
bf41a0b9f247e3c3304b2a3bc5f4e503dc922b658f04e4431d8bd79568d287d0

SHA512
4dcceb7ed5ec0dd84c7f0a899e89f0b98fa5bd6cd8f704d80908a696f0ba43f853a5701dacac7539f1f96f6d91cf370ecbd180899a2a37fb75faf5157291b15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
309c11bbfdfb143887ee0dc8167281a5

SHA1
5a3d8b31fce44009eb84fe3b1ef0fa32c9fec883

SHA256
a9de00aa5e85ab6a5ac3cb4559d82099dcabf5d9f9853181f70978ee2029f97f

SHA512
2c6689151e81454150bb08dfebc856923a0123df51bd5eb4ea963598f5c46ac11a05886ac5ff2667b8f621589fe5be575aacc9959044c22ac9d0dfdb50d300da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61a6a17da5f288fbc4fd0c99e955f741

SHA1
44a3cd76f1e3907d98e89e7e78198738d4ccfef2

SHA256
bb32c646f20dde1876d06b9bfe8dfa6cb78c6a47fc1e8eff89c541de87b6df38

SHA512
3bd5b4dbb2a82306e39c144ecbce78e40d0438bb0e42f5e8cc4ec2f775493b085f73cf3472a6a3d97a0f237ba433869d3a660e47cc215b21535981729598e19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a103e9d0c897cd3b1647f4a8015a324

SHA1
d45cac72cda1c3350ee8b6d350916c38995470d5

SHA256
b28399e305c23744fe5ed460543ad833147d38d7a65170412d7d09d9d036bb49

SHA512
95d80f6bbf2fa3129be7905880c7904409efd4add60909b4e728f8ad463a4055d1dac5665d7cceb90770d325c6ce7b518115e93d3ea07b457ca4bc4e93cbd00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92b3010d46f44264b057e4785b7ccb0d

SHA1
80e55dd9aa42a2a8f202c02e0a8e25e0a71be589

SHA256
92264a449fc5ef28072fd924c3be6be301c566e5f572c3378da6489e074e9349

SHA512
906749da146439b1252f52f40b3260b7faf38d312a804961631c2dc53fed7eea3c5a4fca6e32575378ed414da12582eaf1cd874e23f772182e27a76110b1c790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f770e25442cc20fecd8ae944c0039d6

SHA1
133c38009d7e2deb36a967e14e582f038d28f9a3

SHA256
a425cd63355f85daceb49c08f9c8637ccb58599ec0fcca88e114422d44956539

SHA512
5ad7ae941f2e9a3f453f4c231d7578ac697d0a5cff0743e5cf59a9bdac0e36e5b83b699069d771d51b3879cb013c76b009173256909b7df790d6a12419263c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7030eec555d0349f19fcdfa5c1ff7ec6

SHA1
79712eb190c82d60ea023b177f343b2f30c6e838

SHA256
b27bab5afb91bf1e75d5d716429eb7e96a893ae345f2438837fcd4edb69a5b4c

SHA512
2016b42330c7d4afe2df5e3b33cc7242403cfb9542a7ef1057f358798d1092e04aa7431983d68a2e275b7d6f66679f24bdacce09804a9f6c4fcdee297d494672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9aab5d908981dd0b277ec816b9af2a0f

SHA1
25de6bf4e93373dcd8b9ed7032f850599bba184c

SHA256
90d41944cdd5d37b650c2c4f0ced1396137fdca763d4268efd318cf96faabde2

SHA512
fa77fb5d63b532ac8fb9d64467ddc809271804c71354b486ed2c8b793d0b958bac7957f5292b25bb897265609682e2b85db45b16d646d0bff3a6b0722fe163b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f3dd379c8c8ce73d495db38f6ac3e666

SHA1
91f89e70ceecc4093b4669a952b59f03d39a5407

SHA256
a0dfa2e0f915e6a5b25f51eb1c0d242cd54ea34d31fe785ee6f7a512aab1a19c

SHA512
d7854a32af8c5cfa87b5d7c3bf1c0b1ab952b2ee946b4d4422b347b962d08de5c4720bca7b1f9c9dfa0c120762cd6bdf3932f5a65131fa4671fedb3c26333054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b1a8fb39776411595d213ed3ea7b8d3f

SHA1
ad11a930683d9c4f4ae738b41cf14cd69eaf8ce6

SHA256
a927d0d4184f9c043232cf96e4d6335d1f3d1a902338551043ecb5a9c68f967d

SHA512
7d61ae7d7af1eb716b7259cfc30071ee3bd1db65e074dda3a3d7240229f1164f21f613f66c253d3b7020778d71279b5666addaef01198baa1d7d8927faafa983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6198e9c73fcf4ff01b3b85b7be149db9

SHA1
58f3560770a2633bb62b6d74d21ada373c7b7bfb

SHA256
7f8ed61564047d9a1695d29a0c1d8f570fb72e1b1247ae0c3957d86c81467f00

SHA512
c9d635af67460802a192451e9dafad8e713ca4c205ff2f03e22bb3f6f4a967eac22215c3b4641a30ec4edcfc7c34a6fdded729243b61a8bc278a24bb0cf2eb19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c262ff7f4a340139d0a018c15e128e53

SHA1
6c8ef401126f5dc8332486156737e1166912f8f5

SHA256
84f3198a91e1e8f9b0b6af6502d41dd970a4ce5c1c1193023ccf49d543b85e64

SHA512
3738ad84069bad8d1f7217e7a89876c6ca4d4b2841b25ac648a50934a6154148e035faeb5e4dd53430a81214b9d455e042af7fb72e360e7edd172a1462959f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
be0a650664feb44cdfdfddda2b5a2c3d

SHA1
9bed41db2eb00438db37a240acb4b2a3b93782ef

SHA256
4a6a81414bdf7d2178711a36f05872123d3decea4c71cc232e792ae9fe821bf9

SHA512
e935ff34253f5b83457c055edf3f6235177bb6bb1e806be4fa5053ee41b4655091af07bdd7a6b56c0c59dc2cbd9a0b659cfd01b756245109d594382dc38185af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
336465c6e0aa196abaa002d79c2df8f9

SHA1
4b9e796edbfe412f7d163fe560aadd141e34ed8e

SHA256
9ef0912d8bb0bbb663eb86b1e3c07b3bf086aacb9a08e258ce4878fc572500b4

SHA512
03a1e905f047183504fbbc7a2ba1edf2207e05c7a6bbb2619077725cad03774c7f8ee6248bd23a08ef405fbad4816114584086a39a06af68e0c41a472dc5a259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3f29af8b1f0c07270c464e4a3ce91f7e

SHA1
f3cfd258fd5cc6bd735848e7ca11557ef31bf5e5

SHA256
c4136680f2ba3bd49d7a7c9acb4fbbc3cecd330cba9049dbee30af8c3e5770f7

SHA512
06fb9c4cff74d5f7882b67f30dc48cf6152cb5b37a6861c86b66eab9466410f04510f8680cd6441329caf6fac2f95b9052e548e01863a6b61784791c0de0fb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bbafe993d3226957d269a205c316a3c4

SHA1
6eb84cd284a647b960028dcdd30aeaffcd69dccf

SHA256
53dc7cbf96f140527436178183b4f9a3e9cf2f653e27e9b170c62ff4f2c97f9c

SHA512
7f4c4425a7f85c7190c7f66d4106c968c5708a135a9b5ce7df33b28f57d716c45dc4f5174b0d72a9f8c5a02026c15058f921f9527fd7fe6d915ca13af33a2b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
aa5468f70be5589d43eb74689247161b

SHA1
381acd2006615e35a0255a9e91e19d4f653372a3

SHA256
164196668c8df8df01bd106914852a4e755b84237f3a019426e5bf677e16dc08

SHA512
6cfc16fcada52f5a56cc3fcf56a3b1d37261c6bdce13af26514fdb04fd733e83cf6ea0b73e82abbc6551c22bfae0aebfce80777bb5a0c4109e137b84ef1297fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
eda5ea20759d282a1ab5009dc8413a55

SHA1
504780e678255a78e62be249dc67ac05b20728ae

SHA256
5ec91f89bc9b3c5050ce632ab066a7dcb620b329f46e05492bb07d52b695337f

SHA512
1e4e28888a0e14c45fa834aaf8d260c6f22480a48adc9c4b2e96a2ae6076d3af478606379dc482ee2e18a6cae5b7b10e97066d0db9e3aca0b76b558abf8a9202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
737f917c6b35746431ac30b2bdec6ba4

SHA1
c0011b438e97fcfa7eebeec61782c7ad5b4bc885

SHA256
6d422aefcf703db1416c9a70b077d8baa60d13c708d62cf6458033814cf59ae2

SHA512
b09631197725fa6372811fc2892ba6ae68865e29407de21ab0d5050feba516783bf911e918058caa1e5f6ac3148fbcc02268a3f6463416245d9ed98787458f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
99af647e4e302aba28e6d75c571f418f

SHA1
0ab1fe510950229e0f16c9569e8d07cb8ef696dd

SHA256
ab669b77a3166ef0fb3faf8115740fb4d05d2ab51bc422f566acb7fe46b59dd4

SHA512
bacc825634f5dfcfbf687f551e33427ad28584f21a734aed66978c96596584c3f90f927d90d622a69ef48d38fb799895b4b7ae73082dd81796ae66ec7026f5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
53eb2a0a5d16e68efbf4bee0fa22d3ea

SHA1
efcb01e32a2c2cb9078c53165a5d4e0197ba69e0

SHA256
2b6d4a7bacbb789af07044640814a3c47254a89e54f3dc4fdd5fdef39205c87a

SHA512
549d6a1d5109989b56a6d79e06068599fb27c8f04303ae1160184ff134b29d15b19a4d2fc12b2d29ac5339a5e9168c76d868ddc830f50907dbe23548e43c7eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fc15f090eb8be9d5f072536d108e378b

SHA1
a76ebf5fd055d51ff6b29bec8e4132d94e003802

SHA256
b81c7cace487da54c79349b250775bdfbde1262c5414a3a92330bd6683486d72

SHA512
c5eb2ffdcc855ea117bd430b41b650757455f06a5c556ebe30cb919bd8e63c936bfb3940b1e613e150667f46da4768559419bf3c38d58d267cf5886717564bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b5a99c92ef68e0b9a9052b9dee1c7120

SHA1
562b82257af6c9a4558168ae9ef60e9e06e22dae

SHA256
8730411d092c39ddccfba206bee4f93e73817fc6c509bf342e68b387d966d3fa

SHA512
18a24f29708c3e5f8e32b6ad73dd11db8f3a576946ebe0edcac4e20591034f885efd24be20b238c628fa4d6af4d5a04f1030d859c0fb7b975c27defbd4e5cb21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
36dc8c4b932093d3086b4871fc14ad67

SHA1
2acb260b1d506b215205c811e85802d78a7bee9f

SHA256
b3063deb360b1823f94224ae4bbabd2cc82d8506e47cd2645b498ae2139e378c

SHA512
22a40fef0b74eb7bffeb556aba8e9f79dee7d946431629ed98e70e3906b9a15092381de82ff3e3cd4765342e07faf3c5806fa380b4b72941ef555bb57027b217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592754.TMP

Filesize
1KB

MD5
dfe9b26879e188cbf0f79341e75c3315

SHA1
ae15ad0a19696c564d7bcbda803db7fbb59a308c

SHA256
53590c78817ae33234e408fa492d0f47979af4f87645c7fca32bb83aa59acf6b

SHA512
bbd80ab9fbea9d20e93d5b65a7490e876bb83fc17bb5cf12185fc3646786a3f6ed37785b61e32a24c46c77a6f19edf7836e10effb4a1d5ee2064e63fad93ff6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ef8b749701bf348a6c9d8fbe2eec423

SHA1
e5ca597355e872d2f1aeaa530a291fa0a32b05ab

SHA256
9b6225c6d7a363b2ccb0778d54dda1f3e127de6506344825088794e6bab194f8

SHA512
fdbeaed8cfcd1f841b8bded49ef9dbd365f9539acd71e428ceee734d1003053639d29c332b0f83f3012e6d38070570a9767cf7c60a8ef34996c0a572969e279b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ebd27bc97ab361757a844d507ff4bfeb

SHA1
c1a6ab98c2efab542dffbfd909954398c8beedb4

SHA256
c79dceeb39315c470fea2e22cd11445910f34fdb4613d59adf957dabf101e4a1

SHA512
3bed304bd8e57eb24d47efb48af6612056cbeec5fd38a5987da43384937ffbc5c8b68106b7f1895325a5867c150e6444391754648888cb5d2f1bc7c282b3fa9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fbbef83ac003f20c0c8c5b74b6af91c

SHA1
ecfd3ad8d8106e7d2263064f50d5a32e6d4f93d7

SHA256
5828699535608ddf5d0d86ff0dc1bdc0e53c45ddbfef47c00e2438e8f179b546

SHA512
c9107be4abd737a5290190762d1d231bbf5b2e6d484b549826733c8fe3a6a0d90b927eb908b38e78b3b30cc20da15fd28fdbf3275ee4d0189a856364c957116e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e8571a97b279d707c61a794c09ab23d4

SHA1
4dc1a1b9ae0444d60f3ed58c7f46110e61d3f9f9

SHA256
1cc02390f32b292e4a8a47cd59ef1bf5c5e1d2d3d06d238609c345dd6e3bc638

SHA512
2079457c409fb6e1bd9d339ff8c680dc97f240c8154df21ac876dc5b45e2389099bd3469852151542a5b44c36a672701da86e05ed0efdcfe5d348c67aed32a46

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b0b307510d9180d47181fb70a3320cda

Filesize
5.9MB

MD5
b0b307510d9180d47181fb70a3320cda

SHA1
4c3093324dc3123a90ae94ae60ca12026f7f4885

SHA256
dc6a0d278e85bc6d686b9bae15b668231257e744455b3a08c700a1eac4c9418c

SHA512
78750914832e1e54234c2bc80ed9dbff554ef1c95738a1f6f6d8cff86fa79a1aa03df23cde6a0c3db68cfb8b139a16b3b3b0ebe9acdd0844430abff9031d3ce3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\FluxTeamB.zip.crdownload

Filesize
71KB

MD5
5b983519f5d1ad44ed85f8eb6c010bc1

SHA1
e86f542b1b5d172bb78819232119d80b23d24f54

SHA256
64cb9ff36c82878a84768c6eb138d2e9adf8ed9df0eb58cfe44ada8bc56f6060

SHA512
49dc71aa6b3fc01a825f46d3c39b8de1cb22cf06c361a56aa2ad5e82c280d5687e0ed0d2e308cb1130143ca617f56c223af2b450ae87dd312d5226e583042916

Download Submit
C:\Users\Admin\Downloads\FluxTeamB.zip:Zone.Identifier

Filesize
153B

MD5
f7cfee2970d106ba39ceb2ea1f874a67

SHA1
eadd5d8785601c9957d31cf6119ba2afe0d48044

SHA256
c68495dbfab5c08c7e248f390e5bfaa24d414a259f20ab89e8d53c4fe981f4f5

SHA512
a56a548751be26cb83dfab97b653c8f6d48d62649b0a7f2dd247fe1612e233146df527c6c526493d5ff84bd5c77fedf9c19f0cb1e6957c28710d7a41e5dacddb

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 497138.crdownload

Filesize
5.5MB

MD5
3122273f77f8646e30e99312483a4721

SHA1
dfc6e6fe4402ade089bb8475f3d8deda2ffc37e6

SHA256
0d62e2125931315906d78ccb427320235abf64bd50ba70a596d39715b6aa6ee0

SHA512
b0710efc7679e0e1ffafc903ab87bbc95150282fecbf241330e6d071574dbf50397756df209d42de3eed63085bd69479b227ace5f2bc10b3b774f37a596ba1b6

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
bf39068166582472f173281b149df160

SHA1
eb0e92169d472ffade9c477b48d873b01c1ee7c1

SHA256
08f0be8230b517bca1d8deeb938c764c6bfb448f2c497f9ab5bf69043e01318b

SHA512
85016bb25069cb76abdccf51ab083c4778a990dd5335e444817f1ec0b40d33ac2a396bf967bfca83564e892897c28bf9f62b5e8712665c5867b3dff117df3d37

Download Submit
memory/2208-571-0x0000000005A40000-0x0000000005A54000-memory.dmp

Filesize
80KB

Download
memory/2208-560-0x0000000005AD0000-0x0000000006076000-memory.dmp

Filesize
5.6MB

Download
memory/2208-559-0x0000000000A90000-0x0000000000B04000-memory.dmp

Filesize
464KB

Download
memory/2208-561-0x0000000005460000-0x00000000054F2000-memory.dmp

Filesize
584KB

Download
memory/2208-562-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/2208-566-0x0000000006460000-0x0000000006836000-memory.dmp

Filesize
3.8MB

Download
memory/2208-570-0x00000000061D0000-0x000000000631E000-memory.dmp

Filesize
1.3MB

Download
memory/2304-2550-0x00007FF86E0C0000-0x00007FF86E0CC000-memory.dmp

Filesize
48KB

Download
memory/2304-2559-0x00007FF86DA30000-0x00007FF86DA40000-memory.dmp

Filesize
64KB

Download
memory/2304-2552-0x00007FF86D6F0000-0x00007FF86D700000-memory.dmp

Filesize
64KB

Download
memory/2304-2553-0x00007FF86D860000-0x00007FF86D870000-memory.dmp

Filesize
64KB

Download
memory/2304-2554-0x00007FF86D860000-0x00007FF86D870000-memory.dmp

Filesize
64KB

Download
memory/2304-2535-0x00007FF86FF30000-0x00007FF86FF60000-memory.dmp

Filesize
192KB

Download
memory/2304-2540-0x00007FF86FFC0000-0x00007FF86FFC9000-memory.dmp

Filesize
36KB

Download
memory/2304-2539-0x00007FF86FF30000-0x00007FF86FF60000-memory.dmp

Filesize
192KB

Download
memory/2304-2547-0x00007FF86DFD0000-0x00007FF86DFF0000-memory.dmp

Filesize
128KB

Download
memory/2304-2555-0x00007FF86DA10000-0x00007FF86DA20000-memory.dmp

Filesize
64KB

Download
memory/2304-2549-0x00007FF86DFD0000-0x00007FF86DFF0000-memory.dmp

Filesize
128KB

Download
memory/2304-2548-0x00007FF86DFD0000-0x00007FF86DFF0000-memory.dmp

Filesize
128KB

Download
memory/2304-2546-0x00007FF86DFD0000-0x00007FF86DFF0000-memory.dmp

Filesize
128KB

Download
memory/2304-2545-0x00007FF86DFD0000-0x00007FF86DFF0000-memory.dmp

Filesize
128KB

Download
memory/2304-2544-0x00007FF86DFB0000-0x00007FF86DFC0000-memory.dmp

Filesize
64KB

Download
memory/2304-2543-0x00007FF86DFB0000-0x00007FF86DFC0000-memory.dmp

Filesize
64KB

Download
memory/2304-2542-0x00007FF86DF20000-0x00007FF86DF30000-memory.dmp

Filesize
64KB

Download
memory/2304-2541-0x00007FF86DF20000-0x00007FF86DF30000-memory.dmp

Filesize
64KB

Download
memory/2304-2536-0x00007FF86FF30000-0x00007FF86FF60000-memory.dmp

Filesize
192KB

Download
memory/2304-2537-0x00007FF86FF30000-0x00007FF86FF60000-memory.dmp

Filesize
192KB

Download
memory/2304-2534-0x00007FF86FEE0000-0x00007FF86FEF0000-memory.dmp

Filesize
64KB

Download
memory/2304-2533-0x00007FF86FEE0000-0x00007FF86FEF0000-memory.dmp

Filesize
64KB

Download
memory/2304-2532-0x00007FF86FDC0000-0x00007FF86FDD0000-memory.dmp

Filesize
64KB

Download
memory/2304-2538-0x00007FF86FF30000-0x00007FF86FF60000-memory.dmp

Filesize
192KB

Download
memory/2304-2531-0x00007FF86FDC0000-0x00007FF86FDD0000-memory.dmp

Filesize
64KB

Download
memory/2304-2551-0x00007FF86D6F0000-0x00007FF86D700000-memory.dmp

Filesize
64KB

Download
memory/2304-2560-0x00007FF86DA30000-0x00007FF86DA40000-memory.dmp

Filesize
64KB

Download
memory/2304-2556-0x00007FF86DA10000-0x00007FF86DA20000-memory.dmp

Filesize
64KB

Download
memory/2304-2558-0x00007FF86DA30000-0x00007FF86DA40000-memory.dmp

Filesize
64KB

Download
memory/2304-2557-0x00007FF86DA10000-0x00007FF86DA20000-memory.dmp

Filesize
64KB

Download
memory/2304-2577-0x00007FF86FD30000-0x00007FF86FD39000-memory.dmp

Filesize
36KB

Download
memory/2304-2579-0x00007FF86D580000-0x00007FF86D590000-memory.dmp

Filesize
64KB

Download
memory/2304-2578-0x00007FF86D580000-0x00007FF86D590000-memory.dmp

Filesize
64KB

Download
memory/2304-2576-0x00007FF86FD30000-0x00007FF86FD39000-memory.dmp

Filesize
36KB

Download
memory/2304-2575-0x00007FF86FD30000-0x00007FF86FD39000-memory.dmp

Filesize
36KB

Download
memory/2304-2574-0x00007FF86FD30000-0x00007FF86FD39000-memory.dmp

Filesize
36KB

Download
memory/2304-2573-0x00007FF86FD30000-0x00007FF86FD39000-memory.dmp

Filesize
36KB

Download
memory/2304-2572-0x00007FF86FD10000-0x00007FF86FD20000-memory.dmp

Filesize
64KB

Download
memory/2304-2571-0x00007FF86FD10000-0x00007FF86FD20000-memory.dmp

Filesize
64KB

Download
memory/2304-2570-0x00007FF86FD10000-0x00007FF86FD20000-memory.dmp

Filesize
64KB

Download
memory/2304-2569-0x00007FF86ED20000-0x00007FF86ED2D000-memory.dmp

Filesize
52KB

Download
memory/2304-2568-0x00007FF86ED20000-0x00007FF86ED2D000-memory.dmp

Filesize
52KB

Download
memory/2304-2567-0x00007FF86ED20000-0x00007FF86ED2D000-memory.dmp

Filesize
52KB

Download
memory/2304-2566-0x00007FF86ED20000-0x00007FF86ED2D000-memory.dmp

Filesize
52KB

Download
memory/2304-2565-0x00007FF86ED20000-0x00007FF86ED2D000-memory.dmp

Filesize
52KB

Download
memory/2304-2564-0x00007FF86ECE0000-0x00007FF86ECF0000-memory.dmp

Filesize
64KB

Download
memory/2304-2563-0x00007FF86ECE0000-0x00007FF86ECF0000-memory.dmp

Filesize
64KB

Download
memory/2304-2562-0x00007FF86EC70000-0x00007FF86EC80000-memory.dmp

Filesize
64KB

Download
memory/2304-2561-0x00007FF86EC70000-0x00007FF86EC80000-memory.dmp

Filesize
64KB

Download
memory/4244-367-0x00007FF84BDBB000-0x00007FF84BDBC000-memory.dmp

Filesize
4KB

Download
memory/4244-368-0x00007FF84BDBB000-0x00007FF84BDBC000-memory.dmp

Filesize
4KB

Download
memory/5484-2213-0x000000006E7C0000-0x000000006E9D0000-memory.dmp

Filesize
2.1MB

Download
memory/5484-2526-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download
memory/5484-2419-0x000000006E7C0000-0x000000006E9D0000-memory.dmp

Filesize
2.1MB

Download
memory/5484-2212-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download