3e5e23c0adf484b96a726f9ecdbd4a3089ad7f8979329616b73e521825e183ae

max time kernel
1976s
max time network
1950s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-09-24 2.11.17 PM.png
Size

45KB
MD5

578c76503d19e73f7a935cdfb1a4108e
SHA1

74644b49ebeb844cfa821fe70251f8e56ac6e112
SHA256

3e5e23c0adf484b96a726f9ecdbd4a3089ad7f8979329616b73e521825e183ae
SHA512

52b1cb29234be0e46a90cc26f8ac9ad6ff45887f80fbaf20da53bce7c9530111778317aaa393e6e94fe97f3f15372a0de869f709e768f278bd74ba989599ca0d
SSDEEP

768:54PXdrAREaTeqsZ+93ArVC7UpbJss0JAKEKFXsojUIFI5A29+FKn2g5Fh2O:54Pa1swmfNIOKEKSY29tnxhz

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 33 IoCs

pid	Process
2448	RobloxPlayerInstaller.exe
2524	MicrosoftEdgeWebview2Setup.exe
1528	MicrosoftEdgeUpdate.exe
940	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
1504	MicrosoftEdgeUpdateComRegisterShell64.exe
2332	MicrosoftEdgeUpdateComRegisterShell64.exe
2888	MicrosoftEdgeUpdateComRegisterShell64.exe
2756	MicrosoftEdgeUpdate.exe
1328	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
2288	MicrosoftEdgeUpdate.exe
1444	MicrosoftEdge_X64_109.0.1518.140.exe
2868	setup.exe
1412	MicrosoftEdgeUpdate.exe
1720	RobloxPlayerBeta.exe
1144	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe
2128	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
1876	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe
1096	MicrosoftEdgeUpdate.exe
2016	MicrosoftEdgeUpdate.exe
1208	MicrosoftEdgeUpdateComRegisterShell64.exe
2920	MicrosoftEdgeUpdateComRegisterShell64.exe
1484	MicrosoftEdgeUpdateComRegisterShell64.exe
1944	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdate.exe
3012	MicrosoftEdgeUpdate.exe
2196	MicrosoftEdgeUpdate.exe
2396	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
2448	RobloxPlayerInstaller.exe
2448	RobloxPlayerInstaller.exe
2448	RobloxPlayerInstaller.exe
2524	MicrosoftEdgeWebview2Setup.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
940	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
1504	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
2332	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
2888	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
2756	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1328	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
1328	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
2288	MicrosoftEdgeUpdate.exe
1068	MicrosoftEdgeUpdate.exe
1444	MicrosoftEdge_X64_109.0.1518.140.exe
2868	setup.exe
1068	MicrosoftEdgeUpdate.exe
1412	MicrosoftEdgeUpdate.exe
2448	RobloxPlayerInstaller.exe
2448	RobloxPlayerInstaller.exe
2448	RobloxPlayerInstaller.exe
1720	RobloxPlayerBeta.exe
1144	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1184	Process not Found
1184	Process not Found
1184	Process not Found
1184	Process not Found
1340	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
2128	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe
1604	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
1876	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe
1604	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 24 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2868_1106044921\109.0.1518.140\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\LuaApp\9-slice\gr-loading-indicator.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\MaterialGenerator\More_Menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\DevConsole\Close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\StudioSharedUI\RoundedCenterBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\AnimationEditor\img_key_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\MaterialManager\Texture_None.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\fonts\families\SourceSansPro.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\models\LayeredClothingEditor\mannequin.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\R15Migrator\Icon_Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\StudioToolbox\ScrollBarTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Chat\ChatDownFlip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\VoiceChat\New\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\fonts\NotoSansThaiUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\InspectMenu\gr-item-selector.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Controls\PlayStationController\PS4\ButtonOptions.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\identity_proxy\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ControlsEmulator\Quest3_Light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Menu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\TerrainTools\mtrl_grass.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Controls\XboxController\Thumbstick1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\TagEditor\rightarrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ManageCollaborators\arrowRight_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\StudioSharedUI\pending.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\TextureViewer\arrowright_black_16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ka.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\avatar\compositing\CompositLeftLegBase.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Controls\DesignSystem\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\PlayerList\BlockedIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_zoom.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\edge_feedback\camera_mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\CompositorDebugger\eye.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\PluginManagement\unchecked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\StartPage\Engine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\TerrainTools\icon_regions_fill.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\AnimationEditor\img_timetag_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\PathEditor\Control_Point.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\LegacyRbxGui\ComboBoxArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\WindControl\ArrowUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\AnimationEditor\image_keyframe_cubic_selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2868_1106044921\109.0.1518.140\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\textures\ui\Capture\ShutterPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\content\fonts\SourceSansPro-Light.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2868_1106044921\109.0.1518.140\Trust Protection Lists\Sigma\Advertising	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2196	MicrosoftEdgeUpdate.exe
2396	MicrosoftEdgeUpdate.exe
2756	MicrosoftEdgeUpdate.exe
2288	MicrosoftEdgeUpdate.exe
1412	MicrosoftEdgeUpdate.exe
2128	MicrosoftEdgeUpdate.exe
1944	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadNetworkName = "Network 3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadNetworkName = "Network 3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDecisionTime = d027231d1b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadDecisionTime = 10d7e4de1b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDecisionTime = c04a6f311b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDecisionTime = 40e919131b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDecisionTime = 5049dc3a1b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDetectedUrl	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-44-db-f6-fe-76\WpadDetectedUrl	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadDecisionTime = 40e919131b11db01	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A2692CA-C1E5-490E-AC66-E27068979F7A}\WpadDecisionTime = 1096901a1b11db01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D001EC2F-F1D5-4ABE-A1E6-D9BBFB2CAF76}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{D001EC2F-F1D5-4ABE-A1E6-D9BBFB2CAF76}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{D001EC2F-F1D5-4ABE-A1E6-D9BBFB2CAF76}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2448	RobloxPlayerInstaller.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1144	MicrosoftEdgeUpdate.exe
1748	chrome.exe
1748	chrome.exe
1004	chrome.exe
1004	chrome.exe
1340	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
1616	chrome.exe
1616	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe
2748	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdate.exe
3012	MicrosoftEdgeUpdate.exe
3012	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2716	2412	chrome.exe	31
PID 2412 wrote to memory of 2716	2412	chrome.exe	31
PID 2412 wrote to memory of 2716	2412	chrome.exe	31
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2744	2412	chrome.exe	33
PID 2412 wrote to memory of 2684	2412	chrome.exe	34
PID 2412 wrote to memory of 2684	2412	chrome.exe	34
PID 2412 wrote to memory of 2684	2412	chrome.exe	34
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35
PID 2412 wrote to memory of 2644	2412	chrome.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-09-24 2.11.17 PM.png"
1⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2176 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2192 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3284 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1280 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3504 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3764 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2552 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1688 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2768 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4020 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1852 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4256 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4392 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4404 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4412 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4516 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2216
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- - C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1528
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2408
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1504
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2332
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUExNzJCOTItMjlBOC00QTA3LTk2RkQtNzM4NjE3RUQ5OTMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGNDk1Q0U2QS00QUUxLTRCMkMtOEFCRC1BRDY3MTk3RkRFRjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDE0NDc2MTAwMCIgaW5zdGFsbF90aW1lX21zPSI2MzQiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{5A172B92-29A8-4A07-96FD-738617ED9933}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1328
- - C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4428 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1736 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4024 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2788 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=2552 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=2588 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4524 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2448 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=1500 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=3296 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2592 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1176,i,903353646687432383,8251391642744243179,131072 /prefetch:8
  2⤵
  PID:324

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1068
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUExNzJCOTItMjlBOC00QTA3LTk2RkQtNzM4NjE3RUQ5OTMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMzRDQzQ1Qi01M0FGLTRCRUUtOTFCNy0zRjc4QzhFNDcxRjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQxNDczMTEwMDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{48ECF091-441D-4808-99B5-E61F0AD56180}\MicrosoftEdge_X64_109.0.1518.140.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{48ECF091-441D-4808-99B5-E61F0AD56180}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1444
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{48ECF091-441D-4808-99B5-E61F0AD56180}\EDGEMITMP_6D8F1.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{48ECF091-441D-4808-99B5-E61F0AD56180}\EDGEMITMP_6D8F1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{48ECF091-441D-4808-99B5-E61F0AD56180}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2868
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUExNzJCOTItMjlBOC00QTA3LTk2RkQtNzM4NjE3RUQ5OTMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRTgzRTExMC0yNjA2LTQ3QjktODI2Ny03OTFGNDBGRDY5RTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuMTUxOC4xNDAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ0NTQwMzEwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NDU0MTAxMDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDYyMDU4MTAwMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMGM0MDg0ZjMtMWJlZC00MjQ2LWI4ZWQtMjA2Y2NiZTYwZTNjP1AxPTE3MjgwNzI5ODQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9WFF4ZTNqTGJZWEpXNGM4MExFSGdOQ2JCMTBVZzd6Sld1Smd0REVrUXgya0FoMmxkNmRINk0yTW5nc2t4T2NIdXQ4d3pxZXpBeGNLcFhWSllhVmhLVmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNDA2OTYwMDgiIHRvdGFsPSIxNDA2OTYwMDgiIGRvd25sb2FkX3RpbWVfbXM9IjE0MTIxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDYyMTAwMTAwMCIgc291cmNlX3VybF9pbmRleD0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ2MzQwMjEwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MDkiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3MzYyOTEwMDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1OTAzIiBkb3dubG9hZF90aW1lX21zPSIxNjY4NyIgZG93bmxvYWRlZD0iMTQwNjk2MDA4IiB0b3RhbD0iMTQwNjk2MDA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIxMDIyNCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:1412

C:\Windows\system32\taskeng.exe
taskeng.exe {BC269E80-5147-4B43-A454-0BC41AB040F5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2780
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1340
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{88E5AF1D-0B1F-45B5-9550-40E4F94EE564}\MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{88E5AF1D-0B1F-45B5-9550-40E4F94EE564}\MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe" /update /sessionid "{EF4D078E-0A79-44AC-8EEF-75E185C1C641}"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1436
- - C:\Program Files (x86)\Microsoft\Temp\EUEF2F.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUEF2F.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{EF4D078E-0A79-44AC-8EEF-75E185C1C641}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1096
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2016
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1208
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1484
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUY0RDA3OEUtMEE3OS00NEFDLThFRUYtNzVFMTg1QzFDNjQxfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7NzMwQkNDNEYtREY0RC00MzM3LTg5NzktNDM3NUIwNTJBQzkxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjIiIGRpc2tfdHlwZT0iMCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjIxIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0NzUiIGluc3RhbGxkYXRldGltZT0iMTcyNzQ2ODE1MSI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODgwMzI5NTAwMCIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Modifies data under HKEY_USERS
      PID:1944
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUY0RDA3OEUtMEE3OS00NEFDLThFRUYtNzVFMTg1QzFDNjQxfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswMjdGNkIzQy0xOUZFLTRDMTctQjVGNS00NUZDQUQ2QTlFNDF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMjEiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ3MTYzMzAwMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDcxNjYzMDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0MTk0MzkwMDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzhlZjc1NjczLWFlNzYtNDU3OS04MzRhLTZmZWUwZjI3MzE3ND9QMT0xNzI4MDczMjg2JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVNxdk9jenNWSXNsczVRWmROTEl1b3NSeGpCNDZ6MEVYaUIxUnElMmZpM1phblcxVGtvTWxZelBscThZOGlkaFN6QXNnbm0zWGppQUZaU3h2MWZDdTAlMmZOUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2NTEyNTYiIHRvdGFsPSIxNjUxMjU2IiBkb3dubG9hZF90aW1lX21zPSI5NDY2OSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDE5NDU5MDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0MjQ1ODEwMDAiLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEwOS4wLjE1MTguMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NDc1Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MDQ2OEI2RTEtNEFDMC00MTU3LUI2MDQtQjM0NDk3MjM1MTQzfSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2152 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1356 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1452 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3504 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 --field-trial-handle=1324,i,5503973922389001187,13500513596496580791,131072 /prefetch:8
  2⤵
  PID:2228

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1512 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2196 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:8
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3508 --field-trial-handle=1364,i,8627988651683892021,1969960733704692408,131072 /prefetch:8
  2⤵
  PID:3036

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1396 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:8
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3200 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2228 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3428 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1468,i,4006733010707045554,12650363166083470844,131072 /prefetch:8
  2⤵
  PID:484

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2796

C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876

C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2356 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2620 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3208 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3424 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2544 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3672 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1712 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3568 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2772 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3940 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3920 --field-trial-handle=1364,i,130438748186703428,9971348912379521070,131072 /prefetch:8
  2⤵
  PID:2252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1376

C:\Windows\system32\taskeng.exe
taskeng.exe {08BE2BFF-0194-4407-BB5A-115C18C39B9B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1436
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3012
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg0MjA5OTAtRTkzNy00QzMyLUFENEItNTlDMjQyOENDNjdCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzQ4QUJCREQtMTVFMC00OUQ3LTkxQzQtNzlBODUwNzBBRTY1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjIiIGRpc2tfdHlwZT0iMCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzI1MzQwOTg3IiBvb2JlX2luc3RhbGxfdGltZT0iMTI4OTIwMjEyOTQ2Njk2NzY4Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTcxNzMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExODQ0MjgzMDAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2196
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg0MjA5OTAtRTkzNy00QzMyLUFENEItNTlDMjQyOENDNjdCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0MTQ5OTM2NS1ERDlDLTQ5N0EtOTZBNS1CNDc5OTMzN0UyOTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4yMSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjQ3NSIgY29ob3J0PSJycmZAMC40MiI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjQ3OSIgcGluZ19mcmVzaG5lc3M9Ins0RkYxMzkxNS0wOTMyLTQ2MjQtQkFGRS05OTFEMkRCQTc4QTd9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEwOS4wLjE1MTguMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NDc1IiBjb2hvcnQ9InJyZkAwLjM1Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2NDc5IiBwaW5nX2ZyZXNobmVzcz0iezNFQ0Q0M0Q2LThFMkEtNEYzMC1BRkM4LTNCQkUzODFCRjk3OX0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.21\MicrosoftEdgeUpdateSetup_X86_1.3.195.21.exe

Filesize
1.6MB

MD5
6e6c9eead0bf1a09c9bc0f4516139bfe

SHA1
1aba1e90b8f7db2ea484521ea3247e1e1dffcc74

SHA256
812012ea1a55b4a8b6980d0c9f352be6bbdc1c69bfe13b5116400057aca30662

SHA512
f844a2bcb06b0421a94160a88647ca6d3ae51cad056b3db186da846df336bf57e84a60d95d8310a2becc32c7ca6334098e13b1315ac66f32ede266e0d4d85e08

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2868_1106044921\109.0.1518.140\Installer\msedge_7z.data

Filesize
3KB

MD5
bd70ed26e6e6f3193043ac09c58c6a1c

SHA1
d733a65e17f2851d5116598dd80533efc1656468

SHA256
7a474217d20b9a6fe3c3a46c0d6d5b2d2040fa790663f6da9202ee7cb07bb448

SHA512
3e2ecade6d687b0736d5eafd7527b24095b9c51f0c8ba99398b23da2d8843c49fc8c1fa37190d385b504d8224c8c517d78d44ae32e10e45d54b19477a6970756

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2868_1106044921\109.0.1518.140\Installer\setup.exe

Filesize
3.8MB

MD5
3a92a61a6e01c80ecc7d9499abb901b7

SHA1
d89d05802d937f9c71ced14282b8a19623fca7c8

SHA256
b70b2ed82c7afde8003983992b74f8182f55080b43da3d96dd29e8c0c7e8b47e

SHA512
3867efbd984ddd1eec084c70a42104cbc0057c3bed222af8963051779b612b46bf4cea3311452f6564513d7558d49a1e66a9473ad53f1b2fb4c43a9d7d0fb47d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-10-1.bdic

Filesize
441KB

MD5
4604e676a0a7d18770853919e24ec465

SHA1
415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f

SHA256
a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100

SHA512
3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
f629039be61cd7fce9b3956452ff05a7

SHA1
ec2561c7bc2c631ae620f7a2808338bd61823148

SHA256
dc0e5b249dd4a4de87b44b673e9c7ccdfa044269478eec57c5628c7575b5378d

SHA512
6cb2faab1863ee97cbf660f3a39c81d7953e5a7d94bd3c7504d2d09d0072f1ad0b26dedba00f69c21c5c349f0e1040753dfb55b59721499c564d022f350f50ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a873075b386af63661bc109d74cea794

SHA1
88c1d9f33ca9e1e8380fb882bb297eb8f446b264

SHA256
1344298bcf298b80dcc93173f51214c1e4f8bb32e1ccc5ad2367577e9da1e682

SHA512
93e3a9804c387268ee685fed7e2e34b5a8a02e7bff910b8fff5bc31b1213a91bf09a5b5c609641fb5d529f4719856e3f161c7f9550298e8ecbdf6c2356d35697

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\052cb883-4686-4dee-9915-57b6e07d641c.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3840fabd-b071-42c5-9fe1-1f819215fa0a.tmp

Filesize
177KB

MD5
513a8a4fbf979054e6fdf29d1c21dbae

SHA1
5cfd66782454fdad75f9406d51339d1c75b8e64b

SHA256
eaad83dbe8907cf7b6ab5611497df82aeacf38d973d0a2a03555afec19d31f38

SHA512
ed99cc7460fbaf600c1805af2fa60155f7612b1778cfd289f279fb42ef5943fff69568f2dc6894ffaa95f89fa76db4a16cfc7d0474a716be9e3facdca5333955

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\56f9c026-c0e8-4921-9299-6982392e668f.tmp

Filesize
342KB

MD5
2581a7baad5ae7bb04864f8b3712298e

SHA1
02498dc8f8c76a6e0372393916bf9da44a92862d

SHA256
e0fd6e176da4a3be7fc26631a6c83d6dfbfa5ce9c9406f1e42eafcefaa65c2df

SHA512
462c573e4d46e0650d9c2e8148c6b1330cd0be6c0726e0f43802cda0ce906250c7ebab0f26b4de126ad50c306593780b27cf336c51e8ef3f7120d8c6bcfeb6c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5d4b7bd5-230c-4256-bcb2-9fe52efa9554.tmp

Filesize
177KB

MD5
582bbfec5c68b069916a2a9bbe276ed9

SHA1
fabc86ca142d6244078c99588b59f23b9b914fd8

SHA256
288e476e7597c907d9ee0cf59debc252a502a8d424f2d59d82372dfc2932346a

SHA512
0e99f67cf50888837a999a4e5fd8a2c2e6dc4631c596c333c6954daec636bff7caf0eeb1b2eb229573357a1fe47a083f02a55e47b6743bc3aaa433c138ee7c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\66fd58d3-44a8-43c8-8b15-3a1139cc4eb7.tmp

Filesize
177KB

MD5
0c03dd271416e8612c257bc31f627192

SHA1
5326b35e3d34f5c1240b490edcf193d722520e9f

SHA256
8f295d864d7e5fed534ce3c55748428d0983f84f7ca816e28dfdfc281448a660

SHA512
feb4bd81e0e94df4ffd2a73cefade9ab2ba89127452fc643f906118be11398385ea513933fc8ddfdaf68d753ce720f57209c7d7a33640c18e3f06642ec486240

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
44691fdf709576c5467bd86b9d95cecb

SHA1
9c0e49c662f20cdd89217f1bb4b4ba701e659697

SHA256
bbeef7deae86cbdb634c26982101647e319bb03dce941d124f0ab0edc8a76de9

SHA512
e52fb7f7091ed7a21944c629081fa5069f47fc076911101e20fdcc183c35b7b460fbbfac56f1f91052b1d35a35e66ce2dafce70349ed34ca6f16ba1e1f1fabdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
50bc9d5f9f5f9cebeede2c30a1072c80

SHA1
7d07c62050472184865b25daf0d673b7f179eb39

SHA256
b7c5f9bbe0612ea94d47fd3ac024708c379cadfadc185ab44148945a1a0f0578

SHA512
cc68e8c283cc68238840414e8a48bd584a6495d4f886e7b5d5a4f3b42cce513277186a4e67af7d7af87c9b7acf7bd76b525500f93d26444491adfe356165cf80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
520KB

MD5
d10426a82015ce8af1a04b5915f41dd9

SHA1
15232ba43944880f85a729b37eb3e37fef3550f2

SHA256
1b0b29fc480254cdeb72776b3c55595bbc0255fb85c6bd6240fa3f2752035c42

SHA512
ce325a73c84c4b1848dcda69a67092cee0248c3fdfa12e0c1ba1bf3747d032d2fa6cd7869af3a7188a197d95d92d236d58519cf522d2c5d730ba653f38e9bec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
62KB

MD5
dbb74f17f882c76550d48de0ba3663f4

SHA1
5588f567466d97fe9942087b1c519d2b656c5218

SHA256
4926d87f3aa10435e11a417f901c7ccc8b415cc3d6bc3ac7ccba9ee9b1192786

SHA512
6710f0d865e29d0ec2849bec87db312fdfb043418a1fe6d484955e36670d370586df4e260c50a8165444bbe706d4d9c653cf8cff8c08b68807a09d0fce4dfe3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
41KB

MD5
abda4d3a17526328b95aad4cfbf82980

SHA1
f0e1d7c57c6504d2712cec813bc6fd92446ec9e8

SHA256
ee22a58fa0825364628a7618894bcacb1df5a6a775cafcfb6dea146e56a7a476

SHA512
91769a876df0aea973129c758d9a36b319a9285374c95ea1b16e9712f9aa65a1be5acf996c8f53d8cae5faf68e4e5829cd379f523055f8bcfaa0deae0d729170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
69KB

MD5
aee6d5d48230c7b49c109c2293d85c5d

SHA1
33ba15a284668344dc8cceb29fdeec0db3fc3def

SHA256
e7321897d3021c6db779654c12766d211d0c83dd81b67c418c85310fcda37448

SHA512
8630b6671be4858e6c91486cebf6eb6de9461686663fad3e501de544ebeb9d60ac3b2d96eedf50cafadb0cda367ea90709c343b6e1160d7d9771a38587f09d68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
414KB

MD5
095f73d7ee109c9d388d8fb10b04bb4f

SHA1
e8a2c9185c97c694764addb27216d4504d2a02b9

SHA256
313ceaf23fffaa9defb837a8dbb605988e08074792b4022c6b464b8ce17fd35b

SHA512
30426728cfbda02dcf4a309071760f6b2e20581875287d1452064d280efbdee97f3f618aabc4589500c276b05de31f2d6743a2a6c7a889433c4e8ba1c5eac7a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
100KB

MD5
2e52bee929ab7d56b2622ae84962e0dd

SHA1
7fd648bb1fb1f069578e992972d7f22ef1bfb36b

SHA256
58a0ed06b38f7886418d565ea4cdb15345b40a1d29e635e167870f45fe14ed4b

SHA512
c53ceaa60c9591ad0e61e82ebc1b5c6dd46a7b4a1b7ac303aeced0f4a0611e4af2b7a5e1febda5fb10041d0a9c76202ed05bc3e344bb6ac6cc35529e127e9d8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0e64a710507f8bc483bfc2db105d4461

SHA1
649f4594d918a7ba3dd0ae305d6dea1aff4eeac4

SHA256
9483f290c301c8c6ae9cfae4ac9b4ff0d71b2f5c23e5ccf9ca740af8611f2c01

SHA512
94a97eb78f55cd66a4ee6f0fe2f526f3b91ce50bbd9e57802976ffc8550134f25f4a941d564a6b05a1c96d006d168fec3fae8dcd810f2e13806377b9690a09bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f76696856b11abc83a3205fcb56a7bf8

SHA1
7962f4400aeffae913b81487a28ed8088426f261

SHA256
c40deee57c8dce48225e3bbee418ad8093a99ffd83b03e68ea233138778c7969

SHA512
16e92d17f0100ec62dea1d64cb405539bbb7338c3d5e7fa5b480a5604ce0871b1ccaf3b9fa68d37babaa2ba8ac1830987f5980b17745fe3628b2b1927933e91b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f2933302da512f5e170f59f5ba7453bd

SHA1
4e3759706de51b24ad3cff4d4953a70bfad35cf2

SHA256
02c8aeb09bb023ba283752ec5aa58fbb15199c70e00420a28ea521ebd5237b16

SHA512
74a9b770dd1c7f029db24e7085b6950a7bfe9d73a6d0da32e6f9a843394cfcd201c26ad2531a1176df160bf2bb430f476aa8fce1ab335a84802ec4cbb01a83c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000015.dbtmp

Filesize
16B

MD5
d1625ab188e7c8f2838b317ba36efc69

SHA1
9352ce60916471b427e9f6d8f192ae2cd9c1ecdb

SHA256
f6a28e2e41d451b4de8597a14916d7a3058ebdd8046a89109658321142660d69

SHA512
50bf78dece37f946a6229d81cb61f0cc647b78220205ebd7f265582e6b228666c6229c219c480556257a135ef5f26600a497dc66494b40779c71ec62a2fb5e42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT~RFf78699c.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000012.dbtmp

Filesize
16B

MD5
ab6ab31fbc80601ffb8ed2de18f4e3d3

SHA1
983df2e897edf98f32988ea814e1b97adfc01a01

SHA256
eaab30ed3bde0318e208d83e6b0701b3ee9eb6b11da2d9fbab1552e8e4ce88f8

SHA512
41b42e6ab664319d68d86ce94a6db73789b2e34cba9b0c02d55dfb0816af654b02284aa3bfd9ae4f1a10e920087615b750fb2c54e9b3f646f721afb9a0d1aea3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000014.dbtmp

Filesize
16B

MD5
ebc863bd1c035289fe8190da28b400bc

SHA1
1e63d5bda5f389ce1692da89776e8a51fa12be13

SHA256
61657118abc562d70c10cbea1e8c92fab3a92739f5445033e813c3511688c625

SHA512
f21506feeed984486121a09c1d43d4825ec1ec87f8977fa8c9cd4ff7fe15a49f74dc1b874293409bd309006c7bbc81e1c4bcba8d297c5875ca009b02e6d2b7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\38eaff55-d1b0-4404-bbe9-496bfc6b0962.tmp

Filesize
5KB

MD5
1da366189c98645be31fda10fb993489

SHA1
f76adc1f449396969826ae9f2e826591eb251171

SHA256
17f20ce8647ba5931d5b001ca060040a9575f23966b419612ef71f4d7db125a0

SHA512
2c103ebfa2ccc3b48ecc7b992e3ad5494033bbedaa2807ec0a7d3c98bb395332fbd266877969bd64af34452a93b061d3c4d78382e8467f444f93ab7094ac7ec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9292ecc3-ec16-4190-a1de-e0e58031d3a7.tmp

Filesize
5KB

MD5
4dd7f5bfad96eddad8b60871298a53ac

SHA1
ffc8bad9e6567e1031ac2e0f04fce2b6e21e7a68

SHA256
4bc03b1b069e0f35f25bad25443e4e09c79f01786ebb10738126c09c8671b03f

SHA512
8c6d7fdf951bf3b3da6ae33a8e90d8fdf2c2855b6ca62ac3c7957688226e33bc54e1c0c1accda930bb2e34ee9c3d747c7d9801cb9fc82b7ea24ae5b126a4f1a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
2c07d8b8417da8d6b386a494cd866988

SHA1
ea017feb73636ed3a50204132f661e7c0805f2b8

SHA256
f420b193541b030d3215ddad719cf84e74cb636ef395579ba2934a7b2b4e7a03

SHA512
c15e596edb3941e553cf1cee56b39e42d6fe9dcb00e192554787f99b807370dd9a3948951e608ce6ddda1eba596c36d8ea2314801b964e580908b467c71e4f77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
379b130289194b196934ad7f6ea50031

SHA1
8b36a8d59d767776096e52233d73f771c7b173c8

SHA256
b57b4b437e10e5b7efedf00996e95827151bf27646c919cf357023896c8c95f7

SHA512
d154bec92dcb24db852b384ee2d3d02fdc284031dff02e32cfe542cd0c975e11c8a2c35b901eaa5394e0db40b22d031a45eb688585a771ab7df0c0dffaec3062

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
3762694ecf70cd01df3cde6cde79ba34

SHA1
b4ef410f37fc0b90406494171cceb0cb181b94d5

SHA256
7445ed78b867d6ce6d0b1b0ce46555c26dfbe3c1ac0d39275b9a33a2c1168696

SHA512
348c74927daa2352c81096d7fb096cf0babe5f9361ba161f72fb666550318f2e1b55c856f30e8a49f23f2d95a4f48092f0cf3b72ce0cc33948159950efb468ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c6bc5a22e5538901c907bfaf1622cd3e

SHA1
6f514aad3bca0758435f582308f4c46eef452c72

SHA256
bcc10c1179b08028b1cb2c9eeac0c5c958ea190c202ae63ff6ecc32feeadabf2

SHA512
5148dcc4c23dc07662310cc861d06910a7bc41f8fcf6a337b581463b35a68f18877884bb0f188fbf686bf5494b29d5f723308f08353c88a7cf2cc8cd3b1a294c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
900467044669847d5921ee700201c5fb

SHA1
3ea68dc527480adc525f18b1c821731a01f93ab5

SHA256
3511eb9a487c46c8fec7a7156385a1cc9b553a5340ba438e26d9459e4d86b146

SHA512
f6ad782813067a7bbdd21185a2f61c73aaf8f0c110021ba7671c23c94e1309002e6fc3feeaec275c1bb7b3499920896ab170c9d7ff5684b71dd37d155eed7fe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
64325ec7f4cae72d31b017e1489a0b81

SHA1
d5c11b302efb6dfa48e7833aff06d089316ab263

SHA256
ae3bf9cf082d3af4d7f1211cda31f3dcbf17e6c0a877aab6da2ca28adb94c4c3

SHA512
9a2a732787d29913eb2b34b6b528900fecf5136298fabff5e3f4d914bf49ae858fc68b2dc564ec581d1b89ad467ebfae61f96f1182cb6310975d4aa1882f4dec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
4d76d00aafc94d52e0e0df5e71494b1b

SHA1
abc8aec85dfef051b082dfa70c9a239da9a31a76

SHA256
3d0033c069f72835a2ada61921321a715e52e8ce4c96dc51c9931f9afc5f7e13

SHA512
151c72f667918403b4698b01d6b0e810f2dccad4c1f4edd28d91ea3faaee88818295864d551d94eeef5004df329df659de314ef29ef2acc0078883c4bb891dd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1e6c3032fd07e63f973da54445536e07

SHA1
24488a36ecae4243dea17e4ce7fcc1fa878c48b5

SHA256
fd4780de1bbf169a96f31e620d679b51866f1f424101f8f99e860302c0c2c1bc

SHA512
97202aa8d5f0912db8f42cfcf4762b420cbfe34b7dcec674f09f8efd9c3c692f36835d5f4b74db58414dfa867ccdc7bcd3e29865fe168f46c66cb194c07e1114

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
33318e222a4f76485ebc99fb5112df77

SHA1
77f5b40b81364b3f78c456124fe6cc4d80228ce1

SHA256
1bc29277f5454eeef54ab22c017e1efb681f7d1f9cf40e1068a85e2a12c30768

SHA512
613765909a4d7ccfe39755a2036a637ff98b8f83f62ea7395ab9ced523ad20a1c3eb5927e0d0d65ff73d16cfef611f4a1ab595df28c6d23bdab6f8f57c7b8d8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
cf44fd4fe912b259df965e005ff0b937

SHA1
8d064b0fc45a93cc7f7b380b9b7af5d5b4cb96b3

SHA256
c3232e76b3548d567675a68f8c3ed05a3b0f8a0198558e93d719cbb147267ff9

SHA512
329474882ce1647e323fde0f9d4a24d490e13e9f116c3810ac03286be57f153b36d51110303913bbd42f54755b167ca6f549d47340361e85fc906af4b03b7cc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
a98ac303feef87dba7759729d1a56b64

SHA1
6a43f589b6d6feab4ff556b31254062b05db0b5d

SHA256
87b0443c9b6556a1b1040577e0b9828c4d980c4e7e01ac908343588cdebb999e

SHA512
bc469f24cffd7820257b0de9409ecbf5de4b35581aeaece492a596c61bb91c03fff5a71568e928070199c57f257caa78f19f91b07ee5f89bce567c76f8ccf8f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
0db47db6cc4abdef27de46e4f53cea50

SHA1
9b900b2ffaf52673d9b6eb19689bd05ff11c3fa6

SHA256
6e7cbb72a9c3d3088c61c9c8f811c9133d4d8e7f7a76417a0d302ea0d747748f

SHA512
61cfdc33c940664d1f91bc83f420cac7c6befda6e7d934cc759d697e304d612ebe828c06f114985e4d9257f77fd8af99f60b76511d2dd08a6b4037d708437159

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
5fe8743207c35fc53396ff08f9a781ce

SHA1
d4d711ddfd5efc3fa96afe420762341a080363ba

SHA256
2226a6fbbf87fc82a758d2ce9f93cce311d71b1b3509f3b60d46387f3a031fb1

SHA512
220e35e97002a2aa7d81a51561eb3a3e43f1917eb9c71c4285d460d7dfce95f5f64f160163a820cb63fc26cc6fc140698a67d3bfdd8e04ee367b1c45ee7d727e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
502c05c3b35f818475ccb8bc0bf5873c

SHA1
27ebb85199b9a23861752757f8d069f695b1aaa0

SHA256
d2096d309989e6892ab8f64e393efe553e2389133d9a572e8b9ab63676982095

SHA512
cfc586071f1e550768ade9d8bee5c5b30432a83ce25c445adf2a80ce00b900ea5bcc5bc1c80a24fbba1da01c63d8eaa040d6c7eee7a575d62dced1e608ba193f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f516b39980d48a7e45ac4f3911274093

SHA1
afc211078a930bedc97acf8bdad5257fbe8f6701

SHA256
c1c8011b0969a8432c3c237b8f1afa52f611c8efbec816ceabb60e4336d53c07

SHA512
66cf1733dafb689a6650996ef1643a7576a9a9489dd30926077a3aba20caded441139786e561e45fb724128130b75301d6d3392cee09e50ff39bd92020906fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
18f240812c916fd9ad908d2320656083

SHA1
b20c434d69790479a3e054ebfeef291bffa3895a

SHA256
4547d7e6ae2b68aeac04175f406319850f2765bf4da334166a0df884c3153561

SHA512
0dc9a125c3831e59632ec0962d1939fd4861c0edf65df0353af0183200438e9a4685c16325fd47930815e218e2c2545407d50b4b6ed0963442afccb3629e4d13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ec9bdc492511c52f81ee217bfd80d8d1

SHA1
89175e7bb77d93901286371b6347a49cc802911d

SHA256
d8c4bbe72d0b83769f6585bb20fd30e968b3079a3d9e050c04efd2d9707a1ca2

SHA512
ebcb01308a5adba752ef273f5c749bdc1c53542da8727f363546ab1e3169553d0df5441fbfd696438d7ecaed4f8a1ffa16bde21d9c8da93989a97cca8b09b59c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
54bc62443644f32a0e8bad555f1dcf5c

SHA1
1b6b0c09ef3738aeed82e3581ff3bde6c92c259e

SHA256
1e5deb1122795a03700b4e48c75264cec8dc283558eb8cde703875393ca7d110

SHA512
e3ca245461fdc996a3410568b7ef09821178db9d537059b0ea9e10f9944ce7ecbc70401bfb10487f87a8cd9aa8441ed2f854691f65ad94e5e90ecba93b706b49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
be1546ae39b8425e284fb4f8f956c03e

SHA1
52df35affd855b6872d32ddbaf6338711eb07c5a

SHA256
ff9a8877469561a09014fca7109e81fb669b16488982b5754d16eb46b193149b

SHA512
7a58cbcab75ab4fcdfc60bb143cc91a80ac9ef33e1028a42fe804a7f1049418f141a06a60c2769767e419b125239ddbe0f8cecd7cf7b3aec2ab85451b867a839

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7eb09d1aa35f8659fbaa6f9c6dd6d0e1

SHA1
a0d20c99c434af88166b653d79092a5b328043f3

SHA256
c36c5b439737d0fbc46ad6c503f34dc70ced5b3c122a0d63473f408a2d27d163

SHA512
43f8c160dc5869c327a6c159933519ea78c462749c7e6c38eef09e1fc1d287fb76a39953e703359efbb42172585562c73f8f70ee3336969c6e1a29c359bc8380

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7e7b25b21ae5bf86d638bcf7a82a491a

SHA1
e73b2eb6277987542b2232ad71192e429375ac0f

SHA256
53737f312296b90cb0d78a46fcb778d0f337fb7f9ec42bb88aa0565f5d2c15dc

SHA512
d491b12acb7bcc25121407281515e8113400afce845bdcfda6a9e11777897b49e3985f599f0a25929b0a477911a083ba3fa0042a9930da2a61bfaaa8a33bbfc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b7d9d340cb729da089bf7797d7f673d2

SHA1
374f0b379d62d8c9fac673a036f93328939cf979

SHA256
b1bb7c78037b69c992f88b92b3bb0484ae4651675b9de858b9f84e945e34c06a

SHA512
43c66a6ca1dab91d68e78ec2e850f4b15cc9ff58fc780754fe306ee07140e043c8f503347a77a877daeeeb6615da4e067dba2febe6bf5d918d6505433f5a1ee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
8fb4f9a4dc01c26bf1e80ea6c4ff8c0f

SHA1
1b2585c3148e194c0c0a34c34be7d6aa0330d3a1

SHA256
1b78da0f41218246934c6bfd10ac43e83961a18a913b454dbbd64f81785b95d4

SHA512
b9b9a34d78ab1ac7df6a02d353b4f809108492f9155d93064e2ed8c6c898a47cf4a69bc94491ff7df86d680cac58c3ebde64a84c712fc4dcd3f1c03e325c4517

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8d9e2cd00cd260523b75a9dc6daf2a2f

SHA1
57bd06a0f3614454864e4526b90a76a62ca05695

SHA256
54c7b4c4caa77e708cf77ed3ca5e06d9203cddf414e6b12864d1e297e98acfdd

SHA512
c4769258c668cb0ef0c4b59e41c5b1af0518b1df77569d8a94b7fafeb3b28bcbbd273a065cfd77309137866f08eb1bb796fbde67b1cca99831029264a8e0e72d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
afe713da015b140fa8b4a65e39ff5deb

SHA1
d1f1f5a6c7851a046e2a25efd8ed0736fc5a1e21

SHA256
056de6d494305255ce970803e74eab22430b082ee60a3ee807935e9272e27cb4

SHA512
f9dc11dd608379b93e1511aba27a54f84634667fab7f4bd9ca404094c0c45ed8a75f3bfc5e77f2f315524b1b5872a1ab0ca5e490669325c5eb1519de1170ede1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
37110f84c35476fc0dd70fd7fe54053f

SHA1
48010a3ae67e13da8ffdc6ba2c0cc968d08ded7d

SHA256
4291434c2ab406ec30d0f4b0967d68242b20ebcd45ea478d354c58d314f0a6d8

SHA512
c3e3f13525600648de93668ad3522a474cdeb8ea3ac0fe2d4bb1f6ee04305dd2e62519027f33c47c17ad0775192e91939204cf1b6e92bf8501b3789bc58b8662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c809ac9dbb32d7ccf12bea66483d896a

SHA1
b9ec152c599c96a46a9f85d38d846c06f754e2be

SHA256
9f0c95773f6d3ee606158f32470fac30a417cef1946ee34abe4341c51bca1200

SHA512
ee7a477f7b33adcd26c41da9849c277bbdf439c6588d8ca94bffc036648df948421797485a85e780a11ffe30066414d408d7c4a47b45a975f538c23b2348c0cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2afd4b2c369c3280ebe8b7e92dbb50b8

SHA1
0419b5bcfb7bb795b38b8f301da93b434c9e8e84

SHA256
352a0eef19e772764c748430fd78d06c21d6e26566fbe58368133826d48d78fb

SHA512
6612a1157539b6788481b124b13b87060360440a37d7f9b1eb06368c2b38f32c2f26d9ecd27eef33a2c290b684acf0503aa2e02ec856986f4790defa25cd50df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
8b24443a3b8d3e1986b997bf2b809282

SHA1
c15a95dc3bdf336466fee9c0b68e89e6afe81bc1

SHA256
64710a8532e29b92ffa3285a2d3db733f25650655879871449e8e4828f8c2575

SHA512
e20089eeff801a894619238e4dc4d268c7ab33f186ae6f9dc2560e1e12b01e8240e6442760beb46705ba608ac0408d64452ac245b4c4a23713465dd4556312ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
d05b1605c097368e85fc4d990a73b349

SHA1
8026df50372416a8f9b04bce4e9349bb249ce76d

SHA256
4176e861bce21900d3117f87f8408e2ef14988d114ccd8a2e92eeaebc8daa679

SHA512
d18528c8a6b277e9d2f50d44c5271f3f3346fe7dc238f61471e6e4d439df6121370a2e56f59aa6d31622cfdf718314046866cd7d0be8d3b2e2c3edc58f4abc7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
99e4169a13a06d76a062765adf59834e

SHA1
132cf45fda8d898c039f8f9aa5bce8d754042990

SHA256
9a862a435f5a5928e82496bf7204fc88ba0ba6e16d6c3b60470bd58baf1dea52

SHA512
e4449dcc2560e64f03962ddc740054401483ae55c766b0b111b7e3f0605fe1929b069ce114733567dbfd042a19fe64707f5093a8e4d09700e05ef99263aaeff7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1efaed187b6ca235145c49b7b53ffe1a

SHA1
1138aaa93a267e4b64206aa8474e116c2dff31fa

SHA256
1cf53b3e66a9d50ea43846977c4aa08fd6a54352fbf10395a46c42f2591bbd84

SHA512
a88d727fd068db54f8e291091425ea94fe939a2a7962444ec09643f63a0fe1145a2f66ce25afc62824d068c1df8310466c672052b0ab526de71f4d484a918bb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6daf1d355c1e5fbe5ef2ba0ac4560fa9

SHA1
7aac84bd1df45c51dc33bf0fa3754d0323a95305

SHA256
eff3b7b344b909aac505f3893738f7ff109fc6cdfb69acb962da0d70c0094773

SHA512
eb4712d842ea6f6c649670a5e2fbee7c743661eb30e56f1ab353f1752e760ee231546a381cd4e5037cd5a0bb0f14d69f97954f39afe08c9e6493ce48c82c6726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3fbeb1faeef80e058d0ecec3f614e7e0

SHA1
31b428fd38fd00e449b8f3c24b136abdd4604169

SHA256
05bd685f117313fb95a7a60389c79b7c1212e8d537ae16001afd99f039659c48

SHA512
55057d775612f2aff3897aede63e60f0e55f04df74e9e89a8b2eb1413bf6a0a6e949390a3f10a2c5d7b3461fc502d37844d369735573ea1b5952fad2b6100f3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
6270710b0b09f95fe1920b0a3e03ef32

SHA1
9faa97e03a8410ac3660e8cf8dd8ee4bbb4132b7

SHA256
c9dc6ca8ad68dd3af0c33e39bbbc3e71141d652c4b804ee8d50a96f7be4fc1c8

SHA512
f1ac92e196202eb9ea7fd7e3046ceb8d89c3ae524bd56b3bc780f3529b6bbacd2e81c9388d9f6741d361e85e4892185c72c59815bfb20f68d8a6009ac3e74941

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
e375efd58644f1f70082c3d8d6044d39

SHA1
06dce90991329cbef511b6a6ce778e567befa9f0

SHA256
17247ba651a09cd50b75114f80c45aa59f4459e65a21789a28ec5447973fa048

SHA512
62d9b4f5e0c40d4288a414073c544ba94a341b16a1faed0b1bf330af4cd3ea6d11d685f4ceb83b0bd53176ab12a02b9c446ae1474e4e605ec4fa0b7bbe160066

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
5198a63455896903036a03e7e81538cd

SHA1
2fe734cdb0c90f0bec440844609f57714e23d115

SHA256
47cf20a6f240f0188bcf1037e2108f989abead5857de7abad5605847c017f0ce

SHA512
6c9c7573a4be3122441994b836f082300dc49b49f5d47b5e8f4c844d0badbe6075ed5c6ee12f36967c2538c02fcd6817df298fe211cf63859c6af055a01d8aa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a61224c3be403fc3b6f54d0aa1ee2347

SHA1
14e6b49dab06b420bd7b4d09a53c6005766ee4ee

SHA256
5d17c8cdd0a9f3eefe0f31deb4133031ca3b7c612573b8f96a8d4384373448f8

SHA512
192fdb10b423d8041a9b0c030704725d9f1dd95cf1529f4df0b4fb994efda070f1c43a56fe4f51255d687d4be4d83e9b0cc4e7f7238a60580ad674002e516329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f6f14136abf06bedbbc0b72e425fc5cf

SHA1
b55a7ef0ece5c007332066663fc7523a79ee8f82

SHA256
6bd2e3df9996ab74019efdc27526a86ea5a923c05885923947dbbb32c4908514

SHA512
8a99f25c53dd1842287a2639c4787012bccf1f290be7ae0ff844c8a3377fd55d61816f1546d2b6e6b218e7314ab54f98100c5ce72beaafd735b50987320afc4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7fdc3ee795a77d029a55457f19ef4144

SHA1
49f0595fe8785a836d1fc1606bd13cb3f4e38e93

SHA256
1e7776af9abf8227d5f3cae1276e5528fd9871d42f4dd54a8270ea48b089d3cf

SHA512
a161672da6251dbcf34e4cbb36865cd6e8c5a0dd52826713edb7ce3685d52e3c208a89dc0bf6abd379000db35c445a189fb01974d08d4dc8d563b262d84d1832

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
18236da60abf916a386fab88b75d6c2d

SHA1
51dc535f5ab6bcdf94152d14def4f1e1939988d8

SHA256
84c5be017788494ab80ba78cc2cca510bad88a0964d988cc63fe132e704e85b4

SHA512
df9e9ada29d843676e652bbf8c12669dac0bbe5831574062d10c5fc4a772a00a89f71e05dedbe6db700b614ad262bd0361ae46aaebc0908f3e9724e6001bf8de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
fe742feb0e34efe1c148bfdd264408b9

SHA1
4e5656901875514bfb29423e259b3a982d72deb0

SHA256
b6e4d57081cb83eebaa5fdb1a9aa419884f4e693b03fe6e509d6a610bcb97688

SHA512
590d50fd49ffb9111960b800ac5342d54ab3f59651b8190bc9e24bfb9468512454e7a09332d419565c6c366b299f6098207ad8027218713218763d98f52fe050

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
de80c5b160602d31013dfac6e735eb24

SHA1
7312e8f75378f54c6904e9bbda3354c6aa637957

SHA256
28019753ffec2ad9b1db0aec151c5aa05c320a1b2c61f3241629c65d29a4b7ac

SHA512
b7e9b681d4abc24009faa1e82cfd7f593bced6ff21105e6bb3f4139a6599e9ec8286e17e59588afc8c06a864a9cea36f9be361eabe984cb46e0443b6daa09974

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
87594900cf81034f0da3064aceab86e3

SHA1
3c97e1a5a2d6b11117a98bcd685aa5b7c9283922

SHA256
14de0746e5f477debd54a7c1517d78b51409a2b3173b74bbba46173dc23c3fc4

SHA512
c2ada07429b7a55255b94f85ce07ae282afd9c23795025e424383c51949e281243b49260faf2c5145bbee98aa017cc162815dc9ecbc7f4d9a6884b753eeff8c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
15f63a98db09465e64dbdd1f73ecc0c8

SHA1
9d97eefe68839f75f3e7e4318457a97d6360f037

SHA256
3085ac40a1d454f8b1816dadb49e21540274807bb81e586bd3fd4cf77561299e

SHA512
5253cfbb8ee827b08016367732612b172ba323d26c0a1260ac2524b57d7c0a90bb3f05427ce22c46b13c45c9947ee3914a02e976c911b099696b13bc43b69fe9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
81e7afef30529dc026bc3068ef0405e2

SHA1
cfe6fe54786842c60ecd71ad423b01dd3a14af14

SHA256
a5827b19c8b4081171244301895b7321a1782fb7b2e21e71ab372851668f6cd7

SHA512
b0a6955e91436a7f0ed27cf94145c33842dd4a06c6bf67ca15c7c8a9ea18276fdaa631540203a0bb6a280ba751955603ef4bd1a2cd42dd86011cd9006c3d6861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3a3d7ddf076ebf6eacbcbab09057685e

SHA1
aee1ac2f0d45ca40bfbddb122fbcbb07a5d31ce2

SHA256
6e5a5b275ee587a412046fba2c277672874d568a72bffc4c2ab76d6e6d3e198a

SHA512
0b2a31860ccc80a86c1dec087cebbdf961549c01c1c43cf1ea3c543e5a3c87c6726d2aeff4b42a72f512b5e033feda4ba04fb1ea07dfd128cb00f5d2ec4cd899

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
311c9d048f70ed1c0f97e77145c3933d

SHA1
70b0a0fce2099132124c39467fe5c8f2b3c947cc

SHA256
ab40b0f6b75102bdb3cd267658335ea33f4434dfe801824ca18d7bab32c97c46

SHA512
5c3b54a247b873dae116c1399fbb1a5326772878c462916843d96dd3de3ccd69bf807511aa94c7d210d4e20503ca081dc142af23cffe3af11fa5c93256328898

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c39c9871d0f8adcf860e1ff5a34935d6

SHA1
4442ab9a280b32dde79ae3c959bdf0aaed58a267

SHA256
f19d80caf3bb5cdb3010dd9323f339dd052b6561d54766ebc2695522f8d522a5

SHA512
d4cbe00f80cb4961644ab8e2286d63e09b632ba07dfee937755bcee6611752a42913fa80ced5e2982a66ebdb492d999cdfeb6714b9b5a139a0cde240aca14a3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
2bb3391b4c533d2bf3cc6254ca7f300d

SHA1
89a0b14e0c7b6d14e69fc13ba318bfeab988ea18

SHA256
da97f647f9c82f9ee94ff76fd5e55cda2224ba57c8ee0ebab78c65c231c817cb

SHA512
656a0e2cb42e7f212c14247e603f5333b1b5975994811c17a2fe4b059da02e77450d94b4e4bd2f986fb4eedb0011c81dcb5b44375cc2b39484c9477262fa98c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
71f97f9f76e19fb83cb988b21df2646b

SHA1
887d11e5c3e8e7c60afb0a9a7cf3e73fc256280f

SHA256
92b1dc3193d843b15ba3dc4d7d80562e01533268abef8dff5f733841d4e24bfb

SHA512
e58ca94b993e29c2bc0b524b58494e181f463f1383ba3b265ab39774030aa3de987a46260e756f9234dd9ee2bf75cd700afec9ed906891376769b7e27fffefcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
877b930d8d80c11df7ac65f0b015d8b9

SHA1
92bb6b7bd26cf5153f5937c98f378d396bfa70a5

SHA256
65c18534ec7288d1010175adef7f472befc8e4d2765dad3ce5105948ab01da44

SHA512
08efeecb26b41913fa7a78c9b293b5d1fd380f7c8113bb692c04b650ed17d1fd5e80fcc7a149572d3a3d6ba5484408c354b4ca68c52bf88a24c7d21004a7b77c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9a1e2a5e67e387ec5edc32dff6a856a5

SHA1
76146dce2bf1af9b75822cc7082abafd260d8fa0

SHA256
da2b8b16d64a896e773d465cbd0ae0cb8d4c005f34f2578a80a7eec111ecba2c

SHA512
0eac02749e8de07c6c33e00ca25060d00d873b50473a43e0d72017bc2c33877d0b3a7e1a0e899d71c6f4985ba73137f467de0cd82023101bb1961b1d882209d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
596d93118d98c9b76e3cf9880b9424b6

SHA1
b9b40424a4e1af218b80b956d297eef9314b2bd8

SHA256
4da89c3600b59db52fa02fc1d63ca3ee7914fe66936b04b536d0f30bac488aee

SHA512
17e64161b3378b522b5e2952923c5b2a1209b087b5388816b75faef4eb8c7a9bf0e6d8eb86c2447b35b9d4230b8bf7493f610ceb307400208e499e4349d0893e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5baaa7acd39582fb65ec87c6a5d37274

SHA1
c7d5eafd5b11f78413627c63280e1572d1a550d9

SHA256
81da657bbb4e42abefce345265879d7a7a48da8d015e8876e505eb0a71b59a3e

SHA512
c484e774ae01f4bbab68d9d2d2163431a77ea4371609da76cc90042ec1a4244e161b5cfd21585b8eec6e4d17ac800da753cc5aa526b5e0cbae2d460e6ad5975f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
52fdd8798f2943b713b0a5ef94045ca6

SHA1
63f2401d9699d49babc5ec4397ed60980cc737cf

SHA256
bd3f0852291d4624abdb440b81c504be561131ea80f8eca3b14352400f40a052

SHA512
abd1efe4d5e8df29e09eb334468fd3676bf7d2ab7d827ff831b6b64d25876f0bb9e478bdb95fbca2c1b12849ee9c8d67f319eb6dd7993451ace9838567787e26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9e8b826b32253e851b0f2a54a23ecb49

SHA1
a532b6b3de93c8c50c22ee7a974ee678c26117cc

SHA256
a63d0b179574e1b3730132b88308a081998d2f41c6026db524a0b6bc57ffbcd5

SHA512
342349b1245425c9a38c757b126b3eb3547e0b12785901e6d951a603ef18e98af4bbf5dae41c61d459ee8e39b899b787fe6d2b73e0bb75e0c279f0335557becc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cbf721fa863a6bcc1df3f58960642f5a

SHA1
c76006ce6e2a6ec92a12da2638ed753a277e17b8

SHA256
377e0c606bee1a54f8df05aeecd4e919292ae5a99a5ed2f260efcb2564ad6b83

SHA512
0b8ab69f871897e5b591e35b5bce05f7b60d91d8b9b41d2aaa3a59b6506faff54f0b9efc554c17e1f88193d0557737667ec67e8cc130cd58e745887b8171d3ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
29ac05def80180794e5bd5f8e4443acb

SHA1
472f50089e7f9a9afc4bb80516c8215640da8182

SHA256
95a1f0b8b8bf40848089bca0127681ad84ee3f42ed573d1a863b4d630d4a9248

SHA512
3a389ca091ccfc8c1f60268291e64a7767c30f6c895530ed4ffd1e49aeafa484faf0468576ad0aa122717d35b7612f8b3102d30ae74442029a0cea0e7c82e1b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
aeb18bdada1000818f41b83fc91af649

SHA1
237cfafaeed4b16b3271dc2699859940d8ca2112

SHA256
d2226ec8bb0460fb336f8f926c54857ff85e9b6a3df61faa298bd1739efd46be

SHA512
eaf3fe0e551d2599c5fecf18bcdf25c16fab77bc0de1b8762b0b844edf99979a4a6fdb8bb71ab79b24645d905f8c3424ab0e3a24b9ddeed6a5ac0809ea070f8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7bf1e3a5d2a59ba7c88dc4e28d1227f1

SHA1
7b9b917cc323716e793a7c651e33c2b800a7c61b

SHA256
b5d5b07941c19c3c912b45306934e8f183e821a4369fe3fc7b1cca0d4fb4a705

SHA512
613facd2c2d7427af90abad50a36a307afa5cbf465c09e1911cdbbb56c453550860175be53266cfc4793ef119a02e655f48342f3c78ab469951e4cf49ad61b8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
158c43c5de03a88db044e673516eae13

SHA1
bb1e618ac1460b53fd5c9db339a600373cfbddb9

SHA256
e57632a0175a71e010a91e0caffbf2d3f9c31218a9b76efed827ec37aeba2a9c

SHA512
66c09fd1e887b23a89d86e34575d143cdb8ed1f5159bdfbfebefad105f35f2f65c7f70c47e008a9bb57d496629ef17c2c6b0d57784ec3852ad9de87daa3bb7d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000016.dbtmp

Filesize
16B

MD5
edd71dd3bade6cd69ff623e1ccf7012d

SHA1
ead82c5dd1d2025d4cd81ea0c859414fbd136c8d

SHA256
befea596b4676ccf7cc37ea8048044bfa0556c8931d76fdeeb693d20264e50d6

SHA512
7fa9b9ef95db0ce461de821f0dec1be8147095680b7879bad3c5752692294f94ebc202b85577b5abac9aeaf48371595dd61792786a43c0bd9b36c9fc3752669d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a2fcc7cc-9cb7-4c9a-9426-d7dda5849290.tmp

Filesize
6KB

MD5
fcc594a78f34dac06152a0f2c1158069

SHA1
3c46af8dfe22e0a2807cb0a32e57d3aa25e518ad

SHA256
67614eec1e6423907567bbb864eabd080b696b81e14cdd99cd3cfe1adeda1aaa

SHA512
0e95775865d7c08b6c2541b5524ab836a94a8c8d9afeb61f6d0018e33f6ef4ba05e4d158bcb97f680eb3c3bcb4d8ea9f18caeb00afe5a08bfccf7668b763fc4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d08df726-873c-4586-827c-87fd2a5f2035.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000019.dbtmp

Filesize
16B

MD5
e5ad213c1d147e06198eec1980e7d918

SHA1
8169b54541b0613052e7dfbdb27ded2d89c26632

SHA256
300feb3870e7d5e43b28bd6b7826d9e0c21e0e81ac1b44e9c4e35957ad0fa023

SHA512
326fa42ae471094fcddb19198fead059669f457b81aa462d93c83df47102c664bd6d4c83f069c0da06450e971ee62efe8d22a2db5aaff356a2a5591455dfd8ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000013.dbtmp

Filesize
16B

MD5
a6813b63372959d9440379e29a2b2575

SHA1
394c17d11669e9cb7e2071422a2fd0c80e4cab76

SHA256
e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312

SHA512
3215a0b16c833b46e6be40fe8e3156e91ec0a5f5d570a5133b65c857237826053bf5d011de1fcc4a13304d7d641bcba931178f8b79ee163f97eb0db08829e711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
88f553a3bc8aa866cbc8d1a40744a680

SHA1
8d6291dcfaf42583dde170237ba6959923470d25

SHA256
f808fd2d26c72a12022c9bf60627fcb8c9848f160b7df2699456aad2d63b93f8

SHA512
d89b6b7aa76c36396d83b8306d622b33cfbc3f5ad4a26706b371f6ddf2af5a4f189429f837d9f49c56c74cad651499b1813fc91dbd79d966a49ef0024c87483b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
342KB

MD5
9acea4d15d98a5284cd1eda58cb7c3ba

SHA1
ad66b9baafcb0e828056ea6893635694bbfa16c2

SHA256
b5797ab9c3d995feb0b8abe571cf5bcfb41cb3f9769cb72bdaee84f8ed325cd7

SHA512
5fa918e41fb1273b69c7de2ac83c4bc86b0b21895c4e7f0ecd6d9891218d6497df254ed62abd8295d13cc95396caa738c1346ed6b1e584e66d7c641e78d54935

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
8db9e4bc2ec7454b91451e6fddffa041

SHA1
2e7032c97de4d5498b1ad60d1489525db735a204

SHA256
971fdbba331a80817e37cf050488e84ddd0399beb6e28b8f97146ed1346c7360

SHA512
08d386d6a33920c8b71114af7ade2d1b36ac1b96dc48bc50e52b54a3e7ba591c555135419d41b7637ce4da3babecdd886a848250e06b7520143e6928c717e439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
342KB

MD5
001f64215181f793929ec0fa5ca8fd03

SHA1
995191eba1df62ace3e0c07968e4cf63c85b9b48

SHA256
8769883c2e3126d19678a0da8b05e91fd7c06b8333a324a844e7f9a12e42c344

SHA512
959ea2806085573c00ba9c582f95184f8782e35b875c3b03a617dceea4ae08340076b0956b753a54604d3c52236af0f339df656a0a3b05e9cf9e0348a310607c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
342KB

MD5
da7aaebab48c77d5831940f530057e75

SHA1
ecf99dec7bb13f3f838d7bb6da7718c13cec07e5

SHA256
abe081559fb94e38e5c7b091d2a744320b137bc3b4e4903c9def253dd188f2cc

SHA512
133a0e1d5c61b7e81d6ca8c27a4866f6005fff0475942e10d65b91ed2f1077bed4c01babc3d8cd627cee56b3b80aa80d2ef436747f0be11ac7a0bb07b2e47673

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
77KB

MD5
d694b5be82e0b2c296fa0b1ab26085ea

SHA1
643f8c30a7e7c44d6fb72d26c6009616e25fc4a6

SHA256
77319a4472386cec6985fb8eae12fea86b903f478d10fee2a37864dec7d0bdf1

SHA512
676c2130c14290e9da55828a69b143e0e948f462a5110e58903ca62e65320f1e0aff64f4d4f6e274a5be5243efb24990dc6ba5c81ad839b021510d2b9351f797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
75KB

MD5
bba1d932885520d5f543520bf80d1c42

SHA1
602c81d4f327526369f9aaa060b6e65f691c0af1

SHA256
432aed90f0686cb7d1ecc65cd01786f6dfd386972a877a5dcf7505c584d04d4e

SHA512
c609de5f3d086103ef3735477300ac476be51759577861ca43c07f42a3e1f1a9b293992e2df7e5a97f8e13eefb125ea053f52f31d83fa9c07a97ffc6523075cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8326.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8339.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.5MB

MD5
bfbd6cc26087166af3a64398260ead58

SHA1
c50f08bffce2a709dee9af3ae6b96bb482abd4f9

SHA256
95c5f519a5f729ec1205f9f1c69b3e370e468ed5d1c7675502a9c9ef227509c9

SHA512
c23683291b4b0e0f555fd715ba6e685faa5a952df95c70df69010e2f6c9f0fd7f593f030fab068207ff97583e049b52674e85bd41fc5901f817b4ec080d945e3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dea668d45836b3847a3ee2be79c662a7

SHA1
11201f2903ca7235c01df4f6caeca64703b62162

SHA256
d40cb9ba13b7a1d99bd03554e97dc1ee22404be1a75e49abbf9a4c4dc9430821

SHA512
24af6cc809cd47bc8d4eee5a1649008f8a7a380541cf994791d4a2df359f3324f808a2609af84a59b37904bc1199e3816edf740105096e27141b6d18d943e2a9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05986c24bb55c0351588ada76a2be860

SHA1
50962946b494a73b58df123c1de81f9eb8598fa9

SHA256
5deb5f795b8030e007c5bb102961ad16d6ddb722bd76668d4465db8863860428

SHA512
3cff13e10dcadab581d9102d6bdbafc5be747fb4246afb657bb7d7c599fb5017a560fcee834acb530f7420f3a1bfe30d5df69a22b267c94586517a737d1d7dcb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a769a2b7987f2ef8bfdd06737513f9e9

SHA1
0a29cd44760333964929b287ee98697ac3253a96

SHA256
ff2d47f4090f304ce499a28f81aa666d954a49192070f2e7cbd0636ffa6a54a5

SHA512
9de0271f35439f579cd0dcfabd78192d5493c0318b61dae69a329f3d425da87d72e56793aff1d03bc04507ff651c1e1d80d1564a76be193f76481e44ee6e19cf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f47fcbc774e092e099a173b27db3f1a

SHA1
4f48e4f16ad3bff45b776e8b48ad446de2d3a32a

SHA256
400e6a60ce5da5621d0bec59c8379b5b732d6a76772f6afc3e0716595e8d5953

SHA512
e41a7d720dd9109350328902a94a05b909ea6119c7c08fa4e6fc87a9eebe95bed0b4144c29cd5ce21f57552baaccd83f73bda558431be0c173dd5aaa741cb2d4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f8bcd45dde4184460ce1abd30bfdecc

SHA1
efdde7d549031f2c8801c2024e40ee6c9a37bfea

SHA256
99d1e762cd2c798c83e6cf4a708b632c58a23922b424e8c301fcf5fe2ef56e10

SHA512
f8b1841e2874dd478bc7aa62753b55d51346a986ae3b147a3cfc49de90b78ad1aba63dfa2f8281f314da7d3941fb7cae6cd1ba1ee20a1f04507db1bd637ce35f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5850a015e561eef291963db550e09a49

SHA1
c6e8bb7e7ca75626f0064db90711696e9ef7f572

SHA256
44e5ec69954c7ad341266b9812c6835c325fea8c98056596af4f9eccf10e75c4

SHA512
174216a2dd6a74527b1e03f7f6a3aaa373847cf25e451b2ed7a1de6ba4085625b61f8549a9a71d0294196b8f4eb9e18c4a3495a7e73f08385dda24d5fad16229

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eac62fa5b548ef31b19587e2e6e22bea

SHA1
891d020326884486a19128e67a2812052b681daa

SHA256
bf6a5536d65ab182ae614ca21cec3ea58197b9c755cfd8183de77dfc156d0198

SHA512
fe7e188decce24cfe702d835b52ce9c80d1997ff093a7b38ed07ea943c5702c8b641443dc57db4aa4578945a3f92046ba75cb2be30adfdf7fee443d25483e155

Download Submit
\Program Files (x86)\Microsoft\Temp\EU6365.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.5MB

MD5
fec78f1ab5646cbc24229181de0c504d

SHA1
571db81600725ca17cf8763752103423c0ed09ae

SHA256
0ea5b6fba50d2a05704486398ece6ecee7a859a69e021b21cfd0dc08f4d39f6c

SHA512
4d4601c191d16f7cf18d073a7ce425aa52998b4316ca916cbb36d6ea9e8758a03697b2e4111da08dc63022e6af5353a885deb3e3226e26af27e1df7effb7102c

Download Submit
\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
memory/1528-2030-0x0000000000B40000-0x0000000000B75000-memory.dmp

Filesize
212KB

Download
memory/1528-3077-0x0000000000B40000-0x0000000000B75000-memory.dmp

Filesize
212KB

Download
memory/1604-5662-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download
memory/1604-5209-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download
memory/1604-5210-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download
memory/1944-5629-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download
memory/1944-5590-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download
memory/1944-5287-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download
memory/1944-5506-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download
memory/1944-5421-0x00000000746F0000-0x0000000074916000-memory.dmp

Filesize
2.1MB

Download