hxxps://filedm[.]com/KA1rz

Resubmissions

12-01-2025 02:31

250112-cz861strck 8

Analysis

max time kernel
1366s
max time network
1366s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filedm.com/KA1rz

Score

8^/10

microsoft discovery evasion persistence phishing privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Delta V3.61 b_64913384.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 32 IoCs

pid	Process
3820	Delta V3.61 b_64913384.exe
3928	RobloxPlayerInstaller.exe
3964	MicrosoftEdgeWebview2Setup.exe
3468	MicrosoftEdgeUpdate.exe
2688	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
3796	MicrosoftEdgeUpdateComRegisterShell64.exe
3820	MicrosoftEdgeUpdateComRegisterShell64.exe
2256	MicrosoftEdgeUpdateComRegisterShell64.exe
3252	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
540	MicrosoftEdgeUpdate.exe
1564	MicrosoftEdgeUpdate.exe
5244	MicrosoftEdge_X64_131.0.2903.112.exe
5324	setup.exe
5344	setup.exe
6068	MicrosoftEdgeUpdate.exe
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
4716	MicrosoftEdgeUpdate.exe
3016	MicrosoftEdgeUpdate.exe
2772	MicrosoftEdgeUpdateSetup_X86_1.3.195.43.exe
3316	MicrosoftEdgeUpdate.exe
5840	MicrosoftEdgeUpdate.exe
1728	MicrosoftEdgeUpdate.exe
1840	MicrosoftEdgeUpdate.exe
5976	MicrosoftEdgeUpdateComRegisterShell64.exe
5568	MicrosoftEdgeUpdateComRegisterShell64.exe
5312	MicrosoftEdgeUpdateComRegisterShell64.exe
4084	MicrosoftEdgeUpdate.exe

Loads dropped DLL 35 IoCs

pid	Process
3468	MicrosoftEdgeUpdate.exe
2688	MicrosoftEdgeUpdate.exe
400	MicrosoftEdgeUpdate.exe
3796	MicrosoftEdgeUpdateComRegisterShell64.exe
400	MicrosoftEdgeUpdate.exe
3820	MicrosoftEdgeUpdateComRegisterShell64.exe
400	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdateComRegisterShell64.exe
400	MicrosoftEdgeUpdate.exe
3252	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
540	MicrosoftEdgeUpdate.exe
540	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
1564	MicrosoftEdgeUpdate.exe
6068	MicrosoftEdgeUpdate.exe
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
4716	MicrosoftEdgeUpdate.exe
3016	MicrosoftEdgeUpdate.exe
3016	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdate.exe
3316	MicrosoftEdgeUpdate.exe
5840	MicrosoftEdgeUpdate.exe
1728	MicrosoftEdgeUpdate.exe
1840	MicrosoftEdgeUpdate.exe
5976	MicrosoftEdgeUpdateComRegisterShell64.exe
1840	MicrosoftEdgeUpdate.exe
5568	MicrosoftEdgeUpdateComRegisterShell64.exe
1840	MicrosoftEdgeUpdate.exe
5312	MicrosoftEdgeUpdateComRegisterShell64.exe
1840	MicrosoftEdgeUpdate.exe
4084	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 20 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\shaders\shaders_vulkan_desktop.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\DeveloperStorybook\Folder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\PlatformContent\pc\textures\water\normal_22.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\Balthazar-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\oneauth.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\DevConsole\Search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\MaterialGenerator\Materials\Mud.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\Debugger\Breakpoints\client.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\AmaticSC-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\MenuBar\icon_minimize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\Vehicle\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\avatar\compositing\CompositExtraSlot3.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\meshPartFallback.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\StartPage\Avatar.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\PluginManagement\unchecked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\vcruntime140.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\GameSettings\DottedBorder_Square.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\MaterialGenerator\Materials\DiamondPlate.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\BHO\ie_to_edge_bho.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\BuilderSans-ExtraBold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6950.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\msedge.exe	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\dialog_purpose_shop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\families\HighwayGothic.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\LuaChat\icons\ic-unpin-20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\avatar\heads\headD.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VR\buttonSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\LuaApp\graphic\Auth\vn_agebadge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\btn_newBlue.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\particles\explosion01_smoke_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ControlsEmulator\GenericController_Light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\LuaApp\graphic\Auth\builderman.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\webview2_integration.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\NotoSansDevanagariUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6950.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6950.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\fonts\LuckiestGuy-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\sky\sun.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\particles\fire_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\R15Migrator\Icon_AdapterPaneTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\content\textures\StudioSharedUI\images.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	1840	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delta V3.61 b_64913384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6068	MicrosoftEdgeUpdate.exe
3316	MicrosoftEdgeUpdate.exe
4084	MicrosoftEdgeUpdate.exe
3252	MicrosoftEdgeUpdate.exe
1564	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133811227361948939"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0B482A5-71D4-4395-857C-1F3B57FB8809}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
2868	NOTEPAD.EXE
1608	NOTEPAD.EXE
5100	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
3928	RobloxPlayerInstaller.exe
3928	RobloxPlayerInstaller.exe
3468	MicrosoftEdgeUpdate.exe
3468	MicrosoftEdgeUpdate.exe
3468	MicrosoftEdgeUpdate.exe
3468	MicrosoftEdgeUpdate.exe
3468	MicrosoftEdgeUpdate.exe
3468	MicrosoftEdgeUpdate.exe
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe
4716	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdate.exe
3016	MicrosoftEdgeUpdate.exe
3016	MicrosoftEdgeUpdate.exe
5840	MicrosoftEdgeUpdate.exe
5840	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3820	Delta V3.61 b_64913384.exe
3820	Delta V3.61 b_64913384.exe
3820	Delta V3.61 b_64913384.exe
1752	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4312	chrome.exe
3588	chrome.exe
3588	chrome.exe
3388	chrome.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
3580	RobloxPlayerBeta.exe
5244	RobloxPlayerBeta.exe
5212	RobloxPlayerBeta.exe
3772	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3416	3588	chrome.exe	83
PID 3588 wrote to memory of 3416	3588	chrome.exe	83
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 4500	3588	chrome.exe	84
PID 3588 wrote to memory of 3944	3588	chrome.exe	85
PID 3588 wrote to memory of 3944	3588	chrome.exe	85
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86
PID 3588 wrote to memory of 772	3588	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filedm.com/KA1rz
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce88bcc40,0x7ffce88bcc4c,0x7ffce88bcc58
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1592,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1580 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3832,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4412,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4016,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4640,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1476,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5328,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=724,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5568,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5372,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5264,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5668,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5260,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5632,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5380,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5844,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5232,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5736,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6064,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5812,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1448 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6156,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6016,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6512,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6152,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6824,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6324,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6100,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6436,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6036,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6464,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6192,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5848,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=5748,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6520,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=6676,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=5720,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=5888,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5692,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=6756,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6596,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6108,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6004,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7196,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7476,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=7296,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7584 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7268,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=7076,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6172,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6764,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6148,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=7096,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:rxFm8IgE8SKBl-WNENZuCIq2tN5BtvDeD4jaz3aW2jTCztayGIsqQgkSILuV4sJBmPn3ffybAiHnjnQBfus6aiSX0hoFoTHPQKX8R99d4Ah3ctvy50Tv42BZ1qZ4ZCmU9n5opOqTVBOt1doOmwKapqqBYNAapzEfRbbYpy_1t710FHzqxz1FOnPXHE4murq6gswCEFueO4GWz12BAvMHU6RmbVICkfkrTpMPjsr5QQA+launchtime:1736650047861+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1736649887793002%26placeId%3D16116270224%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D188d082d-f86d-41bf-815a-95680ceea2b0%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1736649887793002+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=7820,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=6636,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=7100,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=7552,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=6784,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=7360,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=7408,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=7080,i,3386650343096925853,884133308274499639,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5612

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5096

C:\Users\Admin\Downloads\Delta V3.61 b_64913384.exe
"C:\Users\Admin\Downloads\Delta V3.61 b_64913384.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3820
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2868

C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe
"C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5024
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\delta_core\error_logs\ERROR_LOG_9274568.2822.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1608

C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe
"C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1840
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\delta_core\error_logs\ERROR_LOG_10085868.4168.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 2296
  2⤵
  - Program crash
  PID:2220

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3928
- C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
  MicrosoftEdgeWebview2Setup.exe /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3964
- - C:\Program Files (x86)\Microsoft\Temp\EU6950.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU6950.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3468
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2688
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:400
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3796
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2256
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUU2RUM1N0EtNTc4Qy00OUVBLThFRkQtQTA1QjJENzFCQzhFfSIgdXNlcmlkPSJ7RDQ3QzExNjUtNUY4Qi00RTg4LTkzQjktMUJFQTY4MkE1QjA5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyOEM3RkQ4MS04MDc1LTQ2QzMtOUY0My1FQ0U1NzlFNkFGMjF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDQ4NzgwMzcwNSIgaW5zdGFsbF90aW1lX21zPSI0MzYiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3252
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{5E6EC57A-578C-49EA-8EFD-A05B2D71BC8E}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3808
- C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3928
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3580

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:540
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUU2RUM1N0EtNTc4Qy00OUVBLThFRkQtQTA1QjJENzFCQzhFfSIgdXNlcmlkPSJ7RDQ3QzExNjUtNUY4Qi00RTg4LTkzQjktMUJFQTY4MkE1QjA5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBQUU5MzY5NC01NEQ0LTQxQkQtOTc4QS0wREE5MTgyNjQ1RUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDQ5MTIyMzY0OCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1564
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\MicrosoftEdge_X64_131.0.2903.112.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:5244
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\EDGEMITMP_11422.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\EDGEMITMP_11422.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5324
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\EDGEMITMP_11422.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\EDGEMITMP_11422.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.205 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D02BBAEE-A33E-4731-8F36-43998AEAFD64}\EDGEMITMP_11422.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.112 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff636a82918,0x7ff636a82924,0x7ff636a82930
      4⤵
      Executes dropped EXE
      PID:5344
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUU2RUM1N0EtNTc4Qy00OUVBLThFRkQtQTA1QjJENzFCQzhFfSIgdXNlcmlkPSJ7RDQ3QzExNjUtNUY4Qi00RTg4LTkzQjktMUJFQTY4MkE1QjA5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1REU4RkJGNS00M0UzLTQ2OEQtQkE4Ri1ERDM0Q0UwMDc2NTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy4xMTIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0NTA2NTAzNTQwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQ1MDY1NTM2OTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDc3NjE2MzU5MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2Q5Y2Q5M2MtMWQ1ZS00NDliLTlhZDctZjFlOGQ2YjkwNTA5P1AxPTE3MzcyNTQ5MTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9U1cyZ3lKcFdzZ3c4R0NZM2hiSUx5dzJVeVFOS3BRSFU5JTJidWZ0NVAydFRGNWxQRVd0bXhBTWFWc1VjWGdGRlZvUEkzTGUyZ05jVWNnbXJObXg5QUN2ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Njg3MDk3NiIgdG90YWw9IjE3Njg3MDk3NiIgZG93bmxvYWRfdGltZV9tcz0iMjA1NDIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDc3NjMwMzYwNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0NzkwMTgzNjkwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNTQwMDk3MzQ3MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk3OSIgZG93bmxvYWRfdGltZV9tcz0iMjY5NjciIGRvd25sb2FkZWQ9IjE3Njg3MDk3NiIgdG90YWw9IjE3Njg3MDk3NiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjEwNjMiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6068

C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:5212

C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-37cf60402a5648b4\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1840 -ip 1840
1⤵
PID:5140

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4716

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3016
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9CD12A59-70A3-4567-96D7-373D6E2A3581}\MicrosoftEdgeUpdateSetup_X86_1.3.195.43.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9CD12A59-70A3-4567-96D7-373D6E2A3581}\MicrosoftEdgeUpdateSetup_X86_1.3.195.43.exe" /update /sessionid "{A994BF23-2BAA-43F0-A710-57F434BAF274}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772
- - C:\Program Files (x86)\Microsoft\Temp\EUF56B.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUF56B.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{A994BF23-2BAA-43F0-A710-57F434BAF274}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5840
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1728
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1840
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5312
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk5NEJGMjMtMkJBQS00M0YwLUE3MTAtNTdGNDM0QkFGMjc0fSIgdXNlcmlkPSJ7RDQ3QzExNjUtNUY4Qi00RTg4LTkzQjktMUJFQTY4MkE1QjA5fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MzYyRTE2ODAtRUZEOC00OTZFLUE2MUEtODI1NzVEN0ZGQzc1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjQzIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM2NjUwMTE0Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxODEyMjY3NzQ1MiIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4084
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTk5NEJGMjMtMkJBQS00M0YwLUE3MTAtNTdGNDM0QkFGMjc0fSIgdXNlcmlkPSJ7RDQ3QzExNjUtNUY4Qi00RTg4LTkzQjktMUJFQTY4MkE1QjA5fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEQUFCNkZDMC02REM3LTQwOTEtQjIyNy0wMjQyNjAwQzgzRDJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuNDMiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzY2NzQyNzY2OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzY2NzU4MzgzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTgxMDc1NzQyMDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yMDdlODAzNS05OWJlLTQ1ZDItYjJhYS0xODVmNjcwOWM0MDM_UDE9MTczNzI1NTIzMyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1VeVpTZzBPS2E4MTdPYjhFVU5XZnN6NUhJMVRqRyUyZlRLN3AlMmY3SDZCV0JLd2FEZEFtVHFnYjYzMHklMmZvWGFNaU0wQWdzZlhzT28lMmJGbnVrNEFiSFhBZFBBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTgxMDc1NzQyMDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzIwN2U4MDM1LTk5YmUtNDVkMi1iMmFhLTE4NWY2NzA5YzQwMz9QMT0xNzM3MjU1MjMzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVV5WlNnME9LYTgxN09iOEVVTldmc3o1SEkxVGpHJTJmVEs3cCUyZjdINkJXQkt3YURkQW1UcWdiNjMweSUyZm9YYU1pTTBBZ3NmWHNPbyUyYkZudWs0QWJIWEFkUEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjU0MzQ0IiB0b3RhbD0iMTY1NDM0NCIgZG93bmxvYWRfdGltZV9tcz0iMzk3MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTgxMDc3MzA0NzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTgxMTI5NzY4OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzcyNzY5Njk0MzE0OTc5MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMxLjAuMjkwMy4xMTIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjU4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0FGMTk4MTdDLUU4REYtNEIwOC05QTFFLTA4N0RFRDdBQUU5RX0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Installer\setup.exe

Filesize
6.6MB

MD5
f0dc48bc6e1b1a2b0b15c769d4c01835

SHA1
66c1ba4912ae18b18e2ae33830a6ba0939bb9ef1

SHA256
7ada85f31a3b501eaecd2aa37b8df1f74b470b355279b5db2d1fbc0bb7de4889

SHA512
d2ceeaf987446f7463e84a6286dc1c8f50a80466af641f77d174826189ff5a56b048e616ad8d97ddb12a2f68e182af80309be717367224605c06dcf74a84cc0f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.43\MicrosoftEdgeUpdateSetup_X86_1.3.195.43.exe

Filesize
1.6MB

MD5
83f7907f5d4dc316bd1f0f659bb73d52

SHA1
6fc1ac577f127d231b2a6bf5630e852be5192cf2

SHA256
dac76ce6445baeae894875c114c76f95507539cb32a581f152b6f4ed4ff43819

SHA512
a57059ef5d66d3c5260c725cae02012cf763268bd060fa6bc3064aedff9275d5d1628ff8138261f474136ab11724e9f951a5fdd3759f91476336903eb3b53224

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.2MB

MD5
673f7c90ed7046c1403b3ef6d77a706c

SHA1
e559e39d49b5bfb9c20285dde82159f61fc5a65f

SHA256
bbdf25dee8c741b498e59f8588e2a64c73b012d632b033a5e7c74290f12d3a34

SHA512
441ad8f5169d04f1414e7e8f91d5a894258efd09c115c7bef6eac6b2c07f7dc3323ad6e69400b5c2efac776a1d1b5bce1884471f4d5ebbc65e131a2fa55fada2

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
c70cf279d48d0eb584750994ebccb137

SHA1
800a401bbd4b27280aee3454bc6c50d6c9ab57a3

SHA256
3b113076c1b72aabe0d48f3d17a4128751a322008862197672148abbb34abd1f

SHA512
b1d71219d5c37e4746a80de3ede9f12058f8c27e4193f887a0cfc6896c36cdb05639238a83caba78f1d0fa559979f6eb4d9f87e40bf2a16fcc17098637d437ac

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
61KB

MD5
650dfa6b2aca6f0e9d76631415f004b0

SHA1
76e100274e897374f0195212c44fc029b884948f

SHA256
80e197582449e08864f4d95c02a8af0c81dc5998ea11b832c7f461a164aa2e1f

SHA512
dd5ac3435413a3f3e9cf77edcdf1ddf585675b9be4facf69beb08319327f302bb4256e570f692d0555a32784b057825cefd3e47bae8bdd5b4737b5b8e4b34392

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
6adcd808d1a2a6f9ebac5f805cd220cf

SHA1
0f0e1fea371ce8cbc6cf270c6863f9dcd546e4e5

SHA256
3bed64a9bfe94bc32d7519e6ab1132f4bba27029407c0d710aea073b92b4eb26

SHA512
bb11c7df6fcd3f7a66c3a5c9445084e386e0db6579c5d2b4480f6381e8f41b945279e4c9b2753c134834e5c25663ad6368b3af41ca9a018d7713fd184cafc48d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65f0882a-4227-4ddc-b9e2-fe974df491e9.tmp

Filesize
11KB

MD5
ef85288adf99418358d1d092334f17fb

SHA1
54a57516f47bfde3aa3617429ec98ae524617834

SHA256
58db6052fb0b4049116efa424f00c01a50ccabe9cbe1099cdc580c8a1f267d81

SHA512
e2108bb7820ca0027bb513bf0775c7b96ddbb73a7326b40adeabb10fad4dd6e380519e26a186b0b1b2d12623e0c7419e016b18a2ff7a17d76328cd2447e1d04c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9b353e812e2050dff88c6777ad34cc97

SHA1
88ce11d94d190606dab72d61fc7f15f5fb11f5b4

SHA256
d19dfb147b0a68ababfb3948a4ead2d626f778b1744aa889521a97d3f55241e5

SHA512
e68f9100edec186e4f85622e7ea3265acabddb8dd6648c746dce58d3618545a5e22490024a5eccfcdd531a30e72e89aaf7e7d1841db0b3f3d06c99ef60262025

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a

Filesize
33KB

MD5
68eae8ae528b3cf4965c780505e8274b

SHA1
23eea22c5ced491f0933dbdc428503548ae48636

SHA256
5c677af2d6e78de58c66b09577213d4b1c23cf0409822378053f1c457ff465aa

SHA512
7fb225df90deaeff597ea4513985545b5ca6d3b4478dbe5969554f15ff4b2c1652c6220b970304884adfc2860be045599130534f1c45586a7adcfb29a8e72ac7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c

Filesize
50KB

MD5
b904fcdf1c4c6059fadd6893a7bc7619

SHA1
f41d1674f02616f03ef77d4e84b3ad8ba28a36fc

SHA256
517edd119c5b2719e6ac4b30bf1fd864a6395179a41d273c0afc0696e7495d8e

SHA512
1d86e3c2e83265db1e9b244b749dce0bf39944302ca01ff3123aa5f1cf2cf562774ba344b9d4b2c65da33126ab0a5d80e37d448a794dce7f9f797f9544938503

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d8

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000191

Filesize
20KB

MD5
f92ec8f4044bb8a416e05e255b7e0b6f

SHA1
d33dba53f960cd40b87a6159b0daae2a4475a638

SHA256
87913cddf943d3eba9140536ce406ec3abf4f637b417c05a973cc096b9929346

SHA512
4a1735c357944712e8187580950884834842b50b0bf323305de397823cbccb74cf57e371da6a542bede6cfd60f9328e89630093a22aeed6c07dd2dcc63fb7a66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001a5

Filesize
241KB

MD5
934897ea9fad777de7a67f672c83bd1d

SHA1
5c6b7a8097eb792627630415958d74eef2f0c82e

SHA256
3ca4d4e7f1c7b15b1cb384f4f906e6c8e7e06c0fba94c4d1bb9c432e5e3fb081

SHA512
392884619ccf9c71e0413ca5e5ecadf13c799ded7d2f2d58e7e4cf960c116562445fb501d5f57528895e95cd41e1d7a28173d8994cebf2c6d19505543d0cb991

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001a6

Filesize
32KB

MD5
2e287eb418940084b921590c6e672c9e

SHA1
1fc75a9daa054ef88aaea181f3a9b4cba2b6b6e1

SHA256
6c2c58daae76131a00d1bfee20852f372cf594be7f4a8848acc42f8bf72c1bbd

SHA512
a77f69571b0f04f4a2354d9e18e41ef86f22274eaed20c02215b632bfef09c6543a83591e9db3f2b4036a9684bff666eb6a7b253ba18893500e9cd541ab752a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
17355526d286171ee9aae5ee8033e5a8

SHA1
79de6b260addf940a7d9c38d6dd8663d1e411e58

SHA256
39ec7731023503b1c79ae312be8e818d9c14221d790151728f6a5ee240777086

SHA512
fc55409071dbc17d9e0aa676d6fa9f42515dffedb4339f556264ab33aa5bc576faf525638a370c1973f4243c610b36f3b3662666c8df6091266b45cddf89d29b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
29abcccd03e6b717f902b94e58d8ebbc

SHA1
48c5f8f56ef21e7afce283c9a9ed9453af71a533

SHA256
c2ac0557141784e8332a7b7428e928fec2e719b8840d189c44f2adbf37191790

SHA512
4115668bdaa934c6264a02889f474fad08aca8a1289843929755d9d391c04902fe1a82733c718c952cc908d9a3e485858a6624e74003863d7c31a5944006c6ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
d9d89ec825b8eb179c85c940dd64e3f3

SHA1
056d3c60c00235a40df040c4ebad648864fcb2d9

SHA256
e2d99a20e55911397427800b962aa0198ab834e8e6f21ab4b4503fc18d0efffd

SHA512
fffc7a3366841d0a001c8eda9615324dcc5a958f1529564d904a7fe30f3495d384a076c4640b6ee3c1de39e44b51c1374134b929c924641b3a253a31d31e4476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0c7a82a62e3377b56d0fb9c36df9048d

SHA1
60050a6ba206a7dc686f2bd9cfac38edad7314a2

SHA256
03a4b00cdb6141e5122ad243ea8518df854ba374e8d9a6c7ea524b3886614d28

SHA512
8364530db4a9001a942c695c66b6aa5769ee1d5c7b2fa69768550bb5884632c0231ffe0863d14ae56b8cf941a6b4e5cfa7a3778fe6d2c79ddfdac5dab35cb20c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
01ea27857878449bb5e030b43efbfbd6

SHA1
826349c122c40ceb6ecb7f6d583ae46c912cc00b

SHA256
3c9979ea8a1f1c95469c7461c6c0b2808dbc5c6eb24469baf7a2e805f8432989

SHA512
5809313c03734742b4fb38e506bc2985813ec46e5cf079ec4fce1002ca6e401de0739fcd6f2693b167f2126fb505927a5972a0e895054d7c5e495c1fd7ab1b86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
652bce7472bb4258ddd910f5b83754ba

SHA1
319c8ec426b31d39edc6dafe3d644304c44da088

SHA256
f7c5fbd0ee5eea7fe46c57cc0006508b9922e8f129cc58f4326ee6b8511982f3

SHA512
22b7ef394bbb63f9e5c7bdfc888d6955d39c4cbd1784affeae308583ea3f3994f5c9f2c65109a4671b50f188346969f93377c805b1699a9b556418e38af47800

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
9b5396cd809b97ab9a33c7cb1f74a255

SHA1
c2c74090061be18f23587a90f13393ef774781ee

SHA256
8233b8c3f3b050f5560c2281ca9a694b1ea9a6a32f982b9882ba312cbffbcd31

SHA512
3205d3a1b48ffe545dc46cbd679b19b9b3f0042369749d80c5b70357c9b63bf7fd867cddba9ce7b559d4b7c80b2b460c3c9579b1d1098843a0f7b02e89d763c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
b51846d8e8c4daeeb30f4ad83dbed5f6

SHA1
f867954abf7edbbb351e558cfefb9f187cdbf52d

SHA256
4fbffac0c5d986c1271bbcc087bd7d5b7515effc15519ebe31a8361d997883d3

SHA512
bc19988005a9cf025b3ec8cc8a8e6a694946afde838ff9a870546de01690eb118395854e8cd19f9d24b80033858e34963bede1b92267c2c65088743dd4ee7f41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1dec8516894f39c7d74f1da906139533

SHA1
83a0fc69820d20dac4f0b6b6a719607d0c94db42

SHA256
71612a31239e4e1f715a1e1a4d91b5e85bd435e9009ae101a16b2846c373d65a

SHA512
ef4abd501215fc7207659d183ddfa6534fd7f60935dca511096241b4e902a97375e8af256e23621ce741f51671260aef4480525357576c5b56cf81c1b09d95c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5e2396e462a23672663267b5da73b6df

SHA1
88b4275710c4e321e326af9c8287ffd37f0ddd01

SHA256
08aebbff0b3ddb0cf32b3d1a4479e0494459ad80266ac248f512cea36f7dc21d

SHA512
7a30eebdb06677302bfbd5af35fa8f2ef35abcf9bc4328d6fe35851bc7de99f2df13f010e62ab4cfea12e011254cd80463324202d595c67c336cfd7ec190be3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
f9c8731d8cc9d757db93c8cf6edf30f8

SHA1
ad7d903cebcf7192b40fd405b0f11465a3eef6d3

SHA256
58e7bb13a8fc16057b319d520689250f4217c221c29ca7e5e16eb060395775a1

SHA512
61bcf82cde3a2aaef3811d0ee669ae8c6f257ca690a03701316f7472ae610372f6a560e7bfa576714fc6f3c4839fe67d8318a2c32cdfbcd714f0a48423cc5f16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe655d5e.TMP

Filesize
669B

MD5
d040f8010cd8a34d28ea1c1ce2359ff7

SHA1
291f0cb972a600701a6480db3c8016512b993c42

SHA256
4f9333752c015b6f6c41f2fd0e961a87372d3cf75a37f189a4c08292f46614dd

SHA512
664d9de7b39a4b2aa9383e71e7a83cf8c7b275d590c2cad0dbec86e14c6b3a9cb815adf52f5e7ebb402c01621700fdc718d27d9f36196ebdcbac27b481cf5ceb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
28dea9a5a4492fcd5011d08eb61c4542

SHA1
9f3fcb422f5b77f49fd093a9cca4882f7e5ad6c0

SHA256
d0ae48f70dea07ddc72cebfab98cf0613552750422affa3d157e7f66b702b5a4

SHA512
78a84ddee64d5cc2155202c7686b126d44dd4c5affcc939f992e0a39f55bbf577c05ace6df3ed4e28e7f05b3dd1c8712802442704465dd2674d58348b0ad1cd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\87821f06-92ae-4c07-8eca-bb068d33297f.tmp

Filesize
8KB

MD5
cbd67a10a1b2fca6e69b574252d444c0

SHA1
a8fd592c69fed7a08a3b7c26d720baa190e59b99

SHA256
d45ba12d17063a51993da73abf5187c485a31c1e3af1b617396769f2dd135a15

SHA512
565a898de99bd81e24f9caff2906aee1273a0fc333b7473b0e88e1e1cc99e65e237041f6b92566e10dd5776b41aec145ae44e9abe3c233da47ca72f5ef70c710

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
50072caab3e1026181c300a04712a8ea

SHA1
9c69db67a93767d7755842bda7801c32ae6fa803

SHA256
0c1ff4fd11628e803e45f5a928f156e057694470da196fe4f25cb5026b22a008

SHA512
44c190445dbc11284917181ca18e43bca17d8b773aa3e55da40ec54ed63730ba249c407091cbb1690f7f452809f53f3d4d94ee03d2cb1978d14c22116b01bd5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
957df409da79d7fd39ff1cb434afdde5

SHA1
179ed17851bb84d3dd8e8e47e8f7acf2d5e68860

SHA256
fefedd200e0be2877a97f7c5c35135b199b7795873d43485a669ee3bf1519e3d

SHA512
da50c1aa70ebe3448db7b9f0dd66a00e3192ac989bfd21c4d2fa412af3ef0346d35e3bc73bdf582e1312ea5aec042a0f48f8aa9f86874eb16f7a01e9a0b31506

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
16KB

MD5
4d75f9b265069477c12a7293ca091839

SHA1
4a6f70a3ee8bd744a848669d37a8f4c38a7ec545

SHA256
075c12f236d9284b2fa82ee47fa81ff31f597a08659191c3aacd76ef479a515e

SHA512
c7a89a31c2d5af2e2647f30eea92cc2915c7a27b50cf46622b4d6f85055c52dfc05d1b72025082f7c32041be452e7ace20b64776e9a3ea83cd1c8be8b8283a5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
d56bdddbb6ebf04bef4a59bd9a1ad576

SHA1
d50c0086ee90818908390fbecc5d8b06ae6924f0

SHA256
e54a5140553a8b7909e99e0a01e29c2d32fbd8ef74c3e5b3d40787f7d4be705e

SHA512
11ba81e619fdac01cbc763310525dd6282c3ba40d37e96fbadc4de17c56612501e38723abe386b82efd326061a9b90e04cea766377cf718aecb8d2600aa0a9c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
27KB

MD5
c4ea674c02af033d2e58cfc19a53192d

SHA1
dfa2c433b2003cff82079eae3133c69684c94f8c

SHA256
ec0dc758606ead7b922f6cd10dd2c4aca942aad52eed75d6e3449dc0a1e9264f

SHA512
6fb24bbad38166e992523836ac8ba0872b19b1571527d6dc5f62133bc8a10fc58e843e717d370a0f24c77914df2170dcc442fe2edd021a467905b00fb03d8597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
183efb43242fb198d36f793cab263e2d

SHA1
483d4d582b8c407fb1a8f4c849507ebfb46ed66c

SHA256
39b5355aa7891524ee2cc87c21da8cec36e935a3ca70e18a8b03cb49e01b9bb1

SHA512
8661ad7aa41d370e9eef615f6a9bf4fec0e3a8ffb780584de1a2cefd3ab102419ebc706cd648658975785ee9f5f249b05f06422e0b1f0aff455832877a0a379f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
28KB

MD5
48f67d20c5678c3abdcd4627fb6612bf

SHA1
685f048ce05ae6275acf551f2bac3f158a7af35d

SHA256
79443216fdceb09797a47cdaf5e14ad90480bf977809298b5ce85d7efb9790dc

SHA512
71bd1bc5ee1c5aa89bdad2d5c562213673f00084438fa031e4b43a8aa75be426f07072b9d55af634c84469c51e66019d98a773a8406e4c0a0c72e895e8964de6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
f6decd394c9e0a1ac0cac0a14119e74f

SHA1
dce7fc406ce70b6a9cb4cb0ec25e7521584c5e2d

SHA256
25a4741a1c7aa08b64c22e2340dfc5ecac25488fc9bd9324b5d33dfe02484c9a

SHA512
f4627fbbe6f8babc2ed24725ddae8ff9f8ad364e931cf8c2bc1f1517289ab0fa3448c1f04c83063587429f1c54e2d0167cdabc30463df814c6576fc59108df83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
683B

MD5
8d175b8eb11d314b0759f597069351c8

SHA1
a55f1b3a8ad875ae2476a7d0a26c30134ff795bc

SHA256
1721bf6488e550cf75338331ca2b2faded082dc4f61d49376f65dc17c85f4a00

SHA512
56ad485f4d747084a8bea7e23b3605ffe75b96d2f6901ac95108d948e2679b88e659dcf8123ab05e95ffb9b19cdb4f86fafbfd4e2c31df4a7420667be8b64717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
683B

MD5
1b1a0b5e74b57f50d15bb687dd2daa38

SHA1
5823a470786bb8ac7b692906a3d4478619602b82

SHA256
7cd77e680ba8cf92c86f1113b223164cb781af250f4348b0d752c99b0de25205

SHA512
10c57695ecd9b80f10f0a94ad4aee608aa8c77f03f538cae84c3f3dfca888916f518b188310e4336d0afc94abdf4f43942a62084555bcb5e4a87df31f6001c61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
c6ca22b3b764442f197bddecdd91b893

SHA1
1ad3347ad2ad3bfcf68df9e243ef5122273c931e

SHA256
a7026991409c131a4e169583158cf3e4d8c33ca952fbf74f3f03f9b5ad4d0020

SHA512
48b85e0459c16715d1914fae5eca83284364029ba22c12d755b33dff80a3131c12c06ebc06e676d75a8e296c8aab436c03ccdadf18179b484b4071e728c7fbab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
1eb39c9ef2e9aa4d6ab976e419064d42

SHA1
bb6a70ae97b76dd224c3170f6e37ba122e3f7aee

SHA256
63ef459769034b7ddcb0f4bb36f67fae028e764f8b421af85f15f1428d07b2d2

SHA512
1e97f339ea89cc9a0c299bfaa0d19bfded0691bbeebceef1a27c01c226277fd56f41df1f09f84cca1c65ad68fda31a88b8d84b52636a9477d54562fcf9fe8e93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
509fce12f7d4fe69e2ab494fe05577ef

SHA1
f96c2c63966a3f34c60d2f371c016b51580029d8

SHA256
c3bd39cd774cb764ea38c12619821177dd637e10f529211f5439fbbe9ce24303

SHA512
a38390dc217450b7efe8ddec0a69522db091af92d2f4923ff0e143b4805108cc3b417977b6afae9752eedf83468b7337515639b67d45154e93b6ef05464cf591

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
f99a34a78818777f74c98c1ccb06f40a

SHA1
10c61c5148d48a42addf05d75870cbde2d7e4819

SHA256
ee2490f08fc9c810674f5c1f021ec1a15781d1df4ff4ed1637764062fa394473

SHA512
f664ab9b470a4db1817c0b114b7f2d493c76fe59256ec990d44d0be6bbee3e1c54584ddb2f6e362f64ea263617f89f748936030de79d8b006649bd2b01df9695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
efcf98e1c920558c2ac2c5fcc5fcc434

SHA1
e9a8ca36c5a3aa32b45c838a6b0953ff0f02e1f5

SHA256
ab50d10bcf45996240507d86da8065e02318af26b78a63eb49a27f9f43959b46

SHA512
21c4547edf55f9ca743d9fcf44845cc6d8b21f7f5a0a780103652e0d1d4525bec65676471e0dba3666f7ecf485cff9d5753ad4c5de13284cf197ad85b7e3a056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
2cb7edd803bd7c757f05b87d53641cc9

SHA1
caa9ed300bd2310253d0b711dd727a81121b7b4c

SHA256
dfe6e08709d0569c36e109fbaffe365088eee44d9101bc6849aa9513e6b399d7

SHA512
71f0a84453dc34dfc82717326e1b3f10fb29a88d01ac44a25acd76380e62efe81cf3fe0b7f31b3a88c33751e4b7111f178bb5cdd83910540c5b68ee730552f2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
286d73e5e7a2579c19b387b8cf361270

SHA1
dcf7a6b1c499698631210d368737f21cd0cef375

SHA256
3ca302d7085b9fb944c65a90144c2e93957e43c72198304e618ed66710c6b013

SHA512
68747da83aac11e7b61a92d1d6111e9e7d9ae9155577e1ce7e82bd8d5d0681bf25017e81f875f5bcbf0081ee99cddba87ed918b35f3818696d9de17a2d48e378

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
a59939598a587aefb35e764a48677601

SHA1
c6bb9b5f32e5b22d4493448e41d67a6a985923aa

SHA256
d46ac7c97969e805054bf4a7f0cad294830b21dc16035d14c532fe37931a5034

SHA512
967089bdaff9f97c52d7d8f62924e2a02b4c23dc0dc3f242c239b2c20f40cba42987386165f5207ed3280eac238361601e95c4f54c45d8c2f0b7531bae2dafe5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
fedf8c2abf857851fbe943f03675314e

SHA1
826696a177367766609aedfdce997f1b6929fca1

SHA256
1c3d3d4245e93c97bea8a3c800868e2e5a603c029148651f213839381e05dbe0

SHA512
dbd9fe8907c31587e8aef9f233c71a32e41faedb23c8efbcc0e595d1d476c3d337fca9787e3bcaf981a5367e2c438c80b3e1b05f44813aa0a3e308398e0de7eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
336de8099f228b09361d5f4544969543

SHA1
23a8d636a7213a5e69e67320899a1b6c0c1d63d5

SHA256
550a34f6240bd63082a0dec86ed6b056c6dac46e6fc7f14eb39911a7d02b646e

SHA512
6e8722a84c3f19f45af0c93c501e0703b3842e14212873a834a40bcaaaa087b0c3cc37923d6106d52372afa25768f4ff42ea7b9b01442ac88590bd43a00786c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
22e0d5f0de3612baf547f2b8909eadcd

SHA1
51e9a054e988902f1392c9abf85d077d51d7aaa2

SHA256
67070a06d24855cf64eb18c90bc04d39f1b2a52aee255f72bd94df3df14248c2

SHA512
39e7b0879e0cd2282b60721fa47bab681418fb2d20587ea85f514da0afaed7353a575d4c22bdf17b67aa044a38bc9783d555f652180de3e872cd7f356b08c81f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
34fc64a24ae5e2c0bf298fd84739713f

SHA1
26c36c6a661f121282bd831a2039b35e9ecffe9e

SHA256
ac74feb0ac31fa339f091c25e6b6bf4fd9f8691aebd51cd3a9788b848772331c

SHA512
4be2d4406fa937ef3d9943c92457bf6f4d16a5e60fdc8fa999b3e4e7a5410c751cba9b9e61e799b9c118aa68d58d68fa9825031239d138b70edecf5869da21d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
857a83eb1c4b5d213b09f82df07a68b2

SHA1
016940b285fef49ff6b9a7174c4dc1d21ff0cab0

SHA256
7b5d6a0c67d5ad8a95e0d443e4c2af9efc01caab803eb916df820b8a982b9e2e

SHA512
9d721397f3c39ba839f2c0fb1fb0fd39b40075697c5eb63008169d4962179b2de3c9ccd82f06305b1271363cd085945d10b8c214a8e56fd778a69d3910232f5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
6893c48fe59da2166111c807d64be603

SHA1
5f88f17fe133010dad55818a7969729c056a9ec8

SHA256
77db8b3246c91279dea9fe03c1b16d01ca29979e360bbc90246b0d36bd5dc3f1

SHA512
46ba25000047ead001a83a8b405d158a00ee0dd93ce509912b84a928146097bef14348abb5c2044adee30f97b6c2cdf5cd9fdd354a45fdb1f45f55795bfd8d90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
2ddb4cc8a948a2f36e2591fe4729c312

SHA1
73bc3e94ff0877fa3d709d0af6dc46c2dc64b683

SHA256
20170f875f55d8eabdea90e5969c998b3a34adafde2d0afbd42851dafb175d84

SHA512
936e8ad88bff9c8f36f6ab507905f2b0ac3ef8e1fcaec76f76e435f67fa61c6719c3adabb737ef7b5d46b8e3a092a4eb75bb9243329ad9981a024f5345fbd53a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
72038e31c5d489cfd5421b1b46770bd9

SHA1
bfc78cf088e6bc1bf82fcfe374ee079907f9d982

SHA256
88aa8edccb1a9a465c5e1beddfa8dc18e7a1a3e57d6f3fdbda6224c791c46dc8

SHA512
16fcf8008c0d7dfce8a93155403eb121778571126386ec27623ff42fac92fc2bdbca85886aace8bcd9d3ec137b3869b3b3b06ed593b5c6cecd4dcaf8c42139f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
e7e8a4ab034de9347a08313c9bd78242

SHA1
98e6ae0a18e3a23ff671c5495c0188a06a893df5

SHA256
c0680f22a2215551f60cb964bc338459beac5630f1f094702dc7aea0bc8f2a28

SHA512
7688fd150d4205d04a008e487ff26beaf60ce3b7e9a5042d734f6a27c06aff862166faa2f9bdc876d2e5be8a3306b1c08bcd34011b9f26fda98517c1b79b311e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
50f1626172f8b54acd1a0bb2c94ff8c9

SHA1
baa9adde5c4ddd13fd39d46621e0707e56138bcf

SHA256
7768f4aa75f0e1c6d4bc288be16fb7563b9dab334c780d5455f2f0941c703b37

SHA512
dee784fffadab22f94e6e54043e0ca46627a5005022e300a3c356a2721bdbaeeb3704841ef27c89f93b987bf3a1fe2ce8eba3211802fc53fb9c7841de1bee11b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
170b4b40aa8e1b69f4bf4118a24a6ecd

SHA1
3e2b0b998752ff5475ca0cc586e5bba72a30e65b

SHA256
9dd1d6da5ff50c497bca48f617ee23809d29a4d1943f854053909df23a76bc1c

SHA512
0533f3c8c8de37cf80cead5d24df58982dda96cebeb85b03a9f01c2e704f389fef2ab351b05a556cd77f12ac42e8b6acb04a4b5ff31a2898e6bade55527704b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
69fbdc27e20da8a3fecc0c7fe8789d5c

SHA1
6d7bda010cfe6bcf15bcf67711a393f676649757

SHA256
6afdd91b28ebc001d27fa0a404f9bf684f7471e2a9d0f28a9bafe5f8f84ff4ef

SHA512
89e34eef5f6f32caf6f0a9b5d357e66e45877dfa0419802f51db68100c08fc9df456df92eeb1e5d9475be38c2a5b81a73aa2e8334af18173481ea011be3a9c1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
13980fa6a1e8cc2d7bbcb049f727947b

SHA1
5a2810fbb79d5f039ab1b49369f844d6877580a3

SHA256
11b9ddfac15095ec11196f3ad267fa75ccddd9b0b79e210303d2ed8a535a9ba2

SHA512
3e5c51e913d72c289c6233af0c5c74c17b335eecfb10938b75e2aa31d686180e393bdd26cd350f618045e66454b0f1308fb93a0fc19d9a3cde028822e37f1711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a68641be5c09b0c70a0e63013bb0607b

SHA1
75b71a36f958af2e4d370083b6cd63f7b833963d

SHA256
6bd6c967bc1a3b1f8d54fd2f3b750ed54024e1d3a3f85d94daf4e6d9c66d7059

SHA512
147b6a77d6ccb2c92030e6103c7f651a36d36a62147868c145a8b1f6946f7ec418773a5fd45c9f13aaeb7095d030f8bba59c307e9e36d20b0d4ac5c6d23967ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a810be913b1b533c28a15c0a05ee4b8e

SHA1
6e842e93e9b59222a757eb9d5a839986bab4d79c

SHA256
804ccefdca619f74418b2d9c0c167b1a42fef2da6de7d7948266180d903848d8

SHA512
cc496d7ad6228fb4ed41638531b02daaa90d740ca1f6c654c4852e44e3e6d1c6c2a2d97f3b7b23a1ed36864ed68f0f41aa43e66e92f2619834fba202f806ad2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b38468168703402054630083850734f6

SHA1
606724a3505704d5fed8da3554b4def762ad7043

SHA256
113bec45b6d3b30b37cbacf5ab25719f467231b2eed44e690f572d22c4956a15

SHA512
a98c6a48143f342f5a06816305c82ae55cab1f660f578e0f79c63b1728aa12d00ff032c4f68edfa990eb5d31b3e321bd6cf3129346db64947ddf98ff20a7010b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
417daaa96dc1d3dd5dfaa5ddf08db8c9

SHA1
4678e44571eeb90e46411cdf7d4bcdb63e278f24

SHA256
b433657625b86f74a21a3bae1b6dcb54d2524428c2480f5dd0deaf49346bd4d4

SHA512
32c285fbe403d5a2556cb3080223af1de00a8619e50448b5297a6e89fb820c2fb72619a3fa87be1aa114f68a2ca541fbcbe73518b8196e709701690298d70682

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
ed2940a1cccca1353dfbea525eae845e

SHA1
a5e36b817ece5b5d1090b3abb0fc86cf2ea1a0fe

SHA256
74a202618d8c40a6f8764affe3999a2c00140938d1b7ce44597aaeb9b56b44e2

SHA512
ea01cdd19234ac87fab18bfef86b927179e33040c9dabb429deb51cac50ed6ca9722ae0d4c59af8697cb02950635a57960d730454653dffbc2d33c218fd1a59c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
a81a465b2565e2e721ab6b6f2ac5b01f

SHA1
fc5887c04e9b8ec8e3471ae2244633bfc14c7171

SHA256
716e172f80c02e7453f519512af4104491eb1bcd416a3cd1613f8a9319ad546e

SHA512
ede4d0e9b64e307d2df5f27e0fca699f25c6e331c1660e79de33a4b0d32b8cb2b741403d7b9041349318d6040c7118ba3a5119616aec8f4fd3f8fff82b46481c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
fc74e516c8b425c63ee46d4f48a4ebe7

SHA1
38cf9b9a1b8836718493e520cf7f52c71a7d1d18

SHA256
0a1e30dae950b0bc8a78af25ce88f3047a1ad856f91c21a024323016267288f0

SHA512
c71a7feb49251460a45801817c9bb04e1f130d5165038fc1c29a4025450fcd9ad5cb331ffe1802097af22d9b7ea80fbc073982407eb10e6e4b818666c72f5502

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
793f3ef3e633bf3f7bfafc3773f8651a

SHA1
4e7d62329b1a7337297831b6dfe62d385ad2f5ac

SHA256
7f0f6b8e1f76f06c4f428aa5620272c14a6f80b58ed58c9b8b151784d4c03600

SHA512
43b915f59bb30a0928f737f89be632c19eaf6fa07ba5a0f7a44a67878103a7a145dd005c119f5a6f3a96530a64ec42b51fc04e0eac1aaf9ab112e2c1cff3fec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
2e822e475e873573c9748c31b8f3ba0e

SHA1
6f192cc5c72e734201880bfdbf54269688ff6fcb

SHA256
11b4f97a152f598c510f251810695370fc39224729511db93a36bf761ba0a2b7

SHA512
461654baf098981a06e333f1448453d4212773d09e4980c184312d954c1e9736a55ad8104b6db8e2ecfeb61c7fe40c3727e50ab308380fd88ca4d25c7d168ff9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
8eb80bd642ac4a33b59f3bba3db05fb7

SHA1
75fa27193cc6e92a2a6af21a89deb83cb839d17b

SHA256
445c58666edbc6e5b4ff6a600fbd0fc6beb274e35749c19a8f498635784a1b97

SHA512
a5a398d3f70f1b2706d2873df4809d6fae05fcaa919b0f0f89296e7ef31b1ff1f061553a664e47787f42e56fc361e2feed84f0b98f48c4f35fc14d8863015bd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
95a472f2b2d5183e8f1b74fd3547e5fd

SHA1
4d0d9d52190adb8cac3df843af9af1db1318a8f0

SHA256
3633af767e65045047fdb2e6c553ff6bf81e0a9636c09be30a4298ad1104f62f

SHA512
b739e89e28ec2f1f000a3f8812160ee58213761a4e7f54eeec0f1eab02c003d8bcd2deed3700c890e45d86b44d4871de324af6d762ecad4b4fe7730231f4f4e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
6a6ceb703639c8e8f3bdd085a7257b71

SHA1
93405b1194c7ff3ae419d46f201e98d2be4db362

SHA256
74d77dfaff8b6a9da048616dee8daf0df9fff609001562af7ab79f8314bb31f2

SHA512
ae384940cb0dc7c4bf608a9b6e4ad2879202593974786bf8b65c05b9762da5fae56d30c17fe91d51ed4848907aa843bb1ea9e53d7309ab591b2275c0f6d38259

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
e3eed3b4fe70fba22cbb8871f4e5124f

SHA1
25805e6c679d9fde14aa74d4962293416fc337d7

SHA256
0018e0b14029188f5e9208e36d9823c971b478a20fec85797ebdf4fd8f74b543

SHA512
75ba5b59f5ce10a1a0e79e111f883a5bfa67386ada78d2774559b4051618759ff8fbc5f04fa3993a45c5c72007904f69c472ee42c435206e4b77c483c6c203a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
7775a94b48051964659405b479875dea

SHA1
814323528558756d73047eef129addec8e27673a

SHA256
2519fd9e8e84edaa43a67064abdb04ce5d727ebfbb2d2fdf4c1463015929bd60

SHA512
7c8d1d04c562f372641187de516c62addbd6b474a05863a4699b7adee917c2006adfd34e9fa93207b5309bce5dc73c2d1b86acfeaa989f91248d7f7ede8771cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
15272e5e095f29033e258829da6dd622

SHA1
0161e6513864798e3f739b531c0d9d333835c750

SHA256
a5f0098a749005dc3e561255fa22927e88f318954af9e2ecb9adb2b933c2fb4a

SHA512
1849c21d0b50ddf5c7b0f96be41ebb7592619533b91151f9767ea9f956055cbce968414e2f4ce7a4bce98997e79d10f35acc281bb8a8105906386ea28449ea45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
794ea18f400ee1fa3233ae54f7e399cf

SHA1
0b027e7acad4f7654aa726b4222bf1b26124e083

SHA256
5e5968d8ba69d200e2f0d6b2dacd90fb499d34252246937dc334325db5e3eb44

SHA512
c4446c5d1bf42f3b048e16c20c63d6e48dd9647849841b75570905e37b8c2c52ddf1f943a546bc3e0db4a5603dc306e5987f5183fd25233b28e7e1e9686bf10f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
2ff33522637f638567fd181d120182e2

SHA1
bb54949f0d90709e9ca09d417c47308d6eaf071b

SHA256
142dbe3e0cc80e2d2df746e4c4cc6d9c28ea46a65fe82b333ca70febb2920b18

SHA512
d89cf5c380f0eca396cddf82c5e87b2b333c581724c66d2c325308c825e73bc8d9cc0f2f5e92a81fe22f620c354f66431133980b7e3a891b739eeaf9ab070757

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
ff517607d42ebe6aa6d4f4c782b89c32

SHA1
4f2aad62bbd70efffcd9f35f836ae9dd04f011f7

SHA256
1cdd9fd98b9990a96d1a91c7674af2100d85d6d5535105fff5a86271e9237d1b

SHA512
db346b747b5a11c788e3c6197fdb9705de5631d17c0e71fc7284cb3951bcc0567e0bbf7a9075ddb27bbe2a99bc9ad44fb173b669071aa9f0ca1879879201e18f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
43c10f10212bfed379034a93e5766162

SHA1
95c746920c87ca3c067c59d5e6d24982dfed7a12

SHA256
89e6a02b78ca5b794025b1106f1b3a39516ee29dcd0cce84d65c9d0582f85237

SHA512
3a0dd777590332dbccafe3b4a61e4c62a32222c3fa3761f660ab3636aeb25e11caf63a1bba84316e3768924279dad9dec4404e14237de8ab649d85921d3f50a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
02ebc4b19328e79482e24a5c9b0be2bc

SHA1
65ee40753d46d7a541d419ea74328105c8d29f43

SHA256
1cbed4397e4582aac5f81847e8a1b534885a9c747274290ded359874931724ff

SHA512
93387e7d83658f32045a57cc43554f8f85475c6d00d9b76f8bd1130b69158d84ee0bddc1c48dbb7952d141e4c54b17be4e8a53402c6155744672bd41097d1220

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
74eeb1f5da877eb7b6d6a48006b71901

SHA1
a279467db204289aa6844a6d8bfca767b33410f6

SHA256
42552b3d7e2e1a47163354f706741d2e3d79b155f058cfa186c64844f030d7c4

SHA512
f983e9545835d88e6208ee3d31c2a474575b87186fb165a7d14a1d9fd77bcbe118803155c903d3b24a3f43ce9b5a2353a3209dc8b432dbbc54ca4c7fa739620e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
1ec32cd3883a119fffd7dc2c60e5311c

SHA1
acd8a867a9568ab56873d3f88e5318342cc2227f

SHA256
784da4f58ac9cd47a3c07702798f5fe8f4c42de35599581054b657a1222a1a4b

SHA512
4b8a7bcf9ec144f5ff0eb7746b8a6665aefe1ff169223f1bdaee77a179cb0638000f8993c2964cc5e003302c605c76b0da256c5a4dfb2987ac50e46388189021

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
188769927bf64f6d86614695d5f6eda2

SHA1
252886eed1a0dcdf4f75244ca769a8a379a46a5e

SHA256
5f69f8946f5efbf1cd96e2c1e382b4815fadcd37961fe577b06fb3d79536be53

SHA512
e2fbe2af8462701262d2c1abaea45cb14d6a2f8430cba5241505c1c24c963352612fb003b415524113c9136f532fc34204832c57b66071ed31771963d9908e27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
d8763369547ab8cc0186d6fe31bd01ab

SHA1
59b5cdf18cb7339506bbf33279eb87cd6e8bf785

SHA256
07ead5d6b347901b92a860e0921fc35d58d67abab406e09b7d55feb36d1d2433

SHA512
df79b27c404c1032b764b00d3d9fdc2545bc41f011ed25490b8df684ba085eca90421f8590e9c0f3da614a849a86dec63d8bea69a680319a4d6f0767bc6cbd99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
1793107050a472894d6c43e38f9a1260

SHA1
2ae0396bfa03e39293693cdd8f4c2b5f10fed325

SHA256
8f07e94e83cf1625b809769368245d546fdb8deae0c8153a09e879db3dcdab80

SHA512
d85740badcf93156f48b11d0ecbd18f119ef1df7da343cecab3b99c1201244a2849cfae47de427b2e7236d45d707890d33281883abe08d4575cced0fce21f305

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
00a531d84553b90899eb091ecba6f489

SHA1
0ad82efc6be0831d5ff49292d3ef3cf4cc716a47

SHA256
9e19a4f3402775e3ffabfc69acd5f6119bd0b7ef3ca05166ee7895d96e3632a4

SHA512
0849568e8d6048793f1b6482a0c3da15dedb1e1f940fa9eee722461670b24edb4ecc55b4543df6ffeaf6fb9195d12ae20af654f15ea9246ee2bcf49c0729a35f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
040dbfaf68ed34718da8c861319faad4

SHA1
cb3299668308130aebdaefa6daecbd2a5c67917c

SHA256
58b1c07e7a2b7589706809f05513e29ae8af173278ed5e02305af55f455091d4

SHA512
3c29d495af76c27af9adac23c58b7e5b4d3f563ac96920440dc167b5bbfd41b724f3fe31ea4751bcb96c71620f854642f688ef0b508b5e15fe5bea6677614c27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
af03f146d5e3f30293312283296e01b9

SHA1
26f02243ada316026324f931e6d34459bdde551b

SHA256
d7253565a56ff0fd52d8360136db82e5a933dc11c7f15e1f337b5390753325e4

SHA512
16964e68fe6bb4f815ab9e0944494edad529f7d8babc5707cf7e6f2fe12330a52c8cff755dcf13fa28007b96a30afdef766f1f8994ce776749352d0ba159e59d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
cc92274269f8334bed7fffa29076c0bf

SHA1
9bda76c156fff2eab2e42d787a15f493dbf3b2df

SHA256
69936dd7a112eb5239c2f09b4838b8116b131083db78a9f24ade8575859924e4

SHA512
bfbd47ef9b2f1b4b3c4b9e3f37fdc110e4bbdc6c2eb6031aaba866817380d906872ef95ec742c2a9b392e9d71784df57b1569af6fc55fc21abdeeb6c41c5f3a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
a488fecba8ff93ab7d154dd7909ff9fa

SHA1
0961e1dad6b054ad7a224c89ba1ffb9d14e8dbbd

SHA256
9efef74a157bd21c51d4445603ffd60eb18201ddd8c0ee057abb56b99accedbc

SHA512
fb2a411b1b1eed28de816ddd9163a4ffc097ba3ae8185d80d9e5c932de27d8dd815624ff97d0127e61a661ed293b34e76d17befae6f2784a75bc1e566c3696a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c111c84a5d7e5d1822afcbe6a4b972a9

SHA1
642f6a3e2e862e126839d246d45c3b5c57ebc476

SHA256
e4204df7611a73477f81425f7f12d1b0aa0cce91b2ae86fd044049d1fd9cdb5d

SHA512
552995c3ddd2b76edd7d4437eb4dae255fa72f24df29196596ba75400a2523d1dcf37ea11a5b76ee5af6326b1d0c13b1db77a141f42b60112867deacdd6713e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
6c307c6c107c70109dd4e715b93dad67

SHA1
e8ef54fdf5bf53642fea004d9bb8867a393dfe56

SHA256
1a0e57d6ad43a5de6dd7fd62fdefe436fb78e38e03e60bc0dc44666f681817b3

SHA512
aa93eb509385da1372eb41b03eef420aefb18401f11e429af81890b7616952497edd8c6cf1147a71338de4bed97929a1d786a8f577b24cc160f41d761cd207af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
9KB

MD5
bdeba61adf3bbafb3b3d45363c37857d

SHA1
502fed5a645d7fc95824797cd18c1f587945fc81

SHA256
1a22c30f31e9cb9349ff1006de18e90331cf742c4b768a30bbacf1c1caabb592

SHA512
0e4cc06e9a6ed2e59433176af836f2a76dbee7ce23227a360e3e50eeb9bcb19532da6f0d86cea9bbdf2a390649407becbc7853a1dd4eda99bdb7d8999da66cd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
813bfbf1277441d006531a8a54c39eb3

SHA1
aab7a5733599ea712dbd34819fe6e05dd9aede01

SHA256
ebd9d26a52c621139be0551d218d128f8b9565839ab31c9703ff28eb1ef015a7

SHA512
321fceee63cde947a6726e6282bfae00b92175c3482c381ecdcdfd59a6eb12d73530f05ca09da2b209642defab0e36f384c6d40016dd00d88eabe43b9255466f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b627b2f0-f0e5-4c4c-a7b0-c7da19f87464.tmp

Filesize
9KB

MD5
224c6560092a6dc90de4c1a4173fd2ea

SHA1
23a5a03f121e7ac9ca87c39077bcdce7ea897f99

SHA256
b15dd0a5f21b11f2381364916292e1bf217e3942058e8c50d30813b1531856ba

SHA512
3d227aa74dcca555827e2d883f705009594e7c97f82cf86c7704b0e677243d81683303037655072de28ca69141ec1f64d9a78ec1df54add00f3b4cf1e9ad327a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
717692b81d37d62050694d4ea81ad45f

SHA1
a025cd3919767621d4f07c77bda3677116aa900c

SHA256
9ec56d465d7daaa842049199dbeb86eca4a8e16922df87bff164bc281db20aad

SHA512
a2feef47fbf486b474f48ddc56588a5276cc370d4de00340b9c5bdf2f25a43ef75111b420c86efb679d3ad766e6e163fcc44599775f189741a0e9775979ec81e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
186a5b909b6e5af6839c240e4e01a641

SHA1
1df7d72a60bc7d9e74454ccd50c6b38ba27df2a5

SHA256
0a8d59934c8f0efe633738792bae2fb5f5f108ed2f463d2a441ded8f64daf817

SHA512
c3372a45d39e7e4553a8eb66361a8356def673a4b328be346400f2ff374e1a19b0c48d371ca9d01e64288b77636cbbf5270f1b8d8abcfc68ffe61423481a6f80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
88cee0abcd1b010d7209e7cadf733427

SHA1
246e11a71010d761042d9554095c822bfee989b7

SHA256
96930f7020f9d4ed27f8505b882faa0a8523036fd7cfb20788340d08ac6ac68b

SHA512
2e473593c6538dd03003da324d6fd390677413f902c7aa96f241028ad22204cd56b0fd8f006f5c448f5a45223a82789c132f90adbfac13c7b071e754a0843b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4e1ac00caa9b3a3f1411d01398033906

SHA1
d960a44feb5c9131e7643b923e50f895e2665ea8

SHA256
959436b0764a420a14559ea08e914902f9cddb997c7860160b4da97a44b7fafb

SHA512
f06f0fa82584af04cb7aa9c7d1e5899979275a4277440b9eddffecdeb4a2877cdd063d0b9911223c2b8d701e5b6d7aeae647465f3e3651708950dca78b774459

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ed35d1cd5cfd101df72cdec4c4de338c

SHA1
a856feaad33956cb388c0428fbde6aeb885a953e

SHA256
705a1e6d5f9badf25213a6ee0b11d4737fc1ac41e7d3028ee741bacae6250a13

SHA512
e887664888c0c4cc4a080630b0df250a32de68c726742217ae66bab4eda4e3a524fcfecf1d140184336f84c81342a77938a82fc7b3aa2ca6cdba632e45f4188c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
14f3bc6047bd4bd253891d37a730f4bb

SHA1
cf3a7913209608c1232a380fdaf02687b1e489a8

SHA256
5b4f5426bf679908c39b5f48f5ecb73883808300320a9f2d52412cf677f9c575

SHA512
481058def37852eb96d970758c038bac922a3fe294490059b39ee3329c283207368521ed9bd35865fded305645588386d1044686bd55d23e686268284f84e59e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ad640a143828bc208906ffe0bfaed791

SHA1
8e9fb848571e80c943603a01b8cbe0ac5c88e8a6

SHA256
a1fd753f3533f2513a7ded33cf76b44d86e74c7f909062fb604695c6f52492c3

SHA512
4434a34474a2b70a3628b56f0e9b93b8892d2d5d0281984247049ce1a048145c12e998040eb24fabdb1c0f240a188442d77cfa4a6332405b7d3aff240e35ed0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
72a0feacad8008f26d6efa8ed7e186bd

SHA1
906f3102a9e071af196299ba04bf7be7f032fdd3

SHA256
b4fc653a63ef26d93097a9490870c349e760a67053c4908f9a572222492df9eb

SHA512
d2aae74d9ba05eb3ff148503e3ca9720cd30cc9fd743826d484aa6ccb129176ed93b7faaade33e7128af5ccb2b6fb807d31b372620c2f34c25a216ff2687a573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5e64fccfdb97d7977a0f805dab1fa595

SHA1
036cfdb911d1ef8c1d2dd302bb9fe3fa6916bc81

SHA256
7d787510d7b648aff66e8101df4b89b73a7e45f14af574cd1882802821dd5f80

SHA512
4d1a2f549d3ad8874827b3d1e79de9cf581e9c27195bfeebfc62863e65ef6ac024322e8d0e161d38851b63070a1538554475b9cfe8a403795e94ea76142896ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f517ad0950359ee140a31ffeab12f332

SHA1
198faf0a53ba269b4684b38a8d0384e1d63d4f70

SHA256
ba8d0defc4a57dc3db7c27da20483258aa2f8adb0d3c1371d855952a41bff237

SHA512
be6e9d2a6a717e760e7c2de51d4d456c763becc328a9f1cd58c66b8e63e56e828c47836beb1059b0d3c7d8167b819d2b9ccb3827d9e78543e55d249ec6c8d658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
76ef1ced6cf3a7d0b2f50f30345ed416

SHA1
0a4876de8d8fa96515411db8366f009a6867ca98

SHA256
adfb79f18d71cd5edee410e65b554b887729f86bf03546536c12955b6c9fb261

SHA512
0a772c8c4a6d42ec297d3f38e3c6f8a067f73d8084d56adb2bf7641c89b31cfc5c5bfa721b30dd5025394c3756316ddf4dcb8e4cb6c463c07dbc58db87f89420

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
505ae11c1984ea2c43c93137e5a5355d

SHA1
3e9077508098e3055dfb32df60fe48ecce8a7ba9

SHA256
089e1693524f4e4bc3dfe816249fac65bd752a272399e09afbb2450ce0280721

SHA512
858e6e56d7f09ee5683809133c5132410cbded96d197009540b83d551ecaee604fd666a3bd825f2730b5502b003ad7f683209f7a8891f6ce6df8d8add9dee7a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e5c010c2b23c29388d64dedf29bd1657

SHA1
2c62a9e34a94de15035f0ee51c1feb8c20505148

SHA256
4334e6878e7c3fea5075870a81b2a764ada44bc15c6e80895ce0502c7adef679

SHA512
105e2321bd5052846efa1b218c8727c61b7edf94f694f377021f134393a6bbdc4040badf170f5ef6900e0be90bc459d8df37d07269054cb74f916bcc7e2e49ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0eded1ba57fb26c852d1595a408ddf49

SHA1
0065c797811a68b15d8ffc01db0ac709ff85d161

SHA256
4359d444cb123616c97d9033ae5525726369b7acd33746b79b34ec1ab6f23c57

SHA512
4d5c21da47b652e058b025f3fdec8ebfb6354a47a622ec111296af8d8f8b85203bb11ba1577cfbc20b29a919875072510f7b75e73d2e23cc2b99c34398684a1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e6c264b70785ee9fc8d6f48127226369

SHA1
441a67e4b46ec248129792fe7dc719580529381a

SHA256
ab80450ba9f40fc5e68803e3973db81615506c6f98cd1dbf4561f8497efa7bf7

SHA512
3667297d7b6152056879e98b777f1a4a702a9a083168b535476ee119bb42ad1c92f68f90285bd35af8814b9def4c64576155d15277f271a4c9057049488518b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
b5d5d7d1581744724cb94a6bcbf1db5f

SHA1
fadadef4f617d2218824dae2157b9782c2004e6d

SHA256
93204d31e21e996174f84783c6019163e2c9630f79bd7a0a52c3de8dd5b42c2d

SHA512
5f00b660f7152c15827868724dba15b66e6981b29080abf75ab4671be848cf717078153cfe1a9592aef4c8738ec41c4debebee1ea8e7c5fee2f25e47c71bddf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
db30d8773c6b13d2632c51b1dd734e1a

SHA1
aadc12b68db92b5bb6125f335920b02cb8272c30

SHA256
92685419ec005833f1eca37e4220efbb858c2b418af2c7443c7d76287d41deaf

SHA512
65f7eb8691b8ea8d62977aeac157ea85a0dacb1e6575468b94a34ad338fe042a35afd0081b7df21b63900272605c979b0a7900c8404ba097715d044106322417

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8a1b494ac98e58b6b77d718dd5dfebe1

SHA1
7c1a7af0c2f1d867664e44105cfa2971f4ee610c

SHA256
3ca1b4faa3903e6f04199908279f754b8a158f7c8bae43052f06e68736e28627

SHA512
1cb65cc80caa4384a28fc2ec07faf2e4092a0205aa35688762061d45b0f463f982d66238cad3eccc767c4d6141c34fc2612922885484bf41a2bb7abf51fa4487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c705a1392e015d418686c03a15e2bb51

SHA1
b4c37058220db83e4609a87b26b92642f76dfc6d

SHA256
250fa57c23ace58634f0882f552b33c1c771ca4f8da6ab970c586d7f1d02a4e6

SHA512
96fe3a9105dcbcd88b0c4514717906b0f7acf34221da0b554da10545ca980844569c542521e17c9ce4a1680f8cff58680b6d5de0dc19c90a6ce7d0b47c7ba458

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
0872c5da39921ac3e064238cfa91db62

SHA1
7ff921b5316e761ee435747b87e9a195f0e5ae0a

SHA256
bc34acdbffc878472278241de4c728d57fdfeaf46253eab87f01b050add9f8fa

SHA512
c6124fe68e9532aff4a3c527a2f10d43f921bcc33def5c5bb1c3562e79223473bc67edebe0224e50ec2db8b5f9611c05b3c82feb98099945c929bf882efb4bcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
16KB

MD5
27d0b9a171b36858818c8a616eecb0ce

SHA1
d782cab7c44e3f533d375b33a942a5ca54598a61

SHA256
bfe6e8706bf91f723ae38cf29494003abb3f99527bacafb0f001ccbe09e585a9

SHA512
4e0319e28d140591b6bc1d0a19d4fc2b857f659d426df094b9f98eeb326cbf91a5ae5ebd07a8312e8554543b44eacac1b0455ea76d824b787999e8922a8534ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
16KB

MD5
55508a21cfdf25036b0c8145f914cfd2

SHA1
5d1acecf8a1518ca57593d0de835e2a80118e1c9

SHA256
401307cba009104a14ab3f3b9c1f48504ab0f6ab234f68e021a60bb5dff468d2

SHA512
64ef65a856f1aedf0af1fc6063d7b7af85e1faf2ca4c6433587eae6db7f646315598ce576d1dae40c36e664a5f6999c042d09ffd9359e03e7744659686a68c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
55f55a301fff54b20789281e83eedb09

SHA1
22bff5e9e4ea460b2afcb1b637cb8e5cb16dba48

SHA256
88ef308e1029b274cbc1512cd7f9f971ce2a6ff0d6a6f5632058f3d2a36de095

SHA512
2262d71f778865b054597ce95352f205f140198f07680881bb017553fb6021f740434509f8bd8f3cd988c7a8e361a29839feac3982ad6d3c63f597a3392d3084

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1fba6c7410c989a4476f1aa7b22a5666

SHA1
62d7ddee9ac785a8ae966be38e1ca8c4a3a833f5

SHA256
762d9575dc70693eb4e68a1e95f2d5df79c8064be90927e601d766bc981a7311

SHA512
a02564a5b0b7a568df9c88f19473974c2ea776a8a82328d59d254cdda4ca77284ff2ba0e9012ccb915f60bf689851a6a7ea0d50bb4df2fd676eeb168705924f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fe9cbcfff38e760336ee43fb12809ab3

SHA1
1bd2b91dca81d9d6c9a4787d99facb0c9d759869

SHA256
092cad1f0533d563b3208af4171fe5039d15d99c63e2fcd921f63ebcf79dc026

SHA512
2939ccc876190dcc2124d75390d6365cddafbb8c92c072ce0a015cad22afe603c0fcd6d8149db726af92239c962a8c9fb22066a77b5370b03b008643ac04afd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cf7c780b95e6479f0e3b7fb23f1e99c9

SHA1
96ceaa97c91baeb3c0c9cd46f8715012e727a00c

SHA256
221f5c5ae877ff0bf9e5bb30ac3356828205ddba6f1babeeddd0d82973811389

SHA512
c511bdb785308fc66b0e059b65ceb8d59e64dd6b4893040229aba41ae6071bad4cf06a487781835b7e7ad4eac88466e34f93136b3e735387300802c36846b79a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e33ada44a40ae1a618b891afcd3f7df8

SHA1
62ec8ab6d22247524b1106a9262105444cce5cc9

SHA256
7ed105a7457b9596cfbe2e2b4a718073042db2c350240bee28ee648084e1ccbe

SHA512
9565360379f3c83efd65b4f1371f74063db1e8860f0b7964bf1d8ba9207f85f5d42911f9c9d29b932d0f475a6f58dcef5343cc0bedbacae35de66a9e9899d368

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c52d144ca29fad42352f7ad2ab619d05

SHA1
4553f68208c626e7cafb583aff61c5b06c23cdb7

SHA256
691a8c4bbcf4102ddd09ce3ecc54625c649d58095cd9cbaa554baf429d91179a

SHA512
0b841e27c9220123d68d4e6b664162e5339db4e69bd15eca549a1852aa6b7c35620428793cba630d502e21c3744dc4c374b1ffc8c365e37309982064efe8340a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
16KB

MD5
066d404309462f12736f3017ae8ee499

SHA1
f8ad717487257769374391768938155204b9ac5e

SHA256
0fd22fa13d87c7cf252441d4c1accffd759a16af32b84a7f7ff048c440f26cd1

SHA512
d1f638e1c19deaa0d028a61088f661db3c5c8de071e90e9dd09e2466c3e6c4b4a3327c832f41af7473335a62222bed15ef8df5e8c68b61d047110b037b8576a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ed59e0b92ac332484677e4949bab8520

SHA1
8e373dcfd103d3cf2f9fe3ddf6160d699962a8ba

SHA256
9744f0a33280e50ce382acdea48ad314a8879998da62b03201c35c20a9b79fea

SHA512
eaa9995f518abe7afed563771b62d941ea1e2bc552a28a849fd047c399362cb44dfa07a4a3040834f5ce778e8b18b230bc547a5f54a42b822f0e874eb150d682

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4f7a219139f708bfd5207efb7f65d098

SHA1
1ad28f6ae3d015ae8decea6d3527079bef639206

SHA256
1e7c9a491fea8c9a3028f8419ec6d37ec7aead2f4a2ada15adcd2e98d7f8d910

SHA512
c6acdf271e94bfc775512245baf81acb9e944841c77a77854127e4da04c5162da3e2a56d6e701fd15fe0e759e99d88cce63c40f3b15fd2a97a28307ec0a19198

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5a1e083e702e9473ec406f289f5eec34

SHA1
87c50987c09b5cd109d24535cd8645a3616d714e

SHA256
98cf454b765376e2163d1a3b60672f130d03102e88fed8de4994765b9dfae02a

SHA512
f300d4edccd1eeabd651dc4cf272d6aa37c9607525db70fa202d260e21c61b10f1cd879630f2bf04093ed1190326f9cee2a9a14e5d7712b962cd2a43455943cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
c924436697ce647734ace6c530528dd3

SHA1
1994aa0162b48fc0191e8b6dcde9b7088ac7f25d

SHA256
540fa133e3b5a1a619e9388c8e13e3948a7ef1ff61e1e01213245535863c5bca

SHA512
21da52cb2cf2cec5784922ba97ffad15691a79a1ce8fb2b2dc6637546fa6112713905e4e58cf116ddae8794a1ca12a8afebce926bd6da0687864fa9b311441a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
0addb748b96dd72d4a841339cea8ddf7

SHA1
f80f0b6090ca4b4f09a9cfabf1824a3a90e2c5eb

SHA256
e559bf0979f9a04d167c59354cf23d779b7bc7d918d2b29d737fb57f1eb484d7

SHA512
c05044ca6167db8d467ef1d989910007fab3af16b1297e7ac59d2a2ae5f4618b635df9585dd7561b066b3f90cc8fdf870c26580f68709c48665e05180596f076

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
059d15d3efd33666261e5c83bd6e7c00

SHA1
8caf55a354ade4abb78331285d8c809275665796

SHA256
cfda690674c6348fa64963d7b81e9926154bcf1582877e0cb4a40c2e48b3a9a3

SHA512
f4d4877706f26f2172cce5c0330ae29e4cad11eb32a52b31654a459dba69bba03fd8db87e256008a169d08ab449f77418d7a8793783db4bfa3c0e293c0255c2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1812a61f92ae73553184b7352c5a9691

SHA1
7cb7f1f1e989e4c94aacbb170c197911f2c2b317

SHA256
bd7e2fa9e58181c043f104cb0fd20a6767d411a85b17bb5825decff2215c45dd

SHA512
2bcb715c151078723ef66192f183e24689764fc4ea044acc276099aa616ff05c78b53eeaef0383985d4eedbfd443c730686472f4eff2a0a2fee29a77a34e5185

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ef4c77302489db13789d737fb245794b

SHA1
220b69a6670e6ab774abdd4b4ea5ee1fa2cc98f7

SHA256
3301ba63808b3b81dddd4a02c91f0dc7d475756f571699937de46d63e1cf2f44

SHA512
c5875ae2d639a82dba1da3e86e0276e497f2de6ffc5a0c4d04fa6565ba08bf1039bfa88e3f40f1b244729a2a3e460a44d129f4a58dd1822639395fb431ce8636

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
19KB

MD5
f50ebdc286abc20e4d7b8ce126b63696

SHA1
668989b3c08551875e046cd5ed092e3b477b12fd

SHA256
612d87e69649a2fe5c324b508345e95734df65b679ae2788eb8195a7e1daea81

SHA512
87f71e0a16cf079d85c54cf35163faf1e0cf00c890e9055e1711c5a34ab96072e18db53c4e93cd42bc22087fac2e04dc79f255d3f722c04673462743c68f8cf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7a8e6513e78cf386ac4f5e5b4d31fab3

SHA1
eaacfbff4f56fcc5f2294637428a0c165beb9f49

SHA256
01a13b977542cf1a7a450d4f5b8321243c16bdc52396cba5024e1380374a7cff

SHA512
46cf694c842c5b0137d46ad56928e4e0a3385ee918a9b5101dda044e8d31f48240720fdc67ead417c2f6664bea97c28638d0a525caf14db3c7051653f64e07fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
090174e7efdd9ecac4356d0b018c1449

SHA1
f470ba61b5390ccbc919afe5ae7fb61dad15290c

SHA256
e9ed13017e6fd8c3c365b3f1a8bc66159aad1cfc6a7e7c4aed2e902ae722bed2

SHA512
9e12db3a977567e35aaa709728902ddc2e1ad101ac658cc87ec4d99336ecb40e0176e4e17a45377762b0c8dd0d672471d8e128a247f0881b46df30e21f59d6e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4940d2b8592d0b3eebe8b8c8269976c6

SHA1
89304c0522548469d5dd81b464649dc715e2c967

SHA256
ab78d79ff0d5e021d42bf1c941cbd57d76ea3d49d2363d11a47bdfa31db999ac

SHA512
5322abadc7bfe5a737a2a39d576d555de9e6ebddb421efec2f626727e943e2d52fe814b42715bf914509fb5cfecebf36be84cc92def17405cc4b058f51d3cab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ff03e8929a126b882d2d244b2d2a1293

SHA1
7a733e85e0e0f85e679c410774d292c22d030e7e

SHA256
cc75153156b922c8f675c0d05c1ea0f964bc3bf67ffdf03b1326879f53844351

SHA512
2fca68c2c2810fdfc5686f412efd3d79af1e94a3f88909faaef73fcbdb47142509b4e0434eb4948d9627f9f323f6efcc3ed19cafb63a0da7eecbff342f79063d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e1f433f255431b121c7dfcae1a09145f

SHA1
452c51d8f13d58790405ea54d5b3a46105493e8a

SHA256
5f7e6b941a86d6653fe7329ea59e8166ac54354e411867e315e4ae756d1aa5a9

SHA512
e0d0f7aa15e69d5fd5564edfffedd57a6cd938fd3b45a790283df22d26b0b5863bcae0532f9f2f22e1c1daa73a97a5f99434338d07f6720a43b81b078c114ea2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
71677c9a97933a856dfda64539d05adb

SHA1
875fef271b636108000a25ade85855c687a36906

SHA256
e193b1c5b31595a3eb99c0a992253750ebb1fdbc089e2a243893c20da1d23be6

SHA512
16ec4c3e43ef74a559fb52952b6e68b8bfde3b9f83876bef0355ec002076c84b48452ed189a86b0991e8ac3f05215ccc28708af72f4f567eafc32576216fc533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
df8020c720a07e7cb18d4a88a410331b

SHA1
bd76e24ff466b9adb32ee1f42e100b9ff8efe81d

SHA256
5f58914d9549d4e1ddf25b4f726edd69210a239bf87bd7932dfe9c409d5d3420

SHA512
d4324140034b7300d196518ac89e4688ecd6141af72a8e8ca8d73f01e22ec8b39ef266be2b0649206f9d20f2f1e2dadf7e4196a9b14c748bc14e49ce5d7cb12e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
0d6a0dc15229f4a84b54bb62fb2f9bac

SHA1
aab6d3e4f1d9fc1c24f648770e6cd7b0edf28a6e

SHA256
321f90a70ed43618e73a5606d3b9ff91d7cdf17a0290f1ca8ca223f448e44d51

SHA512
3d5dc8f4155c51a2a4173b80e30a59257a87725fc97e08d679ecca760727b6e4eaa029fb8ebf59ce62f17707c902c2d56a81d35ea9ad3135180722b951e41ab6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a32e2aa06895f5eef0a863b29369fed4

SHA1
c0cb5e3eeba5f6bad967b6ba6d7f0840de20ca75

SHA256
379845e71e1bad2ccbbf67fefad8f25b0572cf6af3e8d6f13554928d7ee39e97

SHA512
e96a61951528b7a76ece757393d13b7a16059b7edaa0895046705d2c01a14ae4048829e67099fdf12088caebcbfb8f4ab750b3de28222bc32982d268f95625aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a2462060e102089128e91c7096ebb5b5

SHA1
0fa1f47280a93e88889e90ea177c0c2d7f1012f2

SHA256
3d6114b04b3c0fa357c7314eb503ecfbc33bd671a156b0b410bf9f9dd2e12f00

SHA512
db33b046e043a5b1490bca93a8b9716a5294010b7205b45a99108df6188ac94a7809deac3b8fbab9ebdc49c06b6184829d3ed1f3103c33e5d36cb23d2c438acf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c681319474c7101402853b9a5d1a3490

SHA1
87721ee3682166fb4c900436a99660346c5453f2

SHA256
21d430a68abea9a16cf14b3e85d7eb26c14bfb30ae3dba37eeee8d9eb2ec3a61

SHA512
3a3221f54c2a0855fe9573a72d6fe1be415667f1f13580e9ae2a4ac09ca9762941f1ce639e2fa30244c05b93a33c6651bae74381a6847e5bfe9ae5f0b7ed54a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a5db619c9b588680abac50ccdd3e1f63

SHA1
27ed8e470fdedbf8b96bb6183dd72ab3e50ca95d

SHA256
df374d6901d360f199fb34fd723aa4b6ffc874962d7f3089515307b660ded695

SHA512
86458487f7ea997ac33480d67327416a89aa10e479491ddf4cca5dea221de1deab15d36ebc2f9c52ae06a1fcd69cdbd62b26e91b7e8c51ec6351e64680292b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
90dd23ed5f408214cd778623640217a0

SHA1
3cf06cac16bee7670c0d64440cb4e6d3ba62c29b

SHA256
b79d04c841d393e607bd1f554ba3560ac40c92d7db4341d523dc72d97a2d92fa

SHA512
961e788bbfa16c8df66d255e87d4db55ad3f08d94a1973fb6042fac5e7bb3d3d47f3f4cb13fc9712d3931718e58b0b86152a5c582df139868868b0f1ad11dc7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
e38cd2e3215bb35bcc88c315d8d84044

SHA1
3244fa42dcef106396b26d55b85e7b350654dcb3

SHA256
ba95f02deeb7cc03ee8df3da50803f7a37358ede950a0d03d314b71f68b8e21e

SHA512
0ca3a55a2d810069124ff12df978d2cef2f405aa8661eeeaf8ed800cd8e49dab3dd221318badb8252965b7c4a22e5b4ee54d454fbbcef11b7e05b13c1501b22d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
db6f81af583924207f8b7433ba086211

SHA1
37d5490cf86342aac563e748bda3e8e2a3f684a8

SHA256
3e21126dcb381d286a041c73e01a8cb67d223e9f473d492b4dde56c34dcef945

SHA512
5d7e6198e4413b4361cc7e635d6c3a51ab154c02030ef24f1eaab6d0a69f0fa4c3646ea49a3613c0c20d7533240161a16ccb6e1ab7a7e56586e1cf3284ee248b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
260f29bfc4ba2cafbb065820e80e47db

SHA1
032091f89321ea76134baeb4eece94bb82b68e62

SHA256
3020d44634e9a1db71d1a310ee957c01e5264253e4cfb4d12946df928507d181

SHA512
ba05da6ebb595916ac2f58f0676325b3b7599d4f5c19ffdebe72340e86042291dbc27aca912278b8dd86b62c60432443e2d8c5af8c4693a355e6f0e688684f3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
8ee0c9d214c05f3427a46f9012fb7f2e

SHA1
a1028639d0ad3eefdb74914d35e7d925843eea45

SHA256
5d2e587661ca67c579f41f0b55eb9df227c5bed9af75fbaf7d6de9dce42c6c1e

SHA512
5f60730d82a1680393fd71325d47dd6395f248f757b85c72d15753275f6aac5b675429e714f87b35d960a518074af0a0858a5eae9721723e435d69429170428e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
1260f89acb603d67cd149265b3b05d0a

SHA1
d57a5d16f74650c0da1af1363ea5e9cdeec7a344

SHA256
9657396146aa700c4c1903083b6723841be56894ff4633236f015516fcf48097

SHA512
d702a353fba09d5a0c452705b90bb6220b2e93fc1ac4c50ad7f211631fd78cf14a38b0022390cd7c9066f62439c69ec5e89bc510ea65fa05404d54c86b4ba1a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
8d6eae5cadc7481b56c052d0c6e5164c

SHA1
4acdee29a7f6f9996e3cebce166c200cb52b7c9b

SHA256
49a292098736042550b9c00cf54116455d739882c7118e4f0f04c6bc528e6095

SHA512
a97c7f817ad9f484b6cfe6f1e627992c6a82d57fb600e64d0a0c21f59294bd004ba7cdd5dc8c9dd8d4b89ac0448cf18016e501c827b1b3aa4e676f8b4ddcca50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
83081bc2b070113e7b2f016d753c12e5

SHA1
d663db6e39bcbbc254fe1be0498d0782e4ca9229

SHA256
3ce7854f3c4ef391b1a26b4b0a3e0a96745f8a7f80b46d42ba8bdcc61173984d

SHA512
9d44f8ea59f1a591e23e9c2192139a43b056c97c835d2cc90e3f2143ad57ebae8727dfc492ea169ce0413dc96cdccf0083270136a08f1a5675479dc2a33c97a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c9298baf81bbb2ad434090ae903d5951

SHA1
e85b9a91ff792dfd1895aab0e97c035f3e30aa33

SHA256
31825be365c2fcc61412906ed2c2f74ec8b6af4bf944155e838729b303a9c8ce

SHA512
1b913f707a655503d03d167af0deaff9b11ec3e70987b72123502b1fa788a9595ae8f84559201ed381b2022d730395d98c091ea5d8df06b2829dc5003e8fc061

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
cc34deb5d2dacf92de10a06741625bff

SHA1
7d89e1ba55b7ab8512236bcd645038483c758145

SHA256
97f155213ae14be1e1086fbad51aef8a7c927a52654517928efdad806d325e6a

SHA512
12fba794f3e10a4ebf71e0fc8f050cdf41c281674482ae82ae739097f329e7842c8464c51e5645cc9602ee9290b04c8a84800955eae7bfcd52d8f82348a614af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Delta.exe.log

Filesize
3KB

MD5
018ae769167aeeabb13d7c93b6dcbc35

SHA1
c84630f0338dc467e01bbd8b64cbc1e382d0b51f

SHA256
37327bda7ff193c5f1dac81a4f56973907bc30d07ce3654cfc451a996cfe4b49

SHA512
77620a679df2e2ae082d5b6b0d5b06963ed12ab3304c4449b4e1e964ed34d1485fb8bd635071fb46637660e38ffbfe3e91b2fe0fe7558771182901d2abe2253e

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b825df864798d040bcf9f2dae2974eb4

Filesize
7.3MB

MD5
b825df864798d040bcf9f2dae2974eb4

SHA1
99ac3a6e30188e67182350d16ec3785d2a5d435d

SHA256
c0b8cf766a5b45144861e78ccc213b1732dccd0932daf611963eb98512a7e7de

SHA512
3e486aae5f12bc0dcc2b2005c5c110d6b98c13b71a028a7ba1a60891a579a8713bc33472702569cde7d3786b2cb96dbf3a74596175d1b72ba641d45ff1e18397

Download Submit
C:\Users\Admin\AppData\Local\link.txt

Filesize
56B

MD5
0eb4ba6b9400a34438e71fbda0fc7d3d

SHA1
602cbf508a2872310c0bf5008b0d358ac0b1a433

SHA256
21dea763102948bc51067c0d8b727504937b4ec54f336cecf40a1a27debdfec6

SHA512
6836ece8974f774219fdaa77ec462173470888dee956a8d5ccfd5451037dd4bc3014421183f8628ec8e79f67a34522537fe718eef345203fd502af903400d42b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
11KB

MD5
5a383feb329dc4b1a3bbf8aa560ea0cd

SHA1
fca9ac490a571000c8851fc3066dc6b2feac75f2

SHA256
ce6e425929826fe8b865347eae7de3bd5017b86411262346d98bf234e1e96a81

SHA512
943a68b994c1b35a3ce49f3183f983d3051c5debac9984d9576ccb19a8089a782462435f7b327c6d37ecbba71cb1d40895f0f71a04cc512bbb194755584f5c64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
15KB

MD5
b9db1245a4e57815136449edce379d7f

SHA1
1d898e9f22c890f52074e89166a284b0328df3ee

SHA256
e91015cf9c7e31bad27c03e736661d3aad9b2d1d85c02de69ec929ae85466a75

SHA512
68af1ee6c59c23c1c35e965e2681f4df87af2b07a4729508f354caa42eaa428bfc5001defc31ebf4194b681510ba372f5c677f52a4e82f5f12056add5ab945c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
14KB

MD5
e59cd0225053b331872a6fa55259c677

SHA1
3c85891a24a2e6b6fbb03c04ec695e8e10a4ec43

SHA256
12bb4b5dac582615d1511e26d0ef46f078030e4caddd47565d60200d70abd909

SHA512
278698dbbc52434d7f72f1204e92e5f31f0682bb80666b7401cef1839a27dd62f847ea7f4fc4484169005034498e0cda97099db921a6eea42a58f845b6eb535a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
13KB

MD5
74f8419491c0aaa31b36fa4defb48ec5

SHA1
97b2f75145f0928f5ff5753ae41e205c005aea4c

SHA256
f1ed3cc77236c6e9534569cbf271bd04a5c4ae47263f1e399ecf12eb32a9b1bd

SHA512
ab3fa221295d8564e3c62deb7e1bceb497cd8650023a22a4aa2fe0f9327128c16db122a64d1ca2acd2af18b9376e65de3e4500a1d194490f7b6cd4d8afbd82dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
16KB

MD5
a2c8517c3fd2a2880097d90aed19a1a6

SHA1
9cf296ef4f71da563e74ba3bf7173b711b81783d

SHA256
e2bdd620f143444f6785e70d26dcc21fdf37b103c1fcd06ddda283a083b27828

SHA512
b82d811afe6465d688d918d7ea6ef53b1475216c1bdfc18d7e8aff732c4b72752ce2126e0db3aead353f8170375b0eab922bfe229025b04d4957124e7c75f0a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
13KB

MD5
4408c87ef0308e328bfe913e8f907749

SHA1
1644c41087a9fb0703d4f45aeacc6735e82e0104

SHA256
49d178ae98eb91c5be625c717dd5d92909c27657f894e7a256228bea96db3498

SHA512
132ab27824845e9da296131dc9d9555790bb1e62a2a3e283b8bee131127f666e67951cd8230c4e22f81fe204217d70f212a89be122683cf005f00a69af042083

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
15KB

MD5
6d9dfe5d8d7715c04e68a4a5d8c58baa

SHA1
17d9df410a0e41faab0dbd0e9e877148baad9ed0

SHA256
e1280181b9fe29f88ca52c8acd6c8e323a915a7d34bf70ffbbf43fe6b5691d0a

SHA512
54343e1aebe55e0f9ff65bcb7a26ffb839b291df92e93bc941054aa9f28c57ff93d705f41d1b9dfcb36f0a50e488c692b854518782d1a9422a00e7d21b677935

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
18KB

MD5
508233ee6c9386ca305a73e822b11dcd

SHA1
091d8003bd59177d2810dcc4e83dca00885856c9

SHA256
2983b31b6adca058807ab6f35e526e7184dadb97e5fc4e093f4c5fc0b6b0df5e

SHA512
9997604fbd6c557de84ccf9bd2051ede3057844e2a0f546aae765e53233c43eeacec401ecdd0f919511b764cfbea99cea02da81c54c8ad9b7724381b611cf39d

Download Submit
C:\Users\Admin\AppData\Roaming\delta_core\Settings.json

Filesize
975B

MD5
588d66d9402bc932b140ccb11b52192d

SHA1
d47a5574332bf975fc770dd580f12b6f06d52220

SHA256
628eccf8a060e19f46effac3dac0c1e8b4a181092376984709cef995a2243e0a

SHA512
13412d20c18b96ff76ed7de2b6230292268d1a4e9e8487543899c52ee01a0ef14e086f77b075edef476578e615ee02b6d40dbb73f485862d9c306a62cb000eb6

Download Submit
C:\Users\Admin\AppData\Roaming\delta_core\error_logs\ERROR_LOG_9274568.2822.txt

Filesize
1KB

MD5
b0de4f03082a076546cfad77f30ec91b

SHA1
68479fc26dd1fa7805cfb0f607416a590b34c2db

SHA256
a2639038d09acf07cf58b40e2f2ceb45daa4637e5ae69ec9b9b652481accb538

SHA512
f2bc1bf4533ac2711721117a158cbda7bd95a457c4bf6fcb68725dcc400705b8061ab1cf7a0ea13a9ba22abbe3ee9f7a4df6d7904c743731eba8add175817cae

Download Submit
C:\Users\Admin\AppData\Roaming\delta_core\windowsize.json

Filesize
30B

MD5
696e5267d0e5e96cebc7cfacfa7a567d

SHA1
6ee105ae341b8b359b766c40a31b6b3e1f7e79ee

SHA256
0fd96511d48dd933c94615cc609be556dfe1cf291efa97e490be0e5b0fd0445a

SHA512
19eefc0cf8edba6113f84c38931f204a54ad7c4842284237abfbff4d368491d53ab0ee6dcebc823147b8fdc0a95057f7574b8fefa355766817f9e93163676776

Download Submit
C:\Users\Admin\Downloads\Delta V3.61 b_64913384.exe

Filesize
5.7MB

MD5
15d1c495ff66bf7cea8a6d14bfdf0a20

SHA1
942814521fa406a225522f208ac67f90dbde0ae7

SHA256
61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

SHA512
063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

Download Submit
C:\Users\Admin\Downloads\Delta V3.61.zip

Filesize
22.2MB

MD5
2692ff99a5f94520b6caa33bbd0cf05e

SHA1
0bf675fad129bc61f7c2763177a4314288cce4cd

SHA256
507641e3047216809af93a127af70a266e273cd95c1cfaa06605a753b9166388

SHA512
65d9665d29684325ca27a33ec187be8ccb142f98f662f888b944750ffcfcea43c496403331ab00e5e408dc5b1c3d39d7fc2defdecb1133a41dcc5d00c7c0392c

Download Submit
memory/1840-2804-0x0000000007370000-0x00000000076C4000-memory.dmp

Filesize
3.3MB

Download
memory/3468-3080-0x00000000003C0000-0x00000000003F5000-memory.dmp

Filesize
212KB

Download
memory/3468-3081-0x000000006AB20000-0x000000006AD30000-memory.dmp

Filesize
2.1MB

Download
memory/3468-3146-0x000000006AB20000-0x000000006AD30000-memory.dmp

Filesize
2.1MB

Download
memory/3468-3247-0x00000000003C0000-0x00000000003F5000-memory.dmp

Filesize
212KB

Download
memory/3580-3296-0x00007FFCF5030000-0x00007FFCF5040000-memory.dmp

Filesize
64KB

Download
memory/3580-3260-0x00007FFCF7970000-0x00007FFCF79A0000-memory.dmp

Filesize
192KB

Download
memory/3580-3274-0x00007FFCF54C0000-0x00007FFCF54D0000-memory.dmp

Filesize
64KB

Download
memory/3580-3273-0x00007FFCF54C0000-0x00007FFCF54D0000-memory.dmp

Filesize
64KB

Download
memory/3580-3272-0x00007FFCF53B0000-0x00007FFCF53C0000-memory.dmp

Filesize
64KB

Download
memory/3580-3280-0x00007FFCF7010000-0x00007FFCF7020000-memory.dmp

Filesize
64KB

Download
memory/3580-3286-0x00007FFCF70C0000-0x00007FFCF70CE000-memory.dmp

Filesize
56KB

Download
memory/3580-3285-0x00007FFCF70C0000-0x00007FFCF70CE000-memory.dmp

Filesize
56KB

Download
memory/3580-3284-0x00007FFCF70C0000-0x00007FFCF70CE000-memory.dmp

Filesize
56KB

Download
memory/3580-3283-0x00007FFCF70C0000-0x00007FFCF70CE000-memory.dmp

Filesize
56KB

Download
memory/3580-3282-0x00007FFCF70C0000-0x00007FFCF70CE000-memory.dmp

Filesize
56KB

Download
memory/3580-3281-0x00007FFCF7010000-0x00007FFCF7020000-memory.dmp

Filesize
64KB

Download
memory/3580-3288-0x00007FFCF6080000-0x00007FFCF6090000-memory.dmp

Filesize
64KB

Download
memory/3580-3293-0x00007FFCF60A0000-0x00007FFCF60AB000-memory.dmp

Filesize
44KB

Download
memory/3580-3292-0x00007FFCF60A0000-0x00007FFCF60AB000-memory.dmp

Filesize
44KB

Download
memory/3580-3291-0x00007FFCF60A0000-0x00007FFCF60AB000-memory.dmp

Filesize
44KB

Download
memory/3580-3290-0x00007FFCF60A0000-0x00007FFCF60AB000-memory.dmp

Filesize
44KB

Download
memory/3580-3289-0x00007FFCF60A0000-0x00007FFCF60AB000-memory.dmp

Filesize
44KB

Download
memory/3580-3287-0x00007FFCF6080000-0x00007FFCF6090000-memory.dmp

Filesize
64KB

Download
memory/3580-3258-0x00007FFCF7970000-0x00007FFCF79A0000-memory.dmp

Filesize
192KB

Download
memory/3580-3295-0x00007FFCF4F30000-0x00007FFCF4F40000-memory.dmp

Filesize
64KB

Download
memory/3580-3294-0x00007FFCF4F30000-0x00007FFCF4F40000-memory.dmp

Filesize
64KB

Download
memory/3580-3261-0x00007FFCF7A00000-0x00007FFCF7A05000-memory.dmp

Filesize
20KB

Download
memory/3580-3255-0x00007FFCF7920000-0x00007FFCF7930000-memory.dmp

Filesize
64KB

Download
memory/3580-3259-0x00007FFCF7970000-0x00007FFCF79A0000-memory.dmp

Filesize
192KB

Download
memory/3580-3252-0x00007FFCF7810000-0x00007FFCF7820000-memory.dmp

Filesize
64KB

Download
memory/3580-3276-0x00007FFCF5630000-0x00007FFCF5660000-memory.dmp

Filesize
192KB

Download
memory/3580-3278-0x00007FFCF5630000-0x00007FFCF5660000-memory.dmp

Filesize
192KB

Download
memory/3580-3279-0x00007FFCF5630000-0x00007FFCF5660000-memory.dmp

Filesize
192KB

Download
memory/3580-3275-0x00007FFCF5630000-0x00007FFCF5660000-memory.dmp

Filesize
192KB

Download
memory/3580-3257-0x00007FFCF7970000-0x00007FFCF79A0000-memory.dmp

Filesize
192KB

Download
memory/3580-3277-0x00007FFCF5630000-0x00007FFCF5660000-memory.dmp

Filesize
192KB

Download
memory/3580-3271-0x00007FFCF53B0000-0x00007FFCF53C0000-memory.dmp

Filesize
64KB

Download
memory/3580-3270-0x00007FFCF6D20000-0x00007FFCF6D30000-memory.dmp

Filesize
64KB

Download
memory/3580-3269-0x00007FFCF6D20000-0x00007FFCF6D30000-memory.dmp

Filesize
64KB

Download
memory/3580-3268-0x00007FFCF6D20000-0x00007FFCF6D30000-memory.dmp

Filesize
64KB

Download
memory/3580-3267-0x00007FFCF6D20000-0x00007FFCF6D30000-memory.dmp

Filesize
64KB

Download
memory/3580-3266-0x00007FFCF6D20000-0x00007FFCF6D30000-memory.dmp

Filesize
64KB

Download
memory/3580-3253-0x00007FFCF7810000-0x00007FFCF7820000-memory.dmp

Filesize
64KB

Download
memory/3580-3265-0x00007FFCF6D00000-0x00007FFCF6D10000-memory.dmp

Filesize
64KB

Download
memory/3580-3254-0x00007FFCF7920000-0x00007FFCF7930000-memory.dmp

Filesize
64KB

Download
memory/3580-3264-0x00007FFCF6D00000-0x00007FFCF6D10000-memory.dmp

Filesize
64KB

Download
memory/3580-3263-0x00007FFCF6C70000-0x00007FFCF6C80000-memory.dmp

Filesize
64KB

Download
memory/3580-3262-0x00007FFCF6C70000-0x00007FFCF6C80000-memory.dmp

Filesize
64KB

Download
memory/3580-3256-0x00007FFCF7970000-0x00007FFCF79A0000-memory.dmp

Filesize
192KB

Download
memory/5024-276-0x00000000084D0000-0x0000000008562000-memory.dmp

Filesize
584KB

Download
memory/5024-238-0x00000000004E0000-0x00000000015E6000-memory.dmp

Filesize
17.0MB

Download
memory/5024-239-0x0000000006300000-0x0000000006308000-memory.dmp

Filesize
32KB

Download
memory/5024-240-0x0000000006350000-0x0000000006388000-memory.dmp

Filesize
224KB

Download
memory/5024-241-0x0000000006310000-0x000000000631E000-memory.dmp

Filesize
56KB

Download
memory/5024-242-0x0000000006540000-0x00000000065F0000-memory.dmp

Filesize
704KB

Download
memory/5024-243-0x00000000069B0000-0x0000000006A26000-memory.dmp

Filesize
472KB

Download
memory/5024-246-0x0000000006960000-0x0000000006982000-memory.dmp

Filesize
136KB

Download
memory/5024-247-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Filesize
120KB

Download
memory/5024-248-0x0000000006EE0000-0x0000000007234000-memory.dmp

Filesize
3.3MB

Download
memory/5024-249-0x0000000007350000-0x00000000073EC000-memory.dmp

Filesize
624KB

Download
memory/5024-250-0x000000000BEF0000-0x000000000BEF8000-memory.dmp

Filesize
32KB

Download
memory/5024-275-0x0000000010C40000-0x00000000111E4000-memory.dmp

Filesize
5.6MB

Download