rhadamanthys | hxxps://xeno[.]guru/

Analysis

max time kernel
408s
max time network
410s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2025, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://xeno.guru/

Score

10^/10

rhadamanthys defense_evasion discovery stealer trojan

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral1/memory/476-1721-0x0000000004C20000-0x0000000004CA1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/476-1725-0x0000000004C20000-0x0000000004CA1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/476-1724-0x0000000004C20000-0x0000000004CA1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/476-1723-0x0000000004C20000-0x0000000004CA1000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 476 created 2864	476	Conscious.com	49
PID 5700 created 2864	5700	Conscious.com	49

Executes dropped EXE 7 IoCs

pid	Process
476	Conscious.com
5700	Conscious.com
3344	RobloxPlayerInstaller-WFVGWGXQ4T.exe
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Loads dropped DLL 8 IoCs

pid	Process
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-WFVGWGXQ4T.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1108	tasklist.exe
4032	tasklist.exe
4084	tasklist.exe
3108	tasklist.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 48 IoCs

pid	Process
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\avatar\defaultShirt.rbxm	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\AvatarExperience\CenterPoint.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\MenuBar\icon__backpack.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\R15Migrator\Icon_Error_Checkmark.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\TagEditor\lineargradient.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\icon_admin-16.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\MenuBar\icon_maximize.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Directional.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\TerrainTools\mt_subtract.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\fonts\Ubuntu-Italic.ttf	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\fonts\families\Balthazar.json	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\Debugger\Step-In.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\DeveloperFramework\PageNavigation\button_control_start.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\shaders\shaders_d3d11.pack	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Settings\Slider\BarLeft.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\LegacyRbxGui\scroll.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\configs\DateTimeLocaleConfigs\ko-kr.json	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\LayeredClothingEditor\Default_Preview_Avatars.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Controls\XboxController\ButtonSelect.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Controls\XboxController\DPadLeft.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\graphic\noNetworkConnection.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\particles\forcefield_glow_alpha.dds	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\move.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\AnimationEditor\button_zoom.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\configs\DateTimeLocaleConfigs\ru-ru.json	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\GameSettings\delete.PNG	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\StudioToolbox\AssetConfig\plugin_temp.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\StudioUIEditor\icon_rotate4.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaDiscussions\search.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\StudioSharedUI\ScrollBarBottom.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\avatar\scripts\humanoidWalkFamilyWithDiagonals.rbxm	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\fonts\FredokaOne-Regular.ttf	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\fonts\NotoSansDevanagariUI-Regular.ttf	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\AnimationEditor\button_control_record.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\temporary\placeholder-image-xxl.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\avatar\meshes\leftarm.mesh	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\MaterialGenerator\Materials\Concrete.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\content\textures\StudioUIEditor\icon_rotate6.png	RobloxPlayerInstaller-WFVGWGXQ4T.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_578737676\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\wallet-crypto.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_578737676\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File opened for modification	C:\Windows\RapeClub	Bootstrapper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1318145458\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1341612540\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1341612540\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1341612540\shopping_fre.html	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller-WFVGWGXQ4T.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2524	476	WerFault.exe	129
1492	5700	WerFault.exe	144

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conscious.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conscious.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-WFVGWGXQ4T.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-WFVGWGXQ4T.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2b67309334b54dab\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-2b67309334b54dab"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1216697136-3907990103-1733992739-1000\{2CE5C82A-20DB-453E-91C5-7641F5CE9704}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2b67309334b54dab\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1216697136-3907990103-1733992739-1000\{C15827E7-5A97-47CB-8FC6-694D468A58DD}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-3a5d3d49b5cf42eb"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2b67309334b54dab\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-2b67309334b54dab"	RobloxPlayerInstaller-WFVGWGXQ4T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2b67309334b54dab\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-WFVGWGXQ4T.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller-WFVGWGXQ4T.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
476	Conscious.com
476	Conscious.com
476	Conscious.com
476	Conscious.com
476	Conscious.com
476	Conscious.com
2340	msedge.exe
2340	msedge.exe
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
476	Conscious.com
476	Conscious.com
476	Conscious.com
476	Conscious.com
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
2012	svchost.exe
2012	svchost.exe
2012	svchost.exe
2012	svchost.exe
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	tasklist.exe
Token: SeDebugPrivilege	4032	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	3108	tasklist.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
476	Conscious.com
476	Conscious.com
476	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
476	Conscious.com
476	Conscious.com
476	Conscious.com
5700	Conscious.com
5700	Conscious.com
5700	Conscious.com

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2780	RobloxPlayerBeta.exe
1440	RobloxPlayerBeta.exe
4408	RobloxPlayerBeta.exe
6096	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2284	228	msedge.exe	78
PID 228 wrote to memory of 2284	228	msedge.exe	78
PID 228 wrote to memory of 3728	228	msedge.exe	79
PID 228 wrote to memory of 3728	228	msedge.exe	79
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 4196	228	msedge.exe	80
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81
PID 228 wrote to memory of 3368	228	msedge.exe	81

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2864
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://xeno.guru/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b8,0x7ffc9642f208,0x7ffc9642f214,0x7ffc9642f220
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2064,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2196,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4172,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4560,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4180,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6612,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6148,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5944,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6524,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6836,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5004,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6028,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7236,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=3148,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7676,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7828,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7436,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7492,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=7424,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8324,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8452,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1968,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8412,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7792,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:12
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=6952,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=8476,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3308,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:900
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-WFVGWGXQ4T.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-WFVGWGXQ4T.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3344
- - C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe" -personalizedToken WFVGWGXQ4T --deeplink https://www.roblox.com/games/4483381587/a-literal-baseplate -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3344
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7292,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:6eO16hdCbZEQxkLpWczCt1KWxXny1GdZQ-INT-XC58jV6NWNNOgOzswthSXwi3NkV7KLfC9aZ-e043cYZrKE1XNU5bujLKlz6sTCZJ9tNNPZ-l2mlhsd7aOMIWfnMMW5qbmbk4cjaid0h0zclSf22Pw9EB-TctnnzI1g0g17afE8tEg8zrFdPgizs7a-povL1zxZy7hicZaCG6vPSXVJ7HPxrRrM23At7z39naDDnqM+launchtime:1741932506703+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1741932437605001%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dd5f83dfe-d36b-4527-85e1-749ffae47e57%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1741932437605001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8840,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:14
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=9152,i,13004136796015382536,725650864458915226,262144 --variations-seed-version --mojo-platform-channel-handle=9020 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:ZSpjTHhFFQElCq2OLBg4cRY3xLG2Fl490_uIojWYMqeHqm-LXjGyQ0qPyNnK9o6fuHXOhy905rkerHBOGglwX6B-4pW0NxwrFjEazBFig_T2Agc6ze69qeZUZ8k4uyjDJa7vlSRWnttQmwMATJBPO50n0MQ09grSNarDNI0R-oGh7TujAw1rZiXehg7r63slJD8fko0GbCQalaolDs4WwhSCl6KLGuV9QjK7r89ftBY+launchtime:1741932592230+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1741932437605001%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D1fbb49e4-885c-480a-93c1-2f0462bc1657%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1741932437605001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4752

C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ\Release\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ\Release\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Maternity.xll Maternity.xll.bat & Maternity.xll.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5392
- - C:\Windows\SysWOW64\expand.exe
    expand Maternity.xll Maternity.xll.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 677001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Taxation.xll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "BO" Hawk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 677001\Conscious.com + Folk + Waterproof + Remains + Premiere + White + Invention + Delta + Existed + Lately + Planned 677001\Conscious.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Greater.xll + ..\Hence.xll + ..\Pairs.xll + ..\Picking.xll + ..\Fat.xll + ..\Bc.xll + ..\Subcommittee.xll + ..\Mask.xll + ..\Harvest.xll + ..\Gather.xll L
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\677001\Conscious.com
    Conscious.com L
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 944
      4⤵
      Program crash
      PID:2524
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:856

C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ\Release\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ\Release\Release\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Maternity.xll Maternity.xll.bat & Maternity.xll.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480
- - C:\Windows\SysWOW64\expand.exe
    expand Maternity.xll Maternity.xll.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 677001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5936
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Taxation.xll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 677001\Conscious.com + Folk + Waterproof + Remains + Premiere + White + Invention + Delta + Existed + Lately + Planned 677001\Conscious.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Greater.xll + ..\Hence.xll + ..\Pairs.xll + ..\Picking.xll + ..\Fat.xll + ..\Bc.xll + ..\Subcommittee.xll + ..\Mask.xll + ..\Harvest.xll + ..\Gather.xll L
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\677001\Conscious.com
    Conscious.com L
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 932
      4⤵
      Program crash
      PID:1492
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 476 -ip 476
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5700 -ip 5700
1⤵
PID:1044

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1440

C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
8.4MB

MD5
25073f4cb774505914c4401aee524361

SHA1
2ae76353491a8cc30f89cd3e94497b15f59623d8

SHA256
be11eb7b05c6380fcc8391cbc02a35d4a32690ca77e900a2f3b1a34aeb2cb8ca

SHA512
aa1ea84f29419b3e5c326771c22ce532706ffe812bff2fc4513ffd4566ffca04ebee4b03bb6313c254dbde6c28488e0cf75073cf5cceec84372ed6cf283ccbba

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerInstaller.exe

Filesize
8.4MB

MD5
6a43b83f9199b2b49c4379f7789bce65

SHA1
243b669c116d03e310f2d046dc607151ee17a39b

SHA256
a469adeb606f747e7834f807277b55992955c27659943a38fb97814dee0872e0

SHA512
b120b5bae21e02fd3945975bdb7c920ea45d45015991555f09abdb9311376f0617ef440620b5557a5c52f168ccbec418ca644771f1d91cd476e8dcdea26d969d

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-2b67309334b54dab\RobloxPlayerLauncher.exe

Filesize
8.5MB

MD5
0c9e1cc5627137aa94a65e25346a7083

SHA1
c7a31de26742178018ff0333166712d34d4d88d3

SHA256
8aaba55f3a2ac281b7a40691a540c3074ba88f2a628386dd383c32fc0abcb40e

SHA512
cf3747611d1e64fa5ff1dbffae40c542f3e58a8ef395f08417d6baabb9c179f0843ae797e50df35df14562d60498bf72f69922be2106f1c1faf0604ba6f1bbad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ae987eb15fd5136f2fa707a7b1f18abb

SHA1
bc4aa67ba8692031bfead4b653fc6fefaee3dbbb

SHA256
f5e0e4ee660e95e1c4f64d5aa134aacf9f7fa1a9b9cfaad10f5b57b24d331d1e

SHA512
fb98d55c498ab80b1f7886b56d0e652e648666bfb13c61c20d495dfb9f2e473e24821efc48f103fb0705e199e56b3e23a0bca82c0296d690104eb0d79032c0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
8a89f3346415aafc7dda2a80d3e984b7

SHA1
895c6b85a3ce03909a1240ed9862a2ee112d9064

SHA256
47ffdea67500683b7117180e2cefe8bbc59d72afa1d14f0a104edce103fac10d

SHA512
afa81ed1f7168ff4d5f6eb194cb1ad32f90c31cf2abb363144fc06abdc0c49f1c67314609cf5669f3dc30647a56a8259fc24bdc8b092e8f8bb27ade6837ac372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5

Filesize
19KB

MD5
5c0594df80077e26802d50818ce1ce99

SHA1
0d34912bde940a447a36ecefd79e9fcbf46fec8c

SHA256
4bb649110ce0b3beb61b23cbdcbe053c2f9d39fa81be3065557fc805a6283a00

SHA512
7246cc924246ad9d1b9fcc9c3e6301b28e0d5e35b21d37954364502fa72ea747261af26ab5c0b585d0588ae67904604947208cce62621394612e00e50ea1675c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8

Filesize
129KB

MD5
471d6f48a773631edf4531e2c66c43a5

SHA1
9d76c2bb061d43cf773e4b7546852e49a5314e21

SHA256
4af1d8c6420355d8110436b19efc4e4c4162ef5868bc3668f7bad2c785fa3dc2

SHA512
3c996f6f909e7e561292b3abf24545bb3677f6cf053f0e5958aeba60192d356403e51dcc6fbf20bc77a40dc2fc4d43bfe183e11d85fcce11fb1ca06c0ba8efb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001ae

Filesize
43KB

MD5
bfef1c88c7a2462d08b6930531953552

SHA1
6392a0f160eb73330bebd4c324535445e0783231

SHA256
5bb0ddc5e9112db6992a4eb1252b36b666ca8de22aa5d09b1d083794f2acef4b

SHA512
339ddb4c82a5456623c9ec0bf2574b22d7e98f9b2002d5d9616197dbac6a76742e146ec77e8d3aa8caa3c6178125bea0d9ec57324b28dd52e778055a4eee204f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001af

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
10KB

MD5
701a412bb2017c63065f6eb4eaef7088

SHA1
cd78986694d05a66ad3419df43a0532ddc8bf9a2

SHA256
ffe5e2fc8a8b23a31e242fe5163381d5733cd80e504d3bac081b28bc9e727a38

SHA512
1f40705c36ae7f06d8d626962afb89a93c82d62c4e21aa324019c633a665d9542dfe7a3b5a2b77d602658902eb95ded9cebca19e6f3f7fa809add76c1c2f7d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
12034b59316b374aecfe9b0ddc17e910

SHA1
b97a0c300955a3dc99e44824748b8f74fb2a67a2

SHA256
f1011a2831b1609761c51a64f8cb63ed1d25e1a45b785c15d2da2360f4e69dee

SHA512
935e362d3066e596c757800456d74664593f0e2d8a8e0c358d2822b88f01e95c9547a489926f801857a6436c9677d50ba278f6046767cf8c638ca9d230dd9b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
d09fe6273d63be215666a1120c0bc13b

SHA1
cf22f25a0ba52f62df8fe6eb7eed0123abcada76

SHA256
262f3f8f854127982135d4bdbcefe1293ba53c07ce5adba140faca879c31cc21

SHA512
06843489d3bf168c59a030c6c701da00166727ad9e20f77172c1341ed392ca93487742c913cb38c13ea33073075c2df09b9a76f9186f025a50426743ae34ad5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58393b.TMP

Filesize
3KB

MD5
4cc70e3bf918c9206b5058f43d7a90e7

SHA1
8cb80d29fed56bfa901e698cc68123a21e0ba82f

SHA256
a7665f5a3cd35d62e2d3cd8ce5328c29a6afa169a8f0b955ab06973a56cecf82

SHA512
06584c499bf3412e594fc3a8193d261d3a2705ed8cc3e2792faad188a9e270ff1e47f63310f96dfa556a11e21296d20fa0e8b9a15b40869068d42f69e3eb0dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_guru.transfernow.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
f5b47f72cd070ceef0a6fb6f65c7930e

SHA1
c1aa2dfbdffc94544d4f31756d9fa35ae82f07d2

SHA256
3b062f9ebb080b9e2a590f5a9e8a7b0c5432cb31dea775567f26227541116269

SHA512
3e8a1377c7721bb9ace3f167a7fcd42f972ec72a8aa9a1ca691b48d56bf7234dcc6089f57a60ffd854699275344f2d30e5d3f4bbddb871c3e1a29c230956e7a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
bd286677357967dfb4ca74ab37848364

SHA1
833bb699d79147d44bfb4f34df3dbb79d1c0331f

SHA256
13a7518bd54e00551d01521fe57a90e53e8a38631da5506c8d1f2dc8c745bd1e

SHA512
f1d52f43d76ad9ede440277b3e8a2df9232babb2b561126faf822c5da12318b670ac71fefe98977f03a2c633edcade891f343ee74029f1bd3a4020f1c4e689cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
513B

MD5
4df2122d4c7733a883e1f4b64147986d

SHA1
f8fabe179b31e2646ee3d44b961c1aadaa3bdf02

SHA256
a911f3503b472efc04a23a7a8c2cb5da1e3ec20e2d42d09760925b3f416e0219

SHA512
16ff9dc1919dae788458e4ba1ba956c296fc487379273e79ec4a2a0315d26ba6d782bf65effef203d02bea2b06ef1b228417c3a8d6b6c2145fc6b546aa5c3dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
b52f6536eecbcde4e1e9aa27ef774471

SHA1
eab6412c5aa026b3d3ce6974777a70d768029340

SHA256
dff882e11e35e56c6a5c46b24a1827fa2e84ea679562c74bb1b046e996c1f823

SHA512
32d64a807161e668f1abf163f999dbdcc0985ffb6e6ff329a1427b5bfdf08ae2337afbd2fbfa9e7d159741f7ed4cca5d857e2236f3db6039224f266de3f19e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
668133fcded5728989b85b5228ef513f

SHA1
2726d952c2e8468eb5152b1cd85ed1e9a6b7a83f

SHA256
5f1650ede17710c2f0a0a79dca80f5e05db2ae97ce0c496911fc0a311a328e5a

SHA512
256c4b7b0f8aaf2e5f2ea80f357b5e22dfb90e3a5eb11305e41b1564c7fcf5f7b68488e82c7c353d1f48125c761788d5dc242d4b16b66f4822591f324f088dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e961e2122c45f5379b1118de6f49e826

SHA1
87b9583da7ecabfee59719a598337d24d6277843

SHA256
63aa67f7d7a483ea4538381680de822606a5d599985f594a3b130c85518878bf

SHA512
bd23cdd240e20a305fc8d37972e8323e0dbe801f3ebffdfcfa076951a3f7e32439334d4c48cf62c09bd61427c6ba6da7aae5e85f3f16f78ed90a51c62e07b3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
189a816e35e52425c5cf5114c8b6d731

SHA1
8ad84365a3a8d198e74b2dbb09650691f6653e04

SHA256
4147fef57eb7f00148c858ac2763125c38230e359d2ab0e4ac44e9a5cc785cb1

SHA512
12782e9543174aed477f69f86bb4501e2d211a8b45fc11e40b52130ef0e25c3c8135f2cee7ac2f45b1d6beccf067ee425524c2686f5c2b59ac121577e2a2057f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
3bc619f4c18aae247255caa0a6a441a1

SHA1
44ff271698c3af5f3acfde6a38d4726d83069f0d

SHA256
d98be29b1ebd419baff8b497d6a3e661d4f057636cd325471f31153b0b8b3870

SHA512
7772063d45d8f5c9cca1bf145577983b11a4e2016a2150e206570a5251ad72500773fc59ef137e90af11023ba0582cf1da659a6b3775f11b582e48e9f84dfccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
36be6436259279f4ef04685ea613c0bf

SHA1
a461236e33fa8f398c93bd1fff31b0c3000eac0d

SHA256
189770b2a97e928170c97b186c0339a6394a8d5614c1ef2e47db65f62db15441

SHA512
90c30efe02705a77e4c24e8fca653f1bbe09240442c38244b195d62eb4d0ce1873382cbf00355413d02d31c4908968c33b8cc37b1d7617421c9e6e4403815fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
414KB

MD5
6e50c0012a08560ae1b6d6001eda9849

SHA1
9f3a8e458c03fe7bd86c10a560343f1902146f1d

SHA256
7d40fbac633bf04d521871b7b639ebd7ad6cf09b8f7f887060bdd2dd4ff046e2

SHA512
78d4f69c62c4ce70b45c9fedbe5433e602f12366fa8e184b9e982b4ed81c1097ccec8fb91f20a7944d866a3a9fc723b104459db1645150296204c2a6f3c964b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4fc5b0f7c146fe592c6a2f3f92ffe3c1

SHA1
1c8fa1cf785cd001fb978d25125002b32c283043

SHA256
97f18985afea389c55392c13523db7e715e4a3779cf71df850f22c0c0b23c89b

SHA512
13c8fbe661381148c2efc837c3255576763704b5059ed18817994e6e85087aa545e16668c3aec92db63b23dd68502ab090fbd319309241370bb56091b40766e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0678429132183434dd10b67d06e18648

SHA1
a729424283196b085fff9071cde2a339a0b418d4

SHA256
c65a1d02941acd03dd85f96976e73c449727f858fa7486f144ac63d53c5af3cb

SHA512
6440ae7754bc10f860ed80f6ad9f1dd99a25fe793e5223840a766598e61c1a2dafe27de35f33d04a8afcbd52343050384f84ae17d9eae0d15000e61d0a88ec82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
17e6ff487494ce832bfcf25506b7a4bd

SHA1
141dfe551a60e68c5584eeb9741c20fdd0403f1a

SHA256
eaae05e6c0a8a24aa58a76907ea10e47dbc1b7dba6dd1340c8183fbf71d2e5c4

SHA512
7a4dbb2196dacb69d7c02e400e85f698bfe969abe0f95f9fb05139617e4f3d9e1e04d5a6af5b7308491c542cf35780272dbe92d2aa938fddf2170ea1c2c392d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index

Filesize
2KB

MD5
eaa06c61865634f934397cf53b893b76

SHA1
744d7ad43d6af188221286d81b4941f1b0cf1438

SHA256
84d8020249daf2d0b7de327c738cc68abfaf01f7dbd395c6909021e9dfbcfd21

SHA512
c632693da6e44ecb26786553169bbb4583c3858f8ef7867777ab9c83d7f4174a288458187b129343a0cef19b104dd0bc29e868ddfbede9aa52113fc4391a1061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index

Filesize
1KB

MD5
bedc2a7b2f2d6218cf91c6717d7b2546

SHA1
121b7ac477f82182a598cda68447ecd8a852aceb

SHA256
daf56b389c8f1a9639f620de2c9f2ba34b32f561fa069a314724967e14cc0550

SHA512
9bb7ef593bdbc92fad9875ecd345624b45ae9f2e88c3a966fc05dda44f720facd660eb328a4d30d541b135b2c345c0ff2d5f9bd37fef0e87e2801dce93509eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index~RFe59b2cc.TMP

Filesize
1KB

MD5
799af721ef974ac6639d8e3509b214ce

SHA1
4fdbb5f101345247133aa54191b7b9aa03b483a6

SHA256
685ffa4457fade9720b9a716da4baaacd7addf8027ae846033aa409b923f5b9b

SHA512
d8ff4e5b6fadc4c894ad9d197359692b0755a31caae16e892f12fa6911b73c65aa06f35486c75968616009fcff77e70b0b9897e11201af172f04164135156aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f374c807-02a5-4723-b955-071c984fdc10\index-dir\the-real-index

Filesize
72B

MD5
ba57f05fc39ec95b2a77ef5bf22c970e

SHA1
19e7cab3603f0993ae997617d1a8ac4a426277ba

SHA256
f3c2b07eea3d72cb9fd62c87a2fec5c9379919c386bf5b5bee0ab9cf29fa0de6

SHA512
eb74e95f4cf4317574613add1fcc9aa6a47dd1e66e8861d39e64ba1b0b743545824d9ae9468fded782db82db4bf2d4f4193e1ddd56b72064382631fc6f318901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f374c807-02a5-4723-b955-071c984fdc10\index-dir\the-real-index

Filesize
72B

MD5
133ac438b2be7ba1abfaa5227d974fab

SHA1
b26e10f79b64729496a82971e3777d63af235cea

SHA256
a9529f34293f0338b499f7128407d9be8dc640ceddd72f14d67de4654db3a98c

SHA512
6fccb4303c118e247480b4b5c4a62c9817b9736b96a2dc840ab346645922af1664c964dad79ac5a1123f4b7ea6a34e369f79ca1f7fd560e2e157972a67b4196e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
7593792fc5fe15b45b37d2f2c65ee7d0

SHA1
48748e839c4b26b3ad07c23841de7148a15c2746

SHA256
1e90d496c3a7190c7cfd79ec31544ab0e1f59f0865f527070635d0d49a0f67ac

SHA512
ef7b3910c0c333f9aeaed73a63030c96318f72614f67aefdda4ea14c062c0d5ad2236ad491fbc529fa5f268b5a6f8eef2c6a676131534244ce2ead0b0eb22aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1cf70c410745a4aac90552da44963748

SHA1
1f595247b475d54e665409a27854d9a200d41d12

SHA256
37c0d0534d9f9b3ac8c877fc4a290d29c60ce4f6a542fab0466ed364bf698ef7

SHA512
871a5d9a81b547c601ef61f3bd87243269a723fb08b0eb4783cdbe72b2bf64d0ea8352ad20365b6771fadd43093d603ed6cf287cc36905813c4626f94437b7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a082f.TMP

Filesize
48B

MD5
9407774721c375e36e1da231ad0e2c69

SHA1
cfff6ffa8071eb6ecd616cdbfc4b7dda6e5b0a92

SHA256
c7cf2b1d202e632923178f866adefcfe65fe867bdcdd4f03af686b696854f51f

SHA512
587dcecc64c0cc7f075735c8e1ed2dd3fb48f26551975366fd3923449f8733ef886120fc7e3067a5a18e1bde1c220c5da10fc217809aaa85c8b4bb52a89082ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
aee1bb83e67b65f474f59213ff439fc3

SHA1
0743e09ba7b61e5d7da5a6a191a0d8f77ec4aaaa

SHA256
6b9d7f8782fb1307358f68aa7c1d9e25c1a2a64ba1fc7f5a9ce296aa79b84345

SHA512
8492ed1c2c50da9c0af1eecf2151ea96c3ed803d97f07e2ecb31d24ce2d9d8cdf45814c645a9341ee798394a7a120d893e1081fca3e6f2ac5d51e6a12029e3bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
460B

MD5
1e9f4006a65391c6f7fab967c5222100

SHA1
470192a1a8bfc61805c1e80efb3f1214a14160d3

SHA256
f83f9f9aca1245cd2bacd3603191fa2803f898f73ee93501f1891045c5b8d62f

SHA512
f8299c786944e0846f225143e01c24a0398fab036ed9b45f108425fe8ecf219bf7dc64bc32d95ad232e86c2487bfde5e104f57876f1bc5bfd9ecb5fdc8353413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\buynow_driver.js

Filesize
2KB

MD5
412352a121a62092628029e9b30158d8

SHA1
0021445df04bcd60cd83b670ce1863c42f1f4c11

SHA256
87339a1e25ccbbf120f294fd60333e292e1d631e785a9b205ed5beb0128c214f

SHA512
ffd266f1161ab996f38a6d0723e2cf96840b500cf2aa360f48b7953d448a5cd3a2fffa666d9be9c89dc4495497d5016f1199e6419a82bdf18fc99b8a8a4eb596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\wallet_donation_driver.js

Filesize
1KB

MD5
03abcce3f9828372d9876aa2e6fcdbb0

SHA1
cf5834e1af5f7143e62a29ae0f7ede79178b3574

SHA256
39a63d56be4f1ca950310f385e8a42f7bc2dcc0e49fefff306176182bfa4f0e5

SHA512
ef9b7decb4cfee3961006ea5c77299a48fe6a667475772f2a78e93bd4f691dc4700f8008138c574898fdcd8d717d84b8b201527ddb5a61346e05d362aeb15701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
2d6825c9fa3998f99e67b5eaeb4d931d

SHA1
9c7e6750e6feb19a77e06b1cfa83155c6f30283e

SHA256
a4a6ec51a408aaef7446f0c37914cee437d9fbc67bb2993abf4143c772ee1feb

SHA512
bd5365d64c809f705b9889271adb48c8b0f33bd5716913969ed32c2725906ee6429566a7a7fe5cf0cd287f982461236d8dffc0055ead2ee73a684f9b64788f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
33abcab0cfdeedac380af59526b68d62

SHA1
1cdeb608bada68a5ac7165fb86ac47b860d041b6

SHA256
ff3e44263ed0ef480ecf98a60dec84a8ee5af4705d2726e18d3d03f0db7df9ad

SHA512
a264a141e494caf9d3a84b536469ff16f16959ac1d2f27642cd123162a6bc247fcebd38da0c3ca4fed346220b7f03ab29f0be62f8bbb67f2510e2ace07ab99f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
5848ec78c0efc0e364f34aef98358ac8

SHA1
ab14cd7dde30ac6c171ec961f6a3bfd25f1547d2

SHA256
c4b11c5912ac5efbd937b68535d81d3e7ad82042c216da64e24d31ed318669eb

SHA512
6ab10a987df747b5e09834284417efd315ebf6a2576bd87224e004e7c3c8b154a35cc78cac3bc3c237d83e00bbf2e7b23c9e08d7e1042e3dc5543e2399b4609f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
f30af8f0f9faa888be50079c4ead24a6

SHA1
c979e032f756eb9f9472b11b888b5667458613a1

SHA256
f4bebcc95fab7930b4b9fcff2b4f6e7210107d622955ec6355dcd162e7d411a0

SHA512
b0f045f1a050154a44dbbf63453dbd97c5afcd8c94b6dd3073c26961c238f106cd60556041354ae42a1e058708db9c8a9931b75e30c01147df804a8ccda537e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5e7181681549c4ee5bcfea41f4f7a0e4

SHA1
309027b6ccf4cfd9d3edd76c26d7a3898749e595

SHA256
c53666f5fb6c637a42b7014b25fbbc705df4ddb054e71fcc881d553a2d154c0f

SHA512
93d93e1758eabd54931d817ce63444a9c14192f8e13b9896f35996e2dee0d3de66ae3707b2844604a01acc5f4ac4e6d7b297081bfb3b4af5af71ecc7e31633f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
1366872fe06615376dd0fcd57da5582a

SHA1
b9630a48edfff9aabb463dc598b13a2e7defbcdb

SHA256
7b51a11ce467a8df9e9773cfcc694b01382057aa4b4d09011fa4a42f934afb78

SHA512
4212ee94225280000176a2140adbf05c7b5df3d53fe43983f174183e1380418ebffedcb800cafd6e7704b32878dcbec73c851d728e0a18ecf9e93db4c783d2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
6b28858816ebf289802dc4d7422d119f

SHA1
9c930557bbfb23177d9b7f8a135b206d71efea32

SHA256
0f87fdfb2a831fcc1878f63d726e1efa51abc4e006baf58db4bd6d2358af2161

SHA512
b3793aa420cef4dcdd30423339da08d5c6d039e6dea053e9acfd244008c26c74c500f5f8bd7e7d38e59a376fb2c625ff7e5274eea92c5c1f2b425a209825f6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
34b88358a096ca3169af0492f00c45c8

SHA1
fdaeb7706837173cfc65843daa50c609cbe9028f

SHA256
df27e2252a6b14b202a300eaf5b4b48f19bf4e6984751f15a2465d0513f1d7f7

SHA512
0e8f0fbad5b468a521c09e1785f3151ea016ba1b0594e57d49858ca24eaa482045a51b9d2c0e49b600a7325aa36dbb27222d43beea3dd479b07842466b293028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
464190f331fe23ca4149c677386958bf

SHA1
23ccbba737a07de1c47feae363c4560abdb91af1

SHA256
6f41922c3e748cc44f67eaf1e6edef989995ffda0d87dbe66a2d5b7ce858cb28

SHA512
75747fc0c8b68c2cce4586a155af4eb580d59eeab3b7179b31100d1d4a96e5d82aef7c29dda5cfcc9d43d85c20d146e0da6b05127672b9c556cadcaba185c812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
08f0a7eef4ac68a9b88698e76e0aa262

SHA1
2fd1d02639ff6aa54260ec65062c7a9933111b62

SHA256
2a6c20020edf8e1e2e8fe2495e7a72d14d80ee47c92321bfb177beb4e991c1ad

SHA512
82e64b1ca7e9a897863286afbd522a17d1a990a069deee0f5660974e93f3bfefeaa753e18910180021a36876bfcdfe9be1419a33d4345e6853161dc7fa66d01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
aa20321e815882ff2e692025d4bd85d4

SHA1
547795e87a3e7d31f8967e9a5bed008850be1a54

SHA256
bffd43e076d8e21f81c962f5b4868820450ed9407d601eb426bac8f24ceb1fd8

SHA512
a1d4b1351557922d0d2d065e460e2eedd7832bed695d9f526b818a3fadf267359839233e001228362f802843cdab35f0f0611cbce7f33f052748961c0ba0812e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
1471377909f4888b157e10baa0f91744

SHA1
d0c0b0c3ee82f0ceaf1bf148e93233f33f17e9bd

SHA256
f85e244cd344f58a0edfe966de7266bb8d5c959ca1fc5e2c0392f99257996903

SHA512
3fc571eee67e1c721fec63830b03bfcabf326714abf69f655e51cd2e35ed996145cf3d753bdba61be5533c6d0cad498fae1663cc47bf7b0eef186478d40ed1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
eb55b0c74b5c4950956207ea87a01507

SHA1
cfd3437b19b2d64b130a37d683ca1635c5c4cf0a

SHA256
5ffbd132112b9123f8619277cb0b4107b45120986e5e87cafed80dfd50bdd5b0

SHA512
4cc5327d6f09e233f87b115904ed04f32b39a27a78988536c722bb13fc350c88d5bfe6b1b35a3fb4c1fa9289969433d0fc0d3fc6e17b5a0eb4d7d619b836a239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59c23d.TMP

Filesize
392B

MD5
448f8b6be762c2102ade66daacf66411

SHA1
1195ee56e49e0fde407866740da7d4d6f63326f6

SHA256
928f196edde31d41f489b4c99cfeb47936a6ad45b65c964160452221c9ae7363

SHA512
7eecdf66797f739dcb661b7282ebc9d464eb4aa8e23d4db653b64010a423d12dd9686ff8d204ce9dcb5efab89440ed1429e14dd5328116e9cddae2cb0998c8f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a97b40a7-a9d3-41a0-b934-f890d4a90acf.tmp

Filesize
41KB

MD5
1c21f9abd29b8e0f2f0912aeffbfaa71

SHA1
be72d1670658dcbf401f527fc66b160029e19564

SHA256
9418d2d003ea0b758e26c392991d103c2d77a0334f8fc50ee0211678d4073d17

SHA512
af07ced16577aea7107a19e1adda45b73d571c63e725bd1808a24311e317ad7908fb62e073056e51d14a3a6abef189d094f564b77136dd01e5bb894533fb9636

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3851a56d-3f8b-4279-a2f4-566471fcdd72.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\677001\Conscious.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\677001\L

Filesize
656KB

MD5
b6cfa179ed4f6ce4d1c3f733dd5fa25b

SHA1
6dc3a14ea9f3a6779b6227398af17991ba336dd6

SHA256
04e7d931a1b767e2bec8d954d3163505b44078f500d589447aa2b8fda632e98c

SHA512
df484ecd9aeae6f04ffd9cf11fdd8d425225eb8d2868ffe29afdfaee4a337ce45e886e687c05808e5546f70bd45283c0a4c2c5a25ddd53ccb060768654b4044f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bc.xll

Filesize
61KB

MD5
6ed41054372d0bb368d955d6a070a803

SHA1
f1a9621dbd245cabb08f3f4296569436a9474ac3

SHA256
598d42a7c5a106153b7ac405d6f2ad84724e1d135759b46d02bab971cf08f5b2

SHA512
e86e97f3c095acc6bbca870d0799e543e4d95fa9de9b26af9a9be47df06dc12c0d77f0e223a0068e191a2527bad804eb84e16a73763628befe7765b04f360903

Download Submit
C:\Users\Admin\AppData\Local\Temp\Delta

Filesize
121KB

MD5
e2d166e544d58a05a4c83ea6ac5561d0

SHA1
4c2ca5dda02465593ad4862051ab626c9edfc5e8

SHA256
60ba82f844fdb8217b8ac3f0990276001e499c8c55f5cf4b2c95fc61f0724531

SHA512
770ed44f6631ff52294251caba0673f45c10c7550d71fe6d43c3684ad9a3f64555b3b405fe6f43d22e4c00a5fa34b90fcb4e29e1ffd105c89c8105e2359d89b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Existed

Filesize
73KB

MD5
7981ee35c049b171464c6c15822abc40

SHA1
a7dc0311faf545bc16dd5db5d66a44db863ebedc

SHA256
9d59f5f2b749314fcee24515f2e23378697388ae25571d0c070d5a62a3b964ae

SHA512
5538d2b6dde3e0362997ce2495067cbe0dc3c354b82328f245479b8c8e62e66a85d0c16c8b8df69ff7a8d7bfa562e8f0ab00f861857302da8b4389b668490124

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fat.xll

Filesize
74KB

MD5
db0a553f0830dd13ea00d489d75a59cf

SHA1
3be047bba4f4f6252b91879afb8eb1448e985463

SHA256
9c99a9c5c17fe4a33b81b5118baaad232397d87516f15718b73d028c34f29afb

SHA512
487f16c427fcc7aa13a058dd401cc845bf07a5a92de3fb49edf62a4be8279edf80ffa14465dbcbd5fd2fb76674c193995d9afb992ff9b4cd24ca7ba78502a066

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folk

Filesize
133KB

MD5
6ee9cdf407cd19594250963cf9d181f4

SHA1
fb6f1977211b72ac2ccf550782c8acde4283f605

SHA256
b148578386b3ce0a7b2da505d33a886bf8f8e671c0d73b3bf4f9ec943c11df5b

SHA512
b689606aed7bfb497870bd36d543538e5ed76f19a005a1d7b9bb6338b7b6e5860ab880b8b26124abebe188ac9475a606639c65fd0649fd603e84de7718959fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gather.xll

Filesize
14KB

MD5
ecccc237fcc18a0d5b0b27ade82dc8a7

SHA1
7d67280fb4eaf263b0759293c334e621b0c28333

SHA256
8bac425f8c5c67b51d4445bb4364002e01259f0f43063317c43a8efd70eb8b47

SHA512
07aa172f0c2f69a4766653bae1e2e85947748f361504196476502b32b872919da5f068ebe603478eb1d57fb8a9a1d24b575f395eef611f0388f0a5bc9678a982

Download Submit
C:\Users\Admin\AppData\Local\Temp\Greater.xll

Filesize
70KB

MD5
f1fd84ea9b8e52d3c74b3a2205d704f1

SHA1
f08981533c68337da0fc57093b5f7ca34e8fae1d

SHA256
9b73986db9c06e3c4338546f7e270f8b6c28c376d7b6aa7b626eb966553420a2

SHA512
40e9be86035d27ddfad030f49269ac12c661252731d86276950337337685ba49db5715c2fd4b1c4dfc315f912b805e2efd73554e898a1048a9bbaf3d9e0bbcd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Harvest.xll

Filesize
52KB

MD5
7363de7605e5ff4c3e265dbe5f4ac73d

SHA1
83cae618c50b7c3c5af42408be108a4b5b356bdf

SHA256
3e76968c44a7283c0f4f62a778f69edc023402e2ced36f173305d3e3f693ff0e

SHA512
a2c49016069acbb85bba9f8a46285b0a43a95ba8ee5c87b97894c5d8f1d48d4b81412f443948956fefcaba43f047b8e88053517b06226d2654c6737e0c4dc9f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hawk

Filesize
2KB

MD5
2e435f7d586104b55e8d83d058a7b904

SHA1
ff6a1e8114acf07e16ce7f389ca002c09395c666

SHA256
6013a458d944c51b222b664f37e2deddc027b21361d88e338a00073a93c60eba

SHA512
9d4961ae942f0c1c11ca9418b2a827b21e630fbe684c4d0ceff7c3aee4b66b3dbf6739058ea4440f0e21cb0040a58d1c133eb749d1fc79eed12439a505a63cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hence.xll

Filesize
98KB

MD5
e4fb974bb5837a2b5488bcca63d704cb

SHA1
a3be82b22ae0162f9b98c69dc9bb8e818b0a780e

SHA256
fd253c98c7fad4302fcf15d06c4d649e93c7efbe206a05c95bf55a1d5cbe4a68

SHA512
433b5236eab56aacf9cb020c3ccea858d03379a41f3cb9fd355e10ccf22ac458572949fbe44d1fcff4edecb0db373c0668d3e612c74017c1c8ae5088ea21d770

Download Submit
C:\Users\Admin\AppData\Local\Temp\Invention

Filesize
62KB

MD5
3b9ac7aae61bcff635ec1a9bb19227c4

SHA1
3ecac11aeb7f28a1fe1fb4d10965d9599b0b595c

SHA256
c6f36f22c89d99d50e8ca54cc159c59c740a892467576e2d1a6b67c390c25137

SHA512
59405e79a086d2fc98fd477e57dd3b7d01fa2556e4323a91b821602c2582977220cb2e0e5cd56a0a092ac5715d44d2d50b720466b979ab14118a96b21d51cf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lately

Filesize
97KB

MD5
c293bbd0693fc2240993a22699142b7b

SHA1
78b5608c1cdd3c86e55431199f1cf50cdd7d7772

SHA256
735b9344707f46e7c81958055b4c77ae3dc2672fec6f0eb6349082dbe1c2e456

SHA512
61dfaf9168eefd56602ea142c0d4b9176595907c2355728440bf17713b73f2e957c3724cd461cee753a42cc6092f61222aa75f2201481f1c773c2605d6899791

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mask.xll

Filesize
51KB

MD5
63230584f42d7cb40c9741c18fe0d4be

SHA1
a7b89c752e59c7d610c39c42ecb7ae510aec56e6

SHA256
b4cdd291699df575c017a8b5f01f7e51f21abe9ab33a2dabd4cdee241d3ffa29

SHA512
d2f9237f003d9f38d8113d952c04b7a998a18ae34295b386509f3dd86b01a809ed1556a2f2b30bfa0c10e6464e8ec2d02a71cdc6db038e9e2d61c5df498f7de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pairs.xll

Filesize
73KB

MD5
b6459f6df266d629b98353f547cd27e9

SHA1
0a63e7f709975dc46049f7a86f6d3fe36d9f202c

SHA256
ed10be904d3789078628ee68e74d9f5bd86dbb965d1019e5c0bf57cf988aabda

SHA512
be36c7bdcd4d49366c4203dd94a181182e8748dbf0682d9b55529196e76f8fd9c06fa58f19bfaf95200f5e9d86d7220306477432f6320ead0f6fbdb4015c9b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Picking.xll

Filesize
96KB

MD5
3c423a6595086f8c05c9a8c93deca4ae

SHA1
2df46cfc9b72d8b2356077ff70152f15bfe1e9c6

SHA256
228aec6da2103ffac6868cb0cdf37c3b0610d6b89b7627ea7e577c7bee2aff22

SHA512
750a948b7df9f0b7d497574d5a6c45a99e0283886ab458861805e8faa5566d866e74a8258737cf11e44f7b776be4edb70d3e91c15e6a2a1f4c73886292bf7812

Download Submit
C:\Users\Admin\AppData\Local\Temp\Planned

Filesize
11KB

MD5
0f2f84dc507612c3c5280313fbbafdb2

SHA1
9929bd6fc1e5cffee4f3f93e1488e3227ada824d

SHA256
1ec6cbb5d0506122e8ed557f52e81d33f09f2e14e8f09c27c2873303c1a37670

SHA512
3a0329c2c30ad469cba29a33e3d5da3140a3b023246e55db7f1c95af564b961d33c1aa7e0b32db0d3c9700a54011751abe178930ab0b8f91df45bf4fd3ec6209

Download Submit
C:\Users\Admin\AppData\Local\Temp\Premiere

Filesize
144KB

MD5
ee2f6e1863a4b5143551091905ae3dd7

SHA1
ae37402d61932d9f6dae1eea7a2d55fa45679d5a

SHA256
857746479eed6f566336a2912f850c012863593719ebbab4617c1910653becf0

SHA512
37ea6efa251676b21f4b80ae6514303839df8c9f1df1b768a09b77aa44cea2c0497c0436f6d3fa22e30482aab65e990a52b94c9c570bf16067e61775c5ce2c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remains

Filesize
105KB

MD5
0fc44d9e7a7b1bd1a934d0b8aa1d80ee

SHA1
32b0c3577b19bffa75277a2eec6c0406b7073fee

SHA256
c3a68e71c7baaca31ac8acad536156f7cb7e32ceee51ca887808f10238904496

SHA512
6856be37e77c1b0d321a3923822d2d464e3d4ad94663021d4f96a85be5842f28148e7b34c483a291cd4b735df993516197b5ab198af11a0cf7c84d573888d9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Subcommittee.xll

Filesize
67KB

MD5
9a631707f4c2d2a8b86d01e81fde674d

SHA1
3b78693ad353acf6833e802ddf398ca7f9cc7fef

SHA256
d604a23485e9dee5b33d5774b0a3e22b397b7cbc30a907e962da4eb47420bd3c

SHA512
e30f850229a3bf81d566bad909da64ba5a174b288ecb925a3b4fdd4b557a12a41ba1aba61efa9799b86f74d99f7036545705e0780941a5a60a4dd5cc3b19bf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Taxation.xll

Filesize
477KB

MD5
0411b1071d2588fdb5d6a94fb832009e

SHA1
d3f52cfb853dd5eb5b510d7af4bffe923c693548

SHA256
93d7d94d0874f6889e768011c33c826523935f4e0efadd575906b9f93b368825

SHA512
3a37aa947fd3eda3dd23ab155a48e9a4d8669b5074dd1b4e3ecc26177199aa51c345ebac18961f3b1a49d14be3e5e53ca3f4f222d56eba222864e4ec18564dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Waterproof

Filesize
125KB

MD5
615cd5feaba3f3229ff23d950a2d6592

SHA1
27fe119c5b964a06acd154942461fd65f902beca

SHA256
6e4d88545869fa0eb96dbebbe8ed3e5d2b7b8b571dc61fad7ea87aaa9c291adb

SHA512
8d301136beb5e76770e454ec88b55b571de30900d2f13fe62243e11e0d4f9c164ec6fac4f77473699c15f44dd063ff7bcb6f48adc7990a38410865e1fb9eef2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\White

Filesize
51KB

MD5
f5706e17c94a7e8e98e00852cd505042

SHA1
dc1c62bad8f456cebff4c8dc904de5cdaa8549b9

SHA256
ce75f92970122600eaf633fcd2e733a41b977f9a4b67674649b13f2797b5d490

SHA512
200e958e0c86298384cdcb9338ec70a4fd5b0ae89702eee86538eeb8d2a53026fa4872ea5d77649ec3c363ca9c4a6f539e80c811088f60dda134424894df3289

Download Submit
C:\Users\Admin\AppData\Local\Temp\edg4B0A.tmp

Filesize
28KB

MD5
583a92e3e37000f345e297ccf15e3c08

SHA1
76cee9bd8f27309c4af7aa52824a4d2eddb8f239

SHA256
82b24606ef96c7ee458df1be3e5a1ebc8714af9edeca19ac5b359d33a833eb3c

SHA512
42da33c01d3c7793ceb56f5c8a33f40a61a6ed6dfec437697e999443df5a3b6dbeaf9465bd7f18235c490c01ed87321628bb2bdf8a3eda6377488707d4ff35b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\maternity.xll

Filesize
30KB

MD5
fe2b47d95ebbbe6dbb215eb426999ccc

SHA1
7b9d70adcdc52ae63c3578d3479b6159cba3de5d

SHA256
8a832b996da79f08801ef99954e3f79ce01ab6dda8d80e0cf73b5db8ae74fd56

SHA512
ab414ac3516ee27f04301dde62f55da71468cc4f4cfbcbdc69e04e96f63e92236723a64fa62a816a7dc8eb8151e18c9bf7d071c806a45b5f48757f1f5955b88c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ.zip

Filesize
43.4MB

MD5
0b8c5470ca473334612dd8f57302f680

SHA1
d48084f187608e3f6968092d5c9eacf5fa68d032

SHA256
f814eeb2f4bfa00ce1493699cce1bf65add045c03007d7d8793571e84ef2b1f1

SHA512
9784854b47ef7fe9a65b27871b45f4eafff40d43f95d73b4e8055358310c6a5cc713271dd3307e72aa2805015805ad8146706d5ebbb2b54ae6d5fac0f3b63bb7

Download Submit
C:\Users\Admin\Downloads\ꌃꂦꂦ꓄ꌗ꓄ꋪꍏᖘᖘꍟꋪ.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1318145458\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1318145458\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1341612540\manifest.json

Filesize
145B

MD5
132a3aed904708f6cc53542505087fb7

SHA1
be2289fc538659c2f08d19fb24ced83b845dfcda

SHA256
d188d64484710891472adc87350f83ca81eb819e1582d9387c94a36812513e79

SHA512
92945e70383a68998b4af6c108b3b2cd00d1665c000dbc71c53325fc1609b603a74ac9f14302f9876d5c9a39dcebf293cd0df7a5f898607125a16a6563686c96

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1797480603\manifest.json

Filesize
121B

MD5
fde1edabd926edaf85bd8dcfd6d26f0d

SHA1
380c447a4df3871885c99d926edd1e689f247b99

SHA256
3bab6a96aa24d25d5f838199dff00837be00480f92a559d30a24f67334e02a2a

SHA512
acc5b7ee98a6652a74477d2a9b295ecdacfd0182b75931653d373fdb15c52d1d869bbe3a41e4a79db36ed91ed55c39c47526268b56b123e9b7f19479bbe8dc13

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_578737676\manifest.json

Filesize
1003B

MD5
578c9dbc62724b9d481ec9484a347b37

SHA1
a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

SHA256
005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

SHA512
2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

Download Submit
memory/476-1736-0x0000000004CC0000-0x00000000050C0000-memory.dmp

Filesize
4.0MB

Download
memory/476-1735-0x0000000004CC0000-0x00000000050C0000-memory.dmp

Filesize
4.0MB

Download
memory/476-1721-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/476-1737-0x00007FFCA5480000-0x00007FFCA5689000-memory.dmp

Filesize
2.0MB

Download
memory/476-1739-0x0000000075570000-0x00000000757C2000-memory.dmp

Filesize
2.3MB

Download
memory/476-1720-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/476-1724-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/476-1719-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/476-1725-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/476-1723-0x0000000004C20000-0x0000000004CA1000-memory.dmp

Filesize
516KB

Download
memory/572-1745-0x0000000075570000-0x00000000757C2000-memory.dmp

Filesize
2.3MB

Download
memory/572-1743-0x00007FFCA5480000-0x00007FFCA5689000-memory.dmp

Filesize
2.0MB

Download
memory/572-1740-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/572-1742-0x0000000000EA0000-0x00000000012A0000-memory.dmp

Filesize
4.0MB

Download
memory/2012-2190-0x0000000075570000-0x00000000757C2000-memory.dmp

Filesize
2.3MB

Download
memory/2012-2187-0x0000000001200000-0x0000000001600000-memory.dmp

Filesize
4.0MB

Download
memory/2012-2185-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2012-2188-0x00007FFCA5480000-0x00007FFCA5689000-memory.dmp

Filesize
2.0MB

Download
memory/2780-3713-0x00007FFCA2A30000-0x00007FFCA2A40000-memory.dmp

Filesize
64KB

Download
memory/2780-3709-0x00007FFCA4770000-0x00007FFCA4790000-memory.dmp

Filesize
128KB

Download
memory/2780-3711-0x00007FFCA4860000-0x00007FFCA486C000-memory.dmp

Filesize
48KB

Download
memory/2780-3710-0x00007FFCA4770000-0x00007FFCA4790000-memory.dmp

Filesize
128KB

Download
memory/2780-3721-0x00007FFCA2D70000-0x00007FFCA2D80000-memory.dmp

Filesize
64KB

Download
memory/2780-3724-0x00007FFCA4630000-0x00007FFCA4640000-memory.dmp

Filesize
64KB

Download
memory/2780-3723-0x00007FFCA45C0000-0x00007FFCA45D0000-memory.dmp

Filesize
64KB

Download
memory/2780-3722-0x00007FFCA45C0000-0x00007FFCA45D0000-memory.dmp

Filesize
64KB

Download
memory/2780-3720-0x00007FFCA2D70000-0x00007FFCA2D80000-memory.dmp

Filesize
64KB

Download
memory/2780-3719-0x00007FFCA2D70000-0x00007FFCA2D80000-memory.dmp

Filesize
64KB

Download
memory/2780-3718-0x00007FFCA2D50000-0x00007FFCA2D60000-memory.dmp

Filesize
64KB

Download
memory/2780-3717-0x00007FFCA2D50000-0x00007FFCA2D60000-memory.dmp

Filesize
64KB

Download
memory/2780-3716-0x00007FFCA2D50000-0x00007FFCA2D60000-memory.dmp

Filesize
64KB

Download
memory/2780-3715-0x00007FFCA2BA0000-0x00007FFCA2BB0000-memory.dmp

Filesize
64KB

Download
memory/2780-3714-0x00007FFCA2BA0000-0x00007FFCA2BB0000-memory.dmp

Filesize
64KB

Download
memory/2780-3697-0x00007FFCA55F0000-0x00007FFCA5620000-memory.dmp

Filesize
192KB

Download
memory/2780-3695-0x00007FFCA55A0000-0x00007FFCA55B0000-memory.dmp

Filesize
64KB

Download
memory/2780-3712-0x00007FFCA2A30000-0x00007FFCA2A40000-memory.dmp

Filesize
64KB

Download
memory/2780-3708-0x00007FFCA4770000-0x00007FFCA4790000-memory.dmp

Filesize
128KB

Download
memory/2780-3707-0x00007FFCA4770000-0x00007FFCA4790000-memory.dmp

Filesize
128KB

Download
memory/2780-3706-0x00007FFCA4770000-0x00007FFCA4790000-memory.dmp

Filesize
128KB

Download
memory/2780-3705-0x00007FFCA4750000-0x00007FFCA4760000-memory.dmp

Filesize
64KB

Download
memory/2780-3704-0x00007FFCA4750000-0x00007FFCA4760000-memory.dmp

Filesize
64KB

Download
memory/2780-3703-0x00007FFCA46C0000-0x00007FFCA46D0000-memory.dmp

Filesize
64KB

Download
memory/2780-3702-0x00007FFCA46C0000-0x00007FFCA46D0000-memory.dmp

Filesize
64KB

Download
memory/2780-3694-0x00007FFCA55A0000-0x00007FFCA55B0000-memory.dmp

Filesize
64KB

Download
memory/2780-3693-0x00007FFCA5480000-0x00007FFCA5490000-memory.dmp

Filesize
64KB

Download
memory/2780-3698-0x00007FFCA55F0000-0x00007FFCA5620000-memory.dmp

Filesize
192KB

Download
memory/2780-3692-0x00007FFCA5480000-0x00007FFCA5490000-memory.dmp

Filesize
64KB

Download
memory/2780-3699-0x00007FFCA55F0000-0x00007FFCA5620000-memory.dmp

Filesize
192KB

Download
memory/2780-3701-0x00007FFCA5680000-0x00007FFCA5689000-memory.dmp

Filesize
36KB

Download
memory/2780-3696-0x00007FFCA55F0000-0x00007FFCA5620000-memory.dmp

Filesize
192KB

Download
memory/5700-2184-0x0000000075570000-0x00000000757C2000-memory.dmp

Filesize
2.3MB

Download
memory/5700-2182-0x00007FFCA5480000-0x00007FFCA5689000-memory.dmp

Filesize
2.0MB

Download
memory/5700-2181-0x0000000004380000-0x0000000004780000-memory.dmp

Filesize
4.0MB

Download