hxxps://steamgift[.]cfd/105394106

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamgift.cfd/105394106

Score

8^/10

steam defense_evasion discovery phishing trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
217	5460	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4824	RobloxPlayerInstaller-F2GKB6GYYB.exe
4924	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-F2GKB6GYYB.exe

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
38	4552	msedge.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4924	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\RoactStudioWidgets\slider_caret_disabled.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\AssetPreview\OnSale.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\api-ms-win-core-processthreads-l1-1-0.dll	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\PlatformContent\pc\textures\sky\indoor512_up.tex	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TagEditor\Insert.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\import_edit.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\mtrl_woodplanks_2022.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\XboxController\DPadRight.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Lobby\Buttons\glow_nine_slice.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files\msedge_url_fetcher_116_852819367\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping116_1482225062\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\sounds\action_falling.mp3	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\CollisionGroupsEditor\assign.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\api-ms-win-core-file-l2-1-0.dll	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\CollisionGroupsEditor\manage-hover.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\MaterialGenerator\Materials\Sand.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\import_toggleOff.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_2.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\DeveloperInspector\Close.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VR\Radial\Icons\Backpack.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\DevConsole\Clear.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\models\ViewSelector\ViewSelector.rbxm	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioSharedUI\radio_selected_disabled_dot.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\MenuBar\icon_home.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\dialog_tail.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\slider_new_tab.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\PlayStationController\DPadRight.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\PlayerList\SelectOn.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\period.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DesignSystem\DpadRight.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ViewSelector\front_hover.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\Debugger\Breakpoints\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VirtualCursor\cursorPressed.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioUIEditor\icon_resize2.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DesignSystem\Thumbstick1Horizontal.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\graphic\GameDetailsBackground\abkg_general.jpg	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\api-ms-win-core-datetime-l1-1-0.dll	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\StudioToolbox\ProductOwned.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\fonts\families\AccanthisADFStd.json	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4068_2064751237\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\avatar\scripts\CompositorAnimate\v1betaRC1\AnimateDependencies.rbxm	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\AnimationEditor\button_zoom_default_right.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\TerrainTools\mtrl_grass.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\MenuBar\icon_emote.png	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-F2GKB6GYYB.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\content\avatar\defaultPants.rbxm	RobloxPlayerInstaller-F2GKB6GYYB.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-F2GKB6GYYB.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-F2GKB6GYYB.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133878880753196956"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{8BF8145A-7165-4160-A930-7C23A330AAD1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{85644BB5-1262-4BC6-AE05-1330B490721A}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a6b6797f4e04078"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-361fa88592b64089"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a6b6797f4e04078"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{982C92C4-87C0-4E97-86CC-6FC43F29E2D4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-F2GKB6GYYB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5a6b6797f4e04078\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-F2GKB6GYYB.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4780	chrome.exe
4780	chrome.exe
4068	msedge.exe
4068	msedge.exe
4780	chrome.exe
4780	chrome.exe
4924	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4924	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3140	116	msedge.exe	87
PID 116 wrote to memory of 3140	116	msedge.exe	87
PID 116 wrote to memory of 4552	116	msedge.exe	88
PID 116 wrote to memory of 4552	116	msedge.exe	88
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 5836	116	msedge.exe	89
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90
PID 116 wrote to memory of 2380	116	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamgift.cfd/105394106
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x220,0x264,0x7ffec537f208,0x7ffec537f214,0x7ffec537f220
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2460,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2496,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4956,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6088,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6448,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6528,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,14877231478772994114,14946604669333836643,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffec537f208,0x7ffec537f214,0x7ffec537f220
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2268,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4300,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4300,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4348,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4416,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4540,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4892,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=756,i,4167693538523237330,3106650486454862356,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffec2f3dcf8,0x7ffec2f3dd04,0x7ffec2f3dd10
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1956,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1588,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3312,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4520 /prefetch:2
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4716,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4472,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5200,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5476,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5600,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5916,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5272,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5928,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5948,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5404,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5580,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5996,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4580,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4568,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6572,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6292 /prefetch:2
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6676,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7076,i,2036306863201841191,14923122104192444718,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:5580
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-F2GKB6GYYB.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-F2GKB6GYYB.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4824
- - C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5a6b6797f4e04078\RobloxPlayerBeta.exe" -personalizedToken F2GKB6GYYB --deeplink https://www.roblox.com/games/189707/Natural-Disaster-Survival -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4824
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:4924

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.7MB

MD5
a679a17f732d6c4e4799f4c2a5c00b4d

SHA1
79778557030a4ce1f0a31f1d93878c931bc932fa

SHA256
6472c6e314e51269d9455fbeddb982a6af07269420c23fbb09d2fbdbff49dcc5

SHA512
ee1843c3c4be3c1b82629d45432748b2e84c3025a19cf65fb9f80b6ac214a2d1411152a4ae196d5b02fe535bf6aecf2ee2a898f475394cc23815a30d81e679db

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4068_1869373\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4068_1869373\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4068_2064751237\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\09d2a15a-7bda-4bd4-b88f-b0fcb5fe0720.tmp

Filesize
18KB

MD5
b23d33811a9175471dde9f3753b01d7e

SHA1
54757e63bfa581db77581b4642758c62c454073e

SHA256
f26a04cdb5c8e47d720e250db83633a1315c3415bec8c70e06490ca9e40d8f66

SHA512
bd513b53c661e123f55d3e4822658a7fc3d54178aae2f6e464bd9810c7714f01275ad712bf636756e7d4674f3bcf027ea2b178228fad6d0c6b67bcfa030af3b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
446a829da909a08782f9b8117f6442c1

SHA1
bac883c080b85701db897b3692cb445ca59a8053

SHA256
77ffa8319c414c7ad65d89e615d6661fdeb021d56094a2ff2f2052895d27eae2

SHA512
bdef1189c9df360466b48153407bedbcd5ee8c0ad697bbd37a90fbc1fab9ddfec5d344b3f91885c8eee3fd9aa5b6c0e68351ad310c0af0f5e6ef0b09a3b51ef8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
105KB

MD5
da7fcae4308766368611b35916374158

SHA1
05a209260fd46aa423fc8dc987f4b1730efd82af

SHA256
6caaf6eb26118dd3e9fec44d6c8aa9158817d6599a15dc4d8329aac4bc9dad19

SHA512
c4d3c326b530f2f8fbc2367fadd36a3960435c7b00113a211cd001f3d9f4ac08fc58e8f26063869c37f425abcc8a7e68343ed9b96a90471aaf72658555173b6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000100

Filesize
43KB

MD5
bfef1c88c7a2462d08b6930531953552

SHA1
6392a0f160eb73330bebd4c324535445e0783231

SHA256
5bb0ddc5e9112db6992a4eb1252b36b666ca8de22aa5d09b1d083794f2acef4b

SHA512
339ddb4c82a5456623c9ec0bf2574b22d7e98f9b2002d5d9616197dbac6a76742e146ec77e8d3aa8caa3c6178125bea0d9ec57324b28dd52e778055a4eee204f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000112

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8dbd35a91792f58c1fbb93de0ab5896b

SHA1
4703b252fa07e8f898246b7e62674f49ec7ead35

SHA256
22699a1ed48b0ad539162c388f90a63f5710414710647721bf798033ab681d6a

SHA512
b9cff703f792a5538795141dacc74e36bf782870a47af3dc0ba441cda9158b1d98a830c339c58d9c7fa99c4f80ecd0d2313254a4a852bbd0acb6e60c7e120472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
13e73f04ff793126e5cd75acdc4248de

SHA1
99eed9e1e5ce56c880b424a8f0bb1f21f23f01d0

SHA256
8887dfa682d07f0b0991f0a18661bebff3589fcfd3504fbb7d6dec961dc4cab4

SHA512
3508dde74c6f801c2e6902d7a9b54d3a9d82df411c9241843b2f12df03b25499e11188e22e7bd4c6ab232b4b4f669c01435c9de88145217e8b49a3d92573fa29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log

Filesize
4KB

MD5
a90dbe3a78c64f505b0c86ca12fb21de

SHA1
75db91e28afa3be4c535d12fe4bc3fa1852bfb82

SHA256
313f53bdb04086e9cf0b219156f6dfd92835963b5f65a0a45e75acb740db09ce

SHA512
d543492c1661613cc8dc26ae572ec4788d4524a3cc05ad46925e1d277411fb1b718026a8fe25d29603b4096383cb581420890cc93281122b992d2191bb7ca018

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG

Filesize
550B

MD5
9f264d73dc2fae3850fe0b66e3e864a1

SHA1
e87ecec5273f44e558a2deefc2d9217f5a2d736d

SHA256
6618a0b76b4205a956c274336be3ed40c68ccc722ee89e4af3e63ebe0fa74b08

SHA512
c5a8cb6bd73fccee32888bb7fde95d33cb558846438e3bd25637880b94bee6cc2ea5fd45186752acbee0afa5450879ac31da84350f227e7bd37a1d205c03aa45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
349B

MD5
dc0e4d279f876def4e9833a67a4c64c9

SHA1
d3b9b8852b8e59f637db2e392a48ea261f196b8e

SHA256
837744f45fbfd2bc21c0945776ca61e7f67964c8c756c1d37eafd439909c0998

SHA512
88ef8dd75536bb80ddddc1d857fefae69a2676fcb39fa803fe5b1f77fa12d180461773ae0a26b4f317f68f04e284090f673de7307805ee7ebc5b894ad708651a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
abab167ee9d14ba620894a15da69ed8e

SHA1
80708e118ead7559689d8fb60679e2d651b8cdd7

SHA256
51eb1e279430a1ec5008a07af865050e632080188805509096632927047db242

SHA512
04cdfa632a816da3b6ea3f57de94f904f309c16f5f297c4c198e36b185ebcdd591fc4550fcbaa7369e16da880a1cd2ec06388c37fd24ee5e90998f9fb336bc5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
390B

MD5
c9ded096fe07b12311d15a64a973fcca

SHA1
bd04a781b14b937696232d7ef17aebce160b8a2e

SHA256
52fb5de90d17aed965a0b425a516d9a8007decef740ee411f134fd7c04933fe8

SHA512
393b88a16039870822dcf822d9c2ba4822b75b35b89d69092e00f495d678e16142339e92b36a4782b78189ebc7937f6b113b12f637d2fd3bcb5967ee19e7e1ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\80216857-c7f2-4b73-9a6e-6cc22d049935.tmp

Filesize
7KB

MD5
2bb7159ba42d6f7f6b7a823dac9e4998

SHA1
c8c2972ba5f07461303f116eb1e2ec042dd8c873

SHA256
02b77c600272696493e3da88f5c93d7216aa62fbb31224ea57fa27cb20512024

SHA512
17bc253106870abd983c7cb47120f5f2c85eb32fbe051f51b4b26f25265bcd896978c6bc24cd9fafe602c8ea5ed8643b992781bb11e6a566b6c635d037c62cba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
bdd35579386b76cea972411d2a642926

SHA1
2986b2775896d23a95c2c27d72091176de76ae1f

SHA256
a5324b389e1298457232b2af752f8aa566df5ca7f54391e9e6c5805d5aae87da

SHA512
19b0fd33fae337498f15b5445e880f1c54b927c7e22c6b8b5646a71f726b2e1bd7285d0cafd243a35acee0afaad013027ea1fb4be9fd382bdbd803ca0d152929

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9e92bfc4c71a4ab46a1e82adc23e71b5

SHA1
3f78c10535efb1b7b6127722a1ced2a62722f006

SHA256
7321db404e1652665f36a2d8c382bce6cfcc3bd3656a0bef659c48373f86adef

SHA512
5ca386580e79b740f0e26cc16430518629d9a3be701d836688001a9d4979cd9f75ae858cc50038f8864e7cf9260b19acfc921cc4d664acc6cd7d73e6b2e9b33f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
0bb861a47fc7fd9de7185c54cabbaa75

SHA1
021d793b49641fc9513975f046d6f040e20b3d30

SHA256
7603a117968de4e66813532087be08278ed700999f7902ab2aed65da21d86aca

SHA512
017e6a01517d2863b53ae7b3128313cba5cbb36d71b1b2b29804220fba92548e3c7c03f852d34c6987494fb8b45377f13615457057a0a63e504d1f61c9710659

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7f5cd4520e8644e27e619578ed5724a7

SHA1
6e8d165f18b45d3bafebd0929356f2fcd13c0d11

SHA256
727b7a388028b4dca0cfe31c67d53c9d4f5da242af86f218eeee2aa897f81271

SHA512
e0aabe35d981b653df3cc37da6f8441147508faa0672a22da65447c4abc7684424d692061d248a087eec0c9e9526912ca477a89c317c914c896a4dbfa3570c3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
7006323d02347e657e220e3f726bae71

SHA1
46d96960ee4c9e371859a4c8cc2c7bc3ab22d6a2

SHA256
7b161e7c8fbd047c03fc5cfdb9e7ce07aa8f1a2845c4a5a283310918db19fc4e

SHA512
c8b56ff7a2a87b665cc2d8ccbfbb8ff581d0d41a7b462f07520c2ecb43c068087341b2b4ea7845a57b8493a209da0b46e8c2e1eb468556dac4dd8547ac50e164

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
4394df7208ba6597c272b10c4d7eb00b

SHA1
8598110253d0926f531d0c544ed1a4cba938f0f8

SHA256
250929a52738fee73f99f5abe4baaa396c7cf83e240dc6eef3c27fdce66621d9

SHA512
caf63d6aa09e290d7ebe6a587efef5667cf269f56f71014bfd59c257997fd1164032edea9fb375760949560f5f551416aeff052cbf3a47abf337b65145a621e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b5e53a32c2645b62d9d8dc79eb002273

SHA1
e3dc327052a9bd03ab8b77cc8d18593619104337

SHA256
b7a0f41b90a971f18da7f8628cdc2168f42282d020eb065b67fc8130bb2e3262

SHA512
3fc6161377244748da374364f09e58b0cca6f3c7759d0d161de9f49c5350202d0087f140437b108ad0430f2ed8002f90640a402de83df7c2e5bbda5ae3609d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8a97f8245f24bdf4813c700dcf8517f0

SHA1
ed58ad868aa979a273a9e61c46b2a367343f24e4

SHA256
6ec0c5b3f0fe62fc34889f7e2e8fa9f67b60414a26a1e5cdd089b6ad5942b097

SHA512
7226abf040805a6c0081365c8b450b9a5f3fc2d08d6dc062f43a90f981d717d6be23bc7da41f0ea9542ab20b19fe27e47b600bda448270c35d0bc21f72601794

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0566f6fc6d3d05a39a0613be9fb28ae0

SHA1
9a70d954cd288886b529da5381499d1c67d19518

SHA256
facf5213de174d12d9dc8837fd97b5fa77f6052fc26660801917cbc6600fd08f

SHA512
5d37f72aa0748822a4b860f924a835f403bba13b3dd313955eac269cac7ebd6997ad9ffa4ae336d545dbac4e218c0e05dcea2bd523cfeb4e2ddc4e9d08d3b576

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587fd9.TMP

Filesize
48B

MD5
c498b27f6c75855a59b8d8038f0296bc

SHA1
582a55f283380ffdb5f001fd2775ee8be4bfdf09

SHA256
a99499d7028a27d1d9c3d2fcbe69f383b140b8c5cd315824b2c7574a65380692

SHA512
acbca932bcd2092d03ea78f6bc505342d6e144feb2cec2eff5f11b57041a56103a17548643179388517f4f6ef29c5703d17f0059072f518bb93cdcb6ca09a06c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
154KB

MD5
14073653943a3259c7e0565df276a1e6

SHA1
af6f06bb851b8dfc78249833fb8860e3b72e4719

SHA256
978920fa3f81d5ba3b9a809264bcabc901c748f6c522ff7c2c44ae0cb6d068cf

SHA512
2dc82cf62791245c9e3361a28940262a0e65b4af131f68cedd91473ae1666e39184d768fd06225e0d57f581aa6880e93b7d27169b61762df756d4346c7991888

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
e88b8094575af3a616b7a6a4e206f384

SHA1
b723aac7eb0392c8eb45a0e85a66054f4d80d883

SHA256
135c85541a04009a5f1934f2e9a89baed5068cfa7527efb316d60efaf6683d2e

SHA512
5f175f8528dfe3fd13deddd7acb1c2cc9e5904a7b8edc52ff3a24dae028d76b0d24699e9ff36f10ae52ff3739453fdc0fb4fbb227821bb388dbb73f06a8c46c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
154KB

MD5
c1ee80d07c458a59ebab5f62efc8b0c4

SHA1
5f222b225390beeaa29117c76248f188e6c94683

SHA256
dde560d973894d6bc7e635894d34744c5a9d479df51417a3a07a2f88b178207f

SHA512
7e2d0aee1c10b873d3135fca46c86c4ab9bcf42b860b84b135799a833ff49d6bbe8aa508aa4e574126e4dec8628242f66f32b7b4f28a32392bf52534a520d2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
2d24b17f6564212515675a8496491b7b

SHA1
dd5b8915ed893d27eac0a33d596cc030f94bae9d

SHA256
a03bbab2dc2f5cea0e3f3f843cec6c12015616d6412b67b5e623172203c1b79d

SHA512
a98233f435e40ec70ad9491d88fb824f4b11181787b3dc597de52ff83bd143a58793ecdfc87950012df44b01634414efaec8c0dda9ef0a896efbef87a71cab81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
47ed13f30dcc8c9ee59015db629a236d

SHA1
ad9a8f057eba5dbcc795bf03797238489473c5ff

SHA256
b41b004d5e86430af845bb708f8dc757281a56d7ba5b31af8506dc0c0d4ffc41

SHA512
bd53a974855a91410477534e9f2c97d83f916a6c26d252f6fe40117317b8479e4b43e92a7ada83575b55ef2431a52813405673d200a4a084685d1cbc90e0333d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\978d14f8-2d62-4f26-aff5-e0eace7fd54b.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
745e9ce108b174c70a20f4043e667774

SHA1
a86953b727557db7dffd48201114a72dbd44f7ee

SHA256
5ea91b673c11a466c46a5e1d6f763b893f15d83fe86e48f3a1ef01e084870c88

SHA512
b7702fe8305f088eabfe3904c24d785fc6ffce4fbaffd8949b9362068e2a89400b8d880541d15275223cca8de2abf6b2fd7e757e7655d084af60162fd6b466eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
22fa573d1f9fa5be9c9d973a22b96063

SHA1
2bc599c1e5f3ebe3f541cdb9ef7d25eecb1b1c6b

SHA256
61498a14ee07748c01c4ffdca460fc7bfc8cf319c917797d37d982c0ebb1854a

SHA512
258c585b00cc0eb1399916aee3dce6a6b3d4d97301b5c4eabc6d5ce82ba2fac70b5e7a044cb79b8b8e8d62cbff6b54589179749c002aebc43bbc110de5b2c846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
0d791a18ad0cff2b4f222cc56746b321

SHA1
77cf3fb9a2cdab6830772d7c15f915a5e163b747

SHA256
a2175d7675d520c90c14c7fd8feb23169f0dbe581ce0f795900fa0394609e754

SHA512
f561b12b0d4fc358478f1b7ff7abd96b1d75c1985c6717534bb4791912aa798e1988b156267a61b549c21ee8dd71a666762e4c85b55320cdbd5c1f9aa5278a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
3021e879809df0c4b30bde589e1e7959

SHA1
76b7df4dc47ce1107e8cd7b8cf2f59ab02961a3c

SHA256
67607c9ca936faa57d75d4bb6e0bbf10bae118e740a16bb6b6cce6c8151a7fa8

SHA512
08f7de55a95ba1c22cf01f05ce226fb88f6de3241340661324d595bc1cd4b5cb53f9527b85bb8679b9391894016f998064b4a152ee91ec4afa580e079bdcd0d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
51KB

MD5
7382464df97fed5deb0fbf68b6742dd5

SHA1
4d5b53d7a1de7346e1749c7f61ad71647e9d9783

SHA256
79320354a3a3a2162ce3b75e780c1302431b8ffefec72af26baeaf00d994f689

SHA512
23ae16e9ee8d1c469385a86a13fadb5531dd20aed3da94561687a181ced447551cdd283e88aabe1d6d709a9520ab4dd3dd0a2e2e6aea69da51d353f8ccfba055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
27KB

MD5
638a4990025383a0f83ebf29bdb84a68

SHA1
153e8818dc42f598e47fde8cf398f1447649a4d0

SHA256
878e34b89800bb271d3588e526eb3598eb3822e263f3bdaf53645847d39d0ad6

SHA512
59a505fa1a3bea1511e8fed16dced733299928b4081665d3e3fa4fc71d6f0ed0b09934805f442bf190c9093937e1494ac938167f9beaca0223243703f73efe87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
111KB

MD5
ece822ddf599587ef262b1b22bfeaa47

SHA1
d9a8d480342a2a675c61452df0957fc6773f02ce

SHA256
199b281472b5e03f92a02e91d4f0dc88b91b641f05670a74e1b3507e09b0727e

SHA512
910fafc0f1915a64933d649cea2b80fef570872f792320c49217b6fe60e49e2d32a7b0f698ccc7f91bd444aa62911ac2cd1da6897cdf3c0a27a3c54c8aa9d638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
22KB

MD5
b129dd4c4dd1fc434965e17db982296d

SHA1
dcd89f7b41ff357a65d4aebbfb1eae6e0254eef9

SHA256
6660d544292d6f8081c0dfe08ea30d9ce91259ab8ce3fcb063730de193ef6e89

SHA512
ac653527b5ffef02b53862833916e288ff01ef286b378764f298d31befe2d82c05ff76e5f1bc35e4973df4cb114f2e647b97899c3a1537320f41e23dd1af97ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
491KB

MD5
eaa918479400786006bc5a37e77075a2

SHA1
cb892a61d8643b235ac589d9e0fd7a4a97ce56a9

SHA256
69a47ea33e7fa0226b9f23b5837a9075f36a0ffc2e7adc2f5b30f564e1dad09c

SHA512
52bcd20485323c7451fcfbacf51a3e5366031198177ce53815ee031a451219755421da894edeb8e26a83ec84d7e52217b26158ddf5b0449bffe8f286b2238942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
23KB

MD5
f9e969a5ff052424471f3b3c656fd229

SHA1
516b9c1e8bdad02de157b04e194f8e0ebefd14b3

SHA256
0b6875ff3955b3f51370572fb12e0f30fb0581700d2897a107168069c36cd70f

SHA512
be950779d942725821775586979c28f5cd24b8490ca6a30c62ede38a616c1b4d0bf009f919ae432b833a34b63880017c8ec09663f9cfd24ba1f63f7d91d178b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
41KB

MD5
14f91cafbfd4e524f311a37973e6e481

SHA1
d7378905f76f7eae02779e050e34edba7574eacb

SHA256
5a6dde631ff5fc56d2ee4b0717c9770a07051de1a1d17fcb5b7d772be576e9b9

SHA512
8fff1e0c1f07d03bce5210a2d00e7947029134c1815abb6addafbb7761b29bfa25f8bb40146e7f966d77e8eb659ad19e898925368a1c1e033bfad5bf149b95dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
28KB

MD5
4d0748c0b99564cc4fd1e8c72bc45f60

SHA1
fab0a1e66cac16ea1fed3f7db33d055860925f63

SHA256
e04a35523ae2bb07aa0c4ba19bd9388e065aa8810f00e50f60c58543097c8eae

SHA512
c84f213e12df5640af46d2eb51d7d0d7c9623007d1414dd646a9b5303f0d1d7e2412fea406d47da395110f5787a2be132a7dacf17513b4cbc6af9361750ac9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
22KB

MD5
cd9956d2b6201b91899207bb167832a7

SHA1
d446c9a6b7eddfb458390d760ef9bddc9b251139

SHA256
e357f17301202634bf112fbecde34147ccd4e49fb8e973831195a718cfacf770

SHA512
170ca2ec9fe8bd68ab005fb965092e20899d4b2a3becd84767e3dc49036a2e3af571c4a7fe3840d2a074b9960d2e9d0b55e26e87523fa297efca093718a6fd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
23KB

MD5
4d5d6db17933982faf2ff0c6180a4b21

SHA1
5417a7622e4363101c28153d0ad3984651297ce6

SHA256
40f46cc932f1c2f06f7d7929c462eb7969f3f06b9bb179f33342f0b3feee139f

SHA512
db2b507631c5395c865ae8d0c0fffd50d7c727bad935b81ad4a872bd8577f97001dba37a183a4ce67106f9882b12dd8d3e3efcfdb9936ed9e249c326d8323fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
35KB

MD5
5856baf64a567ecfdae586266f3d61eb

SHA1
fb57ef6616170c637d43266c153bdab736c8bca6

SHA256
1e444ad555e3f20e67f505e40f30ed3e67d5906610ee677281b367801e51ef66

SHA512
ea3b64075973a0dee0d50713f0cd2d961c8316ae8f2184dc02744b9b0ca2881b9479cff88137671046a6f64824e5c89dfdb9cfd973cb856c22225eeffbb12638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080

Filesize
42KB

MD5
99a8561ca96c6287c8e2963ac7566b3f

SHA1
29b75a3f294ebe065568d039f1f503ff83ec6979

SHA256
d8262c7d272144d33006ba13905b8924671b8fbcfe9106c6b1f668e242076c05

SHA512
9af2f67ba47ba1cee3cbd58bb1529c845e6b4014d956894a019a98e6140a1680f2b57a0e2a187796d5a071c1b749f13831c3174f9f37d1821c5f55c3f23b0942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082

Filesize
119KB

MD5
d45f521dba72b19a4096691a165b1990

SHA1
2a08728fbb9229acccbf907efdf4091f9b9a232f

SHA256
6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc

SHA512
9262847972a50f0cf8fc4225c6e9a72dbf2c55ccbcc2a098b7f1a5bd9ea87502f3c495a0431373a3c20961439d2dae4af1b1da5b9fade670d7fcaed486831d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083

Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084

Filesize
3.2MB

MD5
4eb55dea22c7dc9f5311b0c45c147c1e

SHA1
6332a14dfcdeb75d970f5fb9bc0398c472ab3be2

SHA256
1d3db94fe8c9316c596659a7278696394b03260b874505bf8e155f0b24d33455

SHA512
4da7cb28eb5d5cc21af8eba4d267c26e632c887efd4035451b5e855e09f308493cae068286d6aebf6d5eda516f80c0f5cce5fa65cf2db38f80bcf56755e26760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086

Filesize
120KB

MD5
6168553bef8c73ba623d6fe16b25e3e9

SHA1
4a31273b6f37f1f39b855edd0b764ec1b7b051e0

SHA256
d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66

SHA512
0246cee85a88068ca348694d38e63d46c753b03afadf8be76eca18d21e3de77b495215ed2384d62658a391104f9e00df8605edb77339366df332c75691928efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e14c3764942280b144c76d2c508eba70

SHA1
0112362c6117d44369fc18a239ac8fb190635109

SHA256
b46139ef265c9f9d7689b791efe628bf1edff74ebd50905cfbb72608119e8b35

SHA512
b5a73f7b14f2ed483eebbefc49a25c480f322f5b11a90cdb74995da1941e3831bfe08d4735a3ddc89e9a10c3ae3178e06c5dd613e5d713372ceff025ccfbb19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57eef4.TMP

Filesize
3KB

MD5
3fc57294652193fc7d888dc058f6c392

SHA1
992267c2fa5f4faa9fb3dd277277ff4555cc73c1

SHA256
885c18f51fd7b71d67b9d33318ab89ee2d8709f76256a8ad8a15c1679930312c

SHA512
924dd0687142fbff78b4a251f6d449b3ad5f68f89a6010e9bff640199b21b8c3f1660505bb1981379c03c9e0409d79dbb7cee825ff0a0e9df0665cf2266522a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
96eed9948efd0c0accad2b657be1526a

SHA1
6bab17cbbea65be6c68e0223a6a06dc4dbb40901

SHA256
bf6b61bde98d0b40ff84ceb0f7b34f763e6bc6325ae7630ec92155ce85d859c9

SHA512
5099b9bd7157fd1688ea951d7d7939d300411734b6648af3d82a4a3eccc3599f6e85bc8db26d392323696811b8806574521411840faef457f5be4122917c9c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
c2f53c389d70d0343caf6cf54958ab1e

SHA1
d0da0687befd601f4e4e3de70e5836c314e93264

SHA256
1db876346ddaffc657cc3b28eb73d8d118001ec1181cb4a1aa0cecff79080880

SHA512
e89d6f6bad0da945c8d375eb09ad2816a992f3d34798dfa6b998e63c61cbc1ce693a53d66cc8383dcf5113de2145c21c0906e5a8d56b437427ffeea4d7e0647e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
1727841930879595383aa05c2de3bb08

SHA1
6718b8e36485fba053c249e2f89816408aab8b49

SHA256
81724aba8ccbd7bc4cb8351a8c4c2e3f6985671b924c58ffc1c4b8e40078ab93

SHA512
5c77d8e9d5eecb0c8ac62f9831a8944a6b667ca76d6d953f055f12795486b4105071488a2cf43c4597d7dfdd53560d42ba670dcef54847b8d45cf0c4c77696e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b15b833665efe18acc11cbbdaad3d772

SHA1
c53aa88d2cc8bdb7fc77e1bb8e8539d043a86e93

SHA256
2aff691365fa2aecc14837bee149f04a7c3076c65765827427cb1987e7c07f50

SHA512
1438f8e791c4f5ed6037854a0500d3374f6d77460e16b16c43f0e9a4b0e3a95731b58b7c7787e9fd8ccb5c6bded944d573c72e680f54f99dcb0a6f2e4119a384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
ec87afaf7611f72e5bd07f6607f33ae9

SHA1
1a8c5c5d1ed56d7567cb420b889a62a0a6a8f793

SHA256
38d416e2e5d7a217a8207c032c273cf15ccf73a549670351f5b25d3dd35b3e3b

SHA512
d987b16944831b725e0d014e70fb8138126967ce1c234ede574f8f308d9807d2d0c151603e01c402e03e2c7385a990c7de46b4264ad4266811fb5ce90bc4b3c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
860B

MD5
505262aaf4c7a8b12ce563d077afaefa

SHA1
343e3650cd9af4e3bdbf26ef9802fd51fa31fb80

SHA256
a73ae8a1ddfe9fd670bb1d7a2907350fbe174d480353b1f25e06134ebd6da1c3

SHA512
9456295df4b747c7615fd568875e2c72c8f9f0ce87aaef90848f54115c1e7caaf1480e05948f27b9e68836579ededa9bc9968210787f298609025c7ac841408a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6a516b99bda45901231efdec0f7b2a9f

SHA1
43085ab56adc311f1d536de0708dd21549d3ea4d

SHA256
ddceaf23562f9910c84ed65b7424d753e36ef8b553289e565493d94b6a828fd3

SHA512
37e8a9222da0573dd12dc4812bda346391dea667053585eb8b1e505ac488ada7645bb7958e3dfd7f438f9417ed9d9392f3471358509561ba5f04e0c31a288949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
89c16bb8f0249be8b11763127ff152d5

SHA1
3f1e9ed18573983a51c5e242547ad8bb0caf017e

SHA256
3226756e64e759f1136afea4474fef4324dce4a3b454a39a3fed1c18f77dbcfd

SHA512
67c5ffe3b14955dfaf75c5e866584627233f5ba429aa3995e4f41b25f5115fb3405d70ffde5e9d759acf58f8a08548ba8625029beeca67a84f1bc979cc62bbf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
daaec4006848888129094578a16534ff

SHA1
bde32f255ade57bcfec9dfc9188d6454856b4b70

SHA256
5e870a7ed5b704a44f15ce4165870fbcdeff633ff22a7b1bbc058aef49eda286

SHA512
b37ccfa69bda54c344ed497664e346b3d579a24a4d12ceeee72423dd015fd4a1362bf54db9c9a529766de5901284a45ca893fead9f6a20f74945ee8665b425f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
9fc05382937118ec6e05943dbd9a63b5

SHA1
3dfb7831d205ce990229844af1f3b15ea8e24100

SHA256
19788126df6876dc64769f326da66e50e170f62509c614d2ab97c9ac85fbe867

SHA512
ea07717e34adc9cb02549b97482b781b7cd1840d9fd51cd043b3b15f63e8a4a032f062f9dc36bb497de27ab35c8f67b75a74f0209bcaab3bce4cb753f5952eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
d7b6ea06e7007e071b42ae3cc4001d52

SHA1
8809018f838708b1d234d8e56f8ba6dcc6c92ebc

SHA256
7745dc973329480fe68a43b155ff5f1c6bc71ecc8a309f0d80fc84d7aa186f14

SHA512
dbbb0ead18af20f5475ef52f497fe2ee21dc7f235298a3d2816179f9f9642b13d27c54b4657513b68ba3c60e07d12a3bb8496c7ab66d7c253b779494bf869355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
e69ee4c7da8a1351e102effaa8fb82b5

SHA1
592991f4e384e038572a8d92fee4f5adfa967845

SHA256
591024c01b0878ada62807a1ef3ef10c3a198aa776beb148df7f4e372d731714

SHA512
498e8561a9938ad7fb127d3beaf0db2a7f8d22d1b70f58b50ff2de7e2010da6f3c9ea194112109af50e5ade5a345b9b4c2a6460a11818de7afbb18389b34e513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
28561e75f4b26c2ed62a62cba83e4c3f

SHA1
dbea5737c2543923d462404aeff22b665457b225

SHA256
08a3b437752d784ac29209f0cc07f4d9b07542c711e7fcafcfab8f829a1147e9

SHA512
35c43e94629e621a6eee8920d43340842a5ab1ed71d842748d8ea9d7007b3bb15152ef643b8c443121d5205e0e165cbc778d96a22c62e8cc33d5d61c4bc4d2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d9e3e6ed99ec9bfd6a85292fe81f933c

SHA1
66d47f3f7630cb4a273beaee11a2d769a14aa3f1

SHA256
e2cea850a1f0b7ded6c5a36d7b5a4fddfb3ecbba2e2d9fe9ee058edec6db5ffb

SHA512
3a9f2786e95e26d774c61dc3d0075d0e3d3208802189aabfba612fcf75780fa1160690d2495382079ceab5f7e04159fe232660a74f7d382a8bbfbca6e7c2c406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
2fcbdc19ab033e2f7beaf1465c93645a

SHA1
ef770bc0419b11ae2feda9ccd5eb8f76bcb96312

SHA256
0c460aa1294d6d67713da614a7164f6974f9fbcddd4c726dc9f6064ed7ee36db

SHA512
b925338986be7849a430b60c3e9354432612fdef17a4dbdb12fcc7b47473c5efde0edef1a1beac207474ca60f906fc485b95801243f0f75a7869b5516cea8e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
54bbdea0a0027bcca60019e436fae9fd

SHA1
05ed2c7e07cf1a59ddcb28caf72295441473bdc0

SHA256
7960e7e09bf6d6ec2cc8c5070af8f172295e5d59e0decfeb7847530478eba4b8

SHA512
a67e2b57f7985e5b241a0d8fa73d9ad0b0756dccc288782589eaf0d779ccae240e8d150b59c84176acd5e9da8cf22146d06e39e3b9741b86accd018d4f9a25f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
4c1fcf883c4e5b8087ac5d44e4d6113b

SHA1
1be1f174725473cac32d88a31f33d5fdbe323616

SHA256
45d617f9c18fb9417e404f5752612725d0e3dc8211a9c66fd09d41c8d42c788e

SHA512
d5470288cf04527fdbd95044574ecfc728345467fdbaf5a46765aaf1f643df839056733a32f8adcfa651ebd200495c5c7a025fa6ae25864561801baa4ce22e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
8491412c0d83972f68761b31fdd0bb17

SHA1
782ca66f8270f19b12aa8aad08be5b522c7d421f

SHA256
138742df68be65861f4dd66e6918b36c80fb4a8f95b8ac01d5047c2b4044a0da

SHA512
d20ec9021b7135bd7fd18ee6485be29825c3bca09a73ab43bb4429ddd51748f4f7ed01e2e9a8417623f63772297d47fcff32117ee625929b57dd1c97604215f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
22594791c76d0a5e7c19313d0d2333fa

SHA1
829bd9d95ab34202027b3d2c00932b045b0abd43

SHA256
a50aa9d4e4e926d2e9968ecf021bcf6963714088c8140ce9fbcdb7484cd3296e

SHA512
e8563e00ac3e29628cae8044e777629c0afb77d84d105a76416d3f5d7afa1836d874b1e61d2c6e710fadf1137620d130f17311e236771428529312cb63554d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
674a061c233bc34534c0100d2d6e9676

SHA1
e83bdab389c601afa1eb8a323758dd7d142f8478

SHA256
49210e31839b3f27609e3ef7637c79860c2416f6705d11956d0b9305b8e076ba

SHA512
4558b350c8e5a1857b45f895b11b22af5ca595bd1ce18c46f01dddd814a4cac96f820ecf8b1e350547094fb98755a1dc5e101ed679e10cef5acfb69ea69d82de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
37060bf2b70985b8195afb6ccdac0799

SHA1
625ebdd16c17de6474191bb8a3ce1ecb07872ee5

SHA256
69cc4c3bf616b2e6045f5468ea25516ad40794e76523a644888ec8ca6861a540

SHA512
10299bc8ae7a69035c24641f83c10a61a4cf51fbe14a2c47597b7a3b67bb753ff94050a4abf26c4d28e93977a94d8cd368baec8959586e9d2e34bb754083e6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
2502b0ec0a05fb31c3a922856b82535c

SHA1
0047d4e4bcb954094a03a1f4be1db187e7647215

SHA256
c55b762d01462018c68f2be2bca15d14c0ebaa65be25b71c9395da217a89eba7

SHA512
6b0ce72bfdcf99f66c0b10d2a522b2cce4fbbf1e67e2304cfb3b03a90d1f991dffe5ba29648bed0bf0cc1bb3be21134f05eba662916cff0c6d9793d60b8a756e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
8d6898cd7e7628ee2557cfddb08f1c3b

SHA1
0ab03adddf1be62e682e391234e6c42c6efe542a

SHA256
6f65c0d1d9bf0d96245d24ed1d8684a4049f08150242bf0312df1ef7ac921d8b

SHA512
ee294fb4b3c289a0cc82d310cb9e3be4cc7131e8cc7ba833b96bc7d7e808acfe9247b6ee97428466fc79ddb469d9f3e65103a617b7e2098ad1a612c6ba5b770f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
d7800f01dd775f9d4c874f2bf4e1db31

SHA1
8a57ba4f7229dd346ea3f4fed29edf1cf7a4124a

SHA256
10b7a8612db81fc153a794992ad962d5e3224663518d2fbc3a6a4ab138ed2aa6

SHA512
b343aebf528109281be1dcb494aaaa02ce46d333f245e077ff4ff3812b1308d65354a635a4b2b3c53940d994669290706eb10ef144be477515b90fa7b6ac6748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
c51ff2cbb34312f8285ded6726786722

SHA1
2d78fc2c562f4477aabe4c79fbbbab175596cd3e

SHA256
98280d198d5dc0a4bebccc0429679cb3b41e3a852f68191e46ba0aea01944623

SHA512
3c6c236a31b35e463bd0739b58872732f34238b34f2db65c962195df8418752b34581a67e0f5486f6902f496c648851f5dc59445ba990433c489aca8a50ca0c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
665e22d82fbf864992eae0d5af260b59

SHA1
f2d9ab4cee991ced3dd20dea46ad6de8cb77bcf0

SHA256
68b33af006eb1f847e7d9f814d5f86908beda3f66ab6e26460c4eccd0f352974

SHA512
569653db1a2e747b396a4658c713a2f3164dbbd84033ee85f9664eec7ae7b5653b221fb870f627b981848f4b43a72c56d17361ce1ed4b29d3a695d9e9533ee00

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d3ce7ba8150c6b4ed1ad1212fd1c021a

Filesize
7.9MB

MD5
d3ce7ba8150c6b4ed1ad1212fd1c021a

SHA1
703ccb1beb53288f7d6da1294c5fd5a0e6e3a56a

SHA256
327f6d9ac087b0614239a9234981a015b09a108bdc0dd97a2ae72bb1ce6faa5f

SHA512
606d6a8bf1c51247f78b7a2ecff7027b08059814df54f40c461241cc9254d31df08d24f1f0b66570849ad84993baf7dce9c10e02f91071834ab8269e76e8ffa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4780_516382570\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4780_516382570\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4780_516382570\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller-F2GKB6GYYB.exe

Filesize
7.8MB

MD5
e7859398c10c098e678bd8fd13681f10

SHA1
11b731fc9b78dc9a742b2c06b79015fc911fdfb0

SHA256
e756ce2935d54ce1f9a57d5518bf47659a5eb4aefef72dae5349d8b013ee7f58

SHA512
7a75b55ff6ec09fb777b171e7222a2f3aa58c95d7edd6a60a2bd99010ea95542eeb7ca7e8cc52b93edb0677543d6003fd9b3d08915ee8b8f2b291668c85c4adf

Download Submit
memory/4924-2974-0x00007FFEE09A0000-0x00007FFEE09C2000-memory.dmp

Filesize
136KB

Download
memory/4924-2964-0x00007FFEE0CF0000-0x00007FFEE0D16000-memory.dmp

Filesize
152KB

Download
memory/4924-2925-0x00007FFEE2EC0000-0x00007FFEE2EC5000-memory.dmp

Filesize
20KB

Download
memory/4924-2923-0x00007FFEE2E30000-0x00007FFEE2E60000-memory.dmp

Filesize
192KB

Download
memory/4924-2922-0x00007FFEE2E30000-0x00007FFEE2E60000-memory.dmp

Filesize
192KB

Download
memory/4924-2920-0x00007FFEE2E30000-0x00007FFEE2E60000-memory.dmp

Filesize
192KB

Download
memory/4924-2921-0x00007FFEE2E30000-0x00007FFEE2E60000-memory.dmp

Filesize
192KB

Download
memory/4924-2919-0x00007FFEE2DE0000-0x00007FFEE2DF0000-memory.dmp

Filesize
64KB

Download
memory/4924-2917-0x00007FFEE2CD0000-0x00007FFEE2CE0000-memory.dmp

Filesize
64KB

Download
memory/4924-2916-0x00007FFEE2CD0000-0x00007FFEE2CE0000-memory.dmp

Filesize
64KB

Download
memory/4924-2931-0x00007FFEE2AC0000-0x00007FFEE2AD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2934-0x00007FFEE2AC0000-0x00007FFEE2AD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2933-0x00007FFEE2AC0000-0x00007FFEE2AD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2940-0x00007FFEE08B0000-0x00007FFEE08E0000-memory.dmp

Filesize
192KB

Download
memory/4924-2941-0x00007FFEE08B0000-0x00007FFEE08E0000-memory.dmp

Filesize
192KB

Download
memory/4924-2957-0x00007FFEE1380000-0x00007FFEE138B000-memory.dmp

Filesize
44KB

Download
memory/4924-2979-0x00007FFEE2CC0000-0x00007FFEE2CC1000-memory.dmp

Filesize
4KB

Download
memory/4924-2978-0x00007FFEE09A0000-0x00007FFEE09C2000-memory.dmp

Filesize
136KB

Download
memory/4924-2977-0x00007FFEE09A0000-0x00007FFEE09C2000-memory.dmp

Filesize
136KB

Download
memory/4924-2976-0x00007FFEE09A0000-0x00007FFEE09C2000-memory.dmp

Filesize
136KB

Download
memory/4924-2975-0x00007FFEE09A0000-0x00007FFEE09C2000-memory.dmp

Filesize
136KB

Download
memory/4924-2918-0x00007FFEE2DE0000-0x00007FFEE2DF0000-memory.dmp

Filesize
64KB

Download
memory/4924-2973-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2972-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2971-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2970-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2969-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2968-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2967-0x00007FFEE0B90000-0x00007FFEE0BB7000-memory.dmp

Filesize
156KB

Download
memory/4924-2966-0x00007FFEE0CF0000-0x00007FFEE0D16000-memory.dmp

Filesize
152KB

Download
memory/4924-2965-0x00007FFEE0CF0000-0x00007FFEE0D16000-memory.dmp

Filesize
152KB

Download
memory/4924-2924-0x00007FFEE2E30000-0x00007FFEE2E60000-memory.dmp

Filesize
192KB

Download
memory/4924-2963-0x00007FFEE0CF0000-0x00007FFEE0D16000-memory.dmp

Filesize
152KB

Download
memory/4924-2962-0x00007FFEE0CF0000-0x00007FFEE0D16000-memory.dmp

Filesize
152KB

Download
memory/4924-2961-0x00007FFEE0CC0000-0x00007FFEE0CD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2960-0x00007FFEE0CC0000-0x00007FFEE0CD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2959-0x00007FFEE0BC0000-0x00007FFEE0BD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2958-0x00007FFEE0BC0000-0x00007FFEE0BD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2955-0x00007FFEE1380000-0x00007FFEE138B000-memory.dmp

Filesize
44KB

Download
memory/4924-2954-0x00007FFEE1380000-0x00007FFEE138B000-memory.dmp

Filesize
44KB

Download
memory/4924-2953-0x00007FFEE1380000-0x00007FFEE138B000-memory.dmp

Filesize
44KB

Download
memory/4924-2952-0x00007FFEE1360000-0x00007FFEE1370000-memory.dmp

Filesize
64KB

Download
memory/4924-2951-0x00007FFEE1360000-0x00007FFEE1370000-memory.dmp

Filesize
64KB

Download
memory/4924-2950-0x00007FFEE1AA0000-0x00007FFEE1AAE000-memory.dmp

Filesize
56KB

Download
memory/4924-2949-0x00007FFEE1AA0000-0x00007FFEE1AAE000-memory.dmp

Filesize
56KB

Download
memory/4924-2947-0x00007FFEE1AA0000-0x00007FFEE1AAE000-memory.dmp

Filesize
56KB

Download
memory/4924-2945-0x00007FFEE19F0000-0x00007FFEE1A00000-memory.dmp

Filesize
64KB

Download
memory/4924-2944-0x00007FFEE19F0000-0x00007FFEE1A00000-memory.dmp

Filesize
64KB

Download
memory/4924-2943-0x00007FFEE08B0000-0x00007FFEE08E0000-memory.dmp

Filesize
192KB

Download
memory/4924-2956-0x00007FFEE1380000-0x00007FFEE138B000-memory.dmp

Filesize
44KB

Download
memory/4924-2939-0x00007FFEE08B0000-0x00007FFEE08E0000-memory.dmp

Filesize
192KB

Download
memory/4924-2938-0x00007FFEE0740000-0x00007FFEE0750000-memory.dmp

Filesize
64KB

Download
memory/4924-2948-0x00007FFEE1AA0000-0x00007FFEE1AAE000-memory.dmp

Filesize
56KB

Download
memory/4924-2946-0x00007FFEE1AA0000-0x00007FFEE1AAE000-memory.dmp

Filesize
56KB

Download
memory/4924-2942-0x00007FFEE08B0000-0x00007FFEE08E0000-memory.dmp

Filesize
192KB

Download
memory/4924-2937-0x00007FFEE0740000-0x00007FFEE0750000-memory.dmp

Filesize
64KB

Download
memory/4924-2936-0x00007FFEE0630000-0x00007FFEE0640000-memory.dmp

Filesize
64KB

Download
memory/4924-2935-0x00007FFEE0630000-0x00007FFEE0640000-memory.dmp

Filesize
64KB

Download
memory/4924-2932-0x00007FFEE2AC0000-0x00007FFEE2AD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2930-0x00007FFEE2AC0000-0x00007FFEE2AD0000-memory.dmp

Filesize
64KB

Download
memory/4924-2929-0x00007FFEE2AA0000-0x00007FFEE2AB0000-memory.dmp

Filesize
64KB

Download
memory/4924-2928-0x00007FFEE2AA0000-0x00007FFEE2AB0000-memory.dmp

Filesize
64KB

Download
memory/4924-2927-0x00007FFEE2A10000-0x00007FFEE2A20000-memory.dmp

Filesize
64KB

Download
memory/4924-2926-0x00007FFEE2A10000-0x00007FFEE2A20000-memory.dmp

Filesize
64KB

Download