Overview

overview

8

Static

static

1

URLScan

urlscan

http://Ahttps/github...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1049s
  • max time network
    1052s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/08/2026, 03:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://Ahttps/github.com/orangegrouptech/YouAreAnIdiot-UnFlash/releases
  • Sample260804-d5v21sfm9z
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Ahttps/github.com/orangegrouptech/YouAreAnIdiot-UnFlash/releases
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff8e5ffc188,0x7ff8e5ffc194,0x7ff8e5ffc1a0
      2⤵
        PID:2176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,9775113506659924777,13460242049325422378,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:4984
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,13118897092210101448,13145483205032177545,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
        2⤵
          PID:5116
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,4436918822305241930,11917022637610134717,262144 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
          2⤵
            PID:3792
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10734378251919639118,8854327099103844589,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
            2⤵
              PID:2144
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4313262161000994383,949340163805965715,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
              2⤵
                PID:4248
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,5760735623979706019,15339279386155140014,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
                2⤵
                  PID:2344
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,13297262209018259283,10670081922268938251,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
                  2⤵
                    PID:2412
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,17415743021444417405,11159162528219759546,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
                    2⤵
                      PID:2612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,8780444595211153650,6654133280732561036,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
                      2⤵
                        PID:1284
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4504,i,3062311329269110911,6713536480283908373,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
                        2⤵
                          PID:1152
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,4432673465411702194,15842623604000331940,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                          2⤵
                            PID:968
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,5621463989314387963,6814064067673862898,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
                            2⤵
                              PID:1708
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15795384300637829340,9625094768474084699,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                              2⤵
                                PID:4836
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,10136854210823882148,12459157868021538412,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4008
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1128
                                  3⤵
                                    PID:1984
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15795384300637829340,9625094768474084699,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                                  2⤵
                                    PID:2588
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6684,i,2622118102212904956,14299862659903108350,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
                                    2⤵
                                      PID:2372
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4260,i,3220096664184029151,2161623546332753036,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
                                      2⤵
                                        PID:2284
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4824,i,9374277009470304681,1164833503195295584,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
                                        2⤵
                                          PID:2956
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16150069832781228124,14748271012265511975,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
                                          2⤵
                                            PID:1624
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,13765063250444828601,11817821056456232641,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
                                            2⤵
                                              PID:1532
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,4211895781957383193,15452018858474821241,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
                                              2⤵
                                                PID:1268
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8436485577603143371,12799305729660419456,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:14
                                                2⤵
                                                  PID:4504
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4716,i,12811023613495914444,11445959377816286059,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
                                                  2⤵
                                                    PID:1768
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6792,i,7786406702847786814,1046889112341050513,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
                                                    2⤵
                                                      PID:5076
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6916,i,2219608173446500077,8575121163823148140,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
                                                      2⤵
                                                        PID:676
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7040,i,14673542867856328511,949000435216308594,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
                                                        2⤵
                                                          PID:3152
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,14072855631110171318,2018487582714370687,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
                                                          2⤵
                                                            PID:3172
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6880,i,8626464508789641416,6800927417225024808,2097152 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                                                            2⤵
                                                              PID:3136
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,16622318290013763090,6648183217303950950,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
                                                              2⤵
                                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                              • NTFS ADS
                                                              PID:3128
                                                            • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                              "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Drops file in Program Files directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Enumerates system info in registry
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3876
                                                              • C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3876
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:808
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 912
                                                                3⤵
                                                                • Program crash
                                                                PID:848
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,16304015507784368775,15423751083570481092,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:14
                                                              2⤵
                                                                PID:240
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7120,i,12627493804528835707,7363816435158018462,262144 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:10
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5084
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3176,i,9333814283176875594,2928794238748159234,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:14
                                                                2⤵
                                                                  PID:5312
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,10781094416112706938,10657041041136605667,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
                                                                  2⤵
                                                                    PID:5328
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,5262283694199315897,2550663072122101539,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                                                    2⤵
                                                                      PID:5424
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,422632268084990533,6163343553086441188,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14
                                                                      2⤵
                                                                        PID:5992
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,17236521241527726817,840259249259366998,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
                                                                        2⤵
                                                                          PID:3988
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4681153055062095251,7720879910919825417,524288 --field-trial-handle=2136,i,5815953014620900725,18258860241503458074,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
                                                                          2⤵
                                                                            PID:3104
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                          1⤵
                                                                            PID:4872
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3876 -ip 3876
                                                                            1⤵
                                                                              PID:2948
                                                                            • C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                              "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2932
                                                                            • C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                              "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4560
                                                                            • C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                              "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3840
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                              1⤵
                                                                              • Enumerates system info in registry
                                                                              • Modifies data under HKEY_USERS
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:2568
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d46ec728,0x7ff8d46ec734,0x7ff8d46ec740
                                                                                2⤵
                                                                                  PID:392
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,16318285309288646305,10169112342819849062,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:11
                                                                                  2⤵
                                                                                  • System Time Discovery
                                                                                  PID:3700
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,10124144467635030125,15505300143157708254,262144 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
                                                                                  2⤵
                                                                                    PID:2000
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,7596894929371342953,8174012277249473181,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1844 /prefetch:13
                                                                                    2⤵
                                                                                      PID:3556
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,9471629597836880625,156638424514959964,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3152
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,12472146831087339091,16691615318483395533,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3376
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,15683658424197579260,13016205389675288325,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
                                                                                          2⤵
                                                                                            PID:5008
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,4049198583831907953,10311165969541267748,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4956
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,15522066968400892668,15854833978374903878,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:14
                                                                                              2⤵
                                                                                                PID:5484
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,7764680213003355746,2770128795569150063,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5688
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4676,i,1900555133061493839,16007869855927215925,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5748
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3372,i,12775377489705323447,8067393762276748268,2097152 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5880
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,15397174050116869019,7624415989790632295,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:12
                                                                                                      2⤵
                                                                                                        PID:6084
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3876,i,13590445270767745345,10971855224295781716,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:5320
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,9332319456976574418,14542955785000752935,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:14
                                                                                                          2⤵
                                                                                                          • Modifies registry class
                                                                                                          PID:4048
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,14614964950443679972,13003689691958917509,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3960 /prefetch:14
                                                                                                          2⤵
                                                                                                            PID:5176
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,8205535615680845133,3335822217357044059,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6204 /prefetch:14
                                                                                                            2⤵
                                                                                                              PID:5260
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,3441391152331752633,14659732148133295613,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:14
                                                                                                              2⤵
                                                                                                                PID:5744
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3316,i,9582926179907673347,2799907781332331855,262144 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:10
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:6012
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,17775009076513776629,15023213786649915369,524288 --field-trial-handle=1976,i,2751447254665093570,6328208703423305889,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:14
                                                                                                                2⤵
                                                                                                                  PID:4236
                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:1488
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                  1⤵
                                                                                                                    PID:5580
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                    1⤵
                                                                                                                      PID:5852
                                                                                                                    • C:\Windows\system32\sihost.exe
                                                                                                                      sihost.exe
                                                                                                                      1⤵
                                                                                                                        PID:5380
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe /LOADSAVEDWINDOWS
                                                                                                                          2⤵
                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5548
                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                        1⤵
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1516
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2252

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            RobloxStudioInstaller.exe
                                                                                                                            • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                                            • Size 9.7MB
                                                                                                                            • SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            RobloxPlayerBeta.dll
                                                                                                                            • Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
                                                                                                                            • Size 21.2MB
                                                                                                                            • SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            54bfa002-c696-4e4d-b626-d0082a697677.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\54bfa002-c696-4e4d-b626-d0082a697677.tmp
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 ccc8c3ef4af8880346e187f829b6169601d9581dfd712f0a3fc73ebbb93afacf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            BrowsingTopicsState
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                            • Size 414B
                                                                                                                            • SHA256 163044335dc2bc81f80e6ed70447707b8a843c414553f184920248512df3a046
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 792B
                                                                                                                            • SHA256 ce26aadd02c33c2cf7361b9ce09a9c006ae11f24be25a5512bb8e4ecd139e22c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            000001.dbtmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp
                                                                                                                            • Size 16B
                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            000003.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
                                                                                                                            • Size 223KB
                                                                                                                            • SHA256 56839bd4c5b6ea453071b6cceb15cac0dc7e9f5600953af2c2f5cc5735e41e05
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            000014.ldb
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
                                                                                                                            • Size 16KB
                                                                                                                            • SHA256 ba27a52b58c6530de2b9b6493a437ce6cc964ee0f6b8fbbbb36d964079da2331
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            000015.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000015.log
                                                                                                                            • Size 608KB
                                                                                                                            • SHA256 097575449603ef9c016e031d03c7d4474f53a9bf8c59e1789f8c2bcdf0d9c0de
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            000017.ldb
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 154a6f2ca9fb9bbe7c6b44faa145a2a61691a2d30845ab92d7d90b1df7c590dc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                                                                                                                            • Size 349B
                                                                                                                            • SHA256 8802dcc1a9a1c07ac3617584453b6e395f35e3cbfb43426fafc62b6715c3f591
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 55e4cdb72ad2a6e16b0f60e52b8bdef4122206c8fb99b2aec10b33afb28d95b2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            MANIFEST-000001
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                            • Size 23B
                                                                                                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            MANIFEST-000001
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 76f775ee3d5707ca279c20cab0fd3ec188a7a9974f8f0159f88c891e85b78d54
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 474c8382d6e53474b45cd97451b1619dc6ef1d608ac22aeca7315d74b043473e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 89c720211123bceebaf0a1fb2d2b0d6c965e0de5b5f518a6c8ecc54cd3100151
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 1076de758f55afd15266445697e52c8fe6d2f304a1fdab1478ca9cb0cbc27ad8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 da1b58549bde9225a9ae5b5cbb8026e1fdd8516f2e5b24662d955617bca2cb24
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 d6ed812e7eb5e5772c0380d9664c6e7ad2dca3e2cb0745533428b91093062d18
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            TransportSecurity
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 f1c169284dad01599d0775e3591e2f1fb2404dfcf7c8746f56a1baca12d7b107
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 1812dba1403c0d7823b843d80a6eda4e76527ed8e97170eb624addfd2f0a4b63
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 419ad05042d995ff8064a98e10855083279c639504860b7712481df7923ab82d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 9f29818b16be6cd0afc75fb456f06ed752b86d420e54bac70e9ac198cc7596df
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                            • Size 14KB
                                                                                                                            • SHA256 74d61c296223ee725d4a7c53c2b4a81c476decfbec6b449fc6d5c5a68520834a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                            • Size 17KB
                                                                                                                            • SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2390e7de-08a2-4a58-a8d8-21ae9b37c554\index
                                                                                                                            • Size 24B
                                                                                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            temp-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fbe13f79-5fc7-41c9-bb85-d45024f47b9f\index-dir\temp-index
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 aa987c02ba1e452f9e974e81f208bc5174f99254e43d3b2f116e5e342d61b060
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fbe13f79-5fc7-41c9-bb85-d45024f47b9f\index-dir\the-real-index
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 f15b2f404213001acbd06f1f4c98bc4d202540e7931fcb78053a6ff21f81cdad
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe5b1ab8.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fbe13f79-5fc7-41c9-bb85-d45024f47b9f\index-dir\the-real-index~RFe5b1ab8.TMP
                                                                                                                            • Size 48B
                                                                                                                            • SHA256 54f138ada5e7a1245dd85c6fecfa853d66f920304c121c2f138403b326baa3a7
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 214B
                                                                                                                            • SHA256 a4b1bfc9449013723336dd8470d49b01618a37ce9e15614f2464c1f9e3013d0c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 130B
                                                                                                                            • SHA256 967690600a7b8cd507f99751b2d019f74817103674b2c0c915c3017a1d934ef4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 276B
                                                                                                                            • SHA256 f06e0cd057f838b4f6bcf18232ded4186f1196bd78a0a9e33aba49df0095b7b5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 216B
                                                                                                                            • SHA256 0c61e3b6ddb042c2148812670df2aa9eacd36ee7b35248c13ea7e8f038747f44
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 132B
                                                                                                                            • SHA256 8377dd43af00b8dc942cfd14a12ae6f94580c5e3ba8c59dcfe7ef37168d3d77c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                            • Size 283B
                                                                                                                            • SHA256 6950e97a47baa7ba6af1117c0eebb12e9cab1bcdd132bc5aef168e7690f567dc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt~RFe5b04cf.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5b04cf.TMP
                                                                                                                            • Size 137B
                                                                                                                            • SHA256 d102325b6b7ed68600e485b48530b1b76d5b4aab2239802fad16f0821a01e649
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                            • Size 144B
                                                                                                                            • SHA256 c103d0d036053002f08050ab23e28bfa1147510aa48ada6dc822c379e4ff11d7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe5b6dba.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b6dba.TMP
                                                                                                                            • Size 96B
                                                                                                                            • SHA256 8e9fc3ee83c830927262d3a2b037a4d83c6ffa84ebeaf7dd6f86db5f3827fc93
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            512.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2568_2042128362\Shortcuts Menu Icons\Monochrome\0\512.png
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            512.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2568_2042128362\Shortcuts Menu Icons\Monochrome\1\512.png
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            512.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2568_2042128362\Shortcuts Menu Icons\Monochrome\2\512.png
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            16.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2568_891389631\Icons Monochrome\16.png
                                                                                                                            • Size 257B
                                                                                                                            • SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                            • Size 115KB
                                                                                                                            • SHA256 d06be829b7efda6689bb7a8292f9a3d4b8bdef1e1a31adcdd896e7ee8e524681
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                            • Size 235KB
                                                                                                                            • SHA256 908f02c32dc870c775f2d7ba877ed1150a7127cade6da7abc70b6ebfa98ed709
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                            • Size 235KB
                                                                                                                            • SHA256 a0159a90189fa041aca6890f4eaf6a9026beed8d1e3787c20ae6b76fc23620a4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                            • Size 236KB
                                                                                                                            • SHA256 91c04a9bb29b9cc40a487be487f1b759695daa2654227011a21b66637b728b76
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                            • Size 236KB
                                                                                                                            • SHA256 7b0b755368fac3898fafdf8a9a825e7cdfd58a8b2f96aee9884a9404ca4b1914
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            blocklist
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                            • Size 105KB
                                                                                                                            • SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG.old
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                            • Size 334B
                                                                                                                            • SHA256 7e18fbb6ef40bc024d4efad1347e4d975f3efdf9b34f160566509bb6429f02b5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG.old
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                            • Size 357B
                                                                                                                            • SHA256 e9a39e1415738c4b3154cbf6e46a1c016879514718caa23cb34fd64ae83c86d9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            MANIFEST-000001
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                            • Size 158B
                                                                                                                            • SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 5f5bc120de328552b8cfb6f22db95e19304f875c486045d0466c55862877666e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 b1dab2fcaff055a7d1275b1e0706f22581a3709a7e9f13c05cce68ba80c274c6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe5878b5.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5878b5.TMP
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 1cb42ec512b8b971b8cf0c4e32919c460b10fd3f7759bcb55d1bf2c927749906
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Edge Profile.ico
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                            • Size 70KB
                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 38a5fd1ddbd4da9c8ece155b244864625b68d985eb857ea000632faae8911b92
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 940c1456cfe9c0253cff2df55de047292f2097a62db438da22b066198ce325e3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 ff60e6a847cb8439228d530d84beccc4d51e7c84130dc3121e57e278e68cfd09
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 111B
                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SCT Auditing Pending Reports
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Sdch Dictionaries
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                            • Size 211B
                                                                                                                            • SHA256 e474d8ed9058e493764d61a8560971d8f2b25193cb3a5102fb4df36fd6229812
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Sdch Dictionaries~RFe592cd3.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe592cd3.TMP
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 039529f978a9ea03b479a1210cfbc53a7ab47cc9bde556edb3f5ae116dece03d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 da411ced6e6aa0706204b37c0c92af7b16c978820589e0d978b5c38072ca2bf9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 17KB
                                                                                                                            • SHA256 9bec670cb9441e3dbf437843cb5b749ac9bdb0dc017980277750c84cab082030
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 21KB
                                                                                                                            • SHA256 c262834a522693356a121ef3ede8919288386087b191ebd6074233c989895d01
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 31KB
                                                                                                                            • SHA256 8b8b0564f1a6467822bb3e0b88850591ba46653a8a48620ac3bc47f7af45ac8b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\21fe119b-cfbd-4e7d-a241-ecc2e61e5323\index-dir\the-real-index
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 2ab0fc6691bef57fe55004de2b5dddafe778de62d267ca7fb9c81826ca625391
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\21fe119b-cfbd-4e7d-a241-ecc2e61e5323\index-dir\the-real-index
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 1b5befb0d25ef8b8dbd396267eb8eda7061f694457f20a89f45a4c278e5aa03c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 c6c5b8b1042022c07f89f5b3de39d01a404b9f71486ec6ad48bdc66c50417093
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 083d4bab3b47a40282fbd86b235c48af3cccb1801995ce0603beb1d8f5923d2b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe58a090.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index~RFe58a090.TMP
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 2de5ed39cce1e472cb161435584f16ab601e7f0484e11679221399e4ea82c0cc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9423748a-4d71-43e5-8d75-07056a17fdec\index-dir\the-real-index
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 fe21a5a81fec7291f6c4f55b8dd9552b8b726fde85f6d2390eda510e8cdffce5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe595bf1.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9423748a-4d71-43e5-8d75-07056a17fdec\index-dir\the-real-index~RFe595bf1.TMP
                                                                                                                            • Size 48B
                                                                                                                            • SHA256 5b73cc13ed0f0ab80528ba3750e0e0b71817f5f5b6935dff92b3b66f04e3926d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b7978f03-500a-4266-8c8c-b504f996fc13\index-dir\the-real-index
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 076b5519c780f9bd1685806698d52f53d5b291dd3a0347c7306b0fd7da11af0f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                            • Size 476B
                                                                                                                            • SHA256 a4fefcac974cbbe39b27bc14655391f18ccd7251ab063097c8440a69754aa6f8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                            • Size 481B
                                                                                                                            • SHA256 fb31933f4989bc9e32f431a271112f6e64a46eba9cc075cdb1b53d486368c1e2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 52b7ef46a96a2661b7fe1d2a4207417c299dc182889503696eaf238f1a1dbac0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe58f6de.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f6de.TMP
                                                                                                                            • Size 48B
                                                                                                                            • SHA256 736482dc68c444470669198324951b2b4fdce8f309c6e4450a5c61139f60bfae
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 98fa968ced358f609a8165052b34e307243fe3e23ebc9db967540b7e7a056e63
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            f9961971-e2ad-496b-aed6-a48054bd935c.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f9961971-e2ad-496b-aed6-a48054bd935c.tmp
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 28KB
                                                                                                                            • SHA256 0decc2eb89f60b715145577d2097e7351f5d70c762d1329ec63f8e30101ef242
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 8b6fd88198557e9a583c71c923d6d1a1bf275870cc790240f83aef853df57966
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 20KB
                                                                                                                            • SHA256 fbe62594d33fc684de18865f82a0aed0c0318398f177a40ac169a6ad15d8ecf9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 28KB
                                                                                                                            • SHA256 529cb94d469a2ad7b62ae9c57db5d7beb6ad0fc6f782ada717e43b90c25cc174
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 3eccee65d01e20b98668730b6fba06349a753fcc46fe1421386a3bd3e69fde9f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 23KB
                                                                                                                            • SHA256 0487f8d314d048363364a7ce50b70f686cbe72bd0e1b5c4492d425b06b561468
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 a66a1313f608381c9d06855d0ecc4a1356050bb358dae0d30e7de50ec3343e72
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 aef72bf698ac48582e52dc852cc8095d805def29bbd0dcf4d968c9564ebf9d72
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            bf845eae-9d56-408d-bd3d-dfb93c87f60f.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf845eae-9d56-408d-bd3d-dfb93c87f60f.tmp
                                                                                                                            • Size 13B
                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            www.bing[1].xml
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YQO51DHT\www.bing[1].xml
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 f0d6b2e20e7ea0ad0c3f8cbfefd202fba58c50f2f8ed47fdc9c7c37370f98122
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            AppCache134302885065078760.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134302885065078760.txt
                                                                                                                            • Size 82KB
                                                                                                                            • SHA256 3ee2a0b70287b67f1ea5bb72a91b8ef9b43b556dc0f7bb2629d3a50db7b09ddb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Roblox Player.lnk
                                                                                                                            • Path C:\Users\Admin\Desktop\Roblox Player.lnk
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 d8389f3cd04242a80afff3f435bab286fcbee56769cff7130fd4e5e61dcec5d6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Roblox Studio.lnk
                                                                                                                            • Path C:\Users\Admin\Desktop\Roblox Studio.lnk
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 e191452deed9156d7e0b67fec7d2410b0b88c8d56bdcfe94c1603d29b4a6e074
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            RobloxPlayerInstaller.exe
                                                                                                                            • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                                                                                            • Size 9.7MB
                                                                                                                            • SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            RobloxPlayerInstaller.exe:Zone.Identifier
                                                                                                                            • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
                                                                                                                            • Size 171B
                                                                                                                            • SHA256 2cd30c7ca51760fa80112e9b148c84f5423e26ba6bb71ad2c9926da9edc9ad9d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/1516-2593-0x0000024E5E560000-0x0000024E5E580000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2679-0x0000024F604D0000-0x0000024F605D0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2665-0x0000024F609D0000-0x0000024F60AD0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2663-0x000002462A460000-0x000002462A560000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2625-0x0000024E5E460000-0x0000024E5E560000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2592-0x0000024F5E950000-0x0000024F5E970000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2553-0x0000024E2B200000-0x0000024E2B300000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1516-2534-0x0000024E2B200000-0x0000024E2B300000-memory.dmp
                                                                                                                            Download