hxxps://cdn[.]discordapp[.]com/attachments/1522665947645612192/1550912187256676432/Nexomia[.]exe?ex=6ab00f07&is=6aaebd87&hm=6004f17e1010686908e0f2ce29fe5798dd009c2d9f1083ad697d4372d69c3691&

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1049s
max time network
1039s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1522665947645612192/1550912187256676432/Nexomia.exe?ex=6ab00f07&is=6aaebd87&hm=6004f17e1010686908e0f2ce29fe5798dd009c2d9f1083ad697d4372d69c3691&
Sample260919-vnwewshe78

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	4008	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4440	Nexomia.exe

Loads dropped DLL 2 IoCs

pid	Process
6024	msedge.exe
6024	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_205636253\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1091511756\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Staging	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_143810931\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_777701682\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_205636253\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_740016716\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1601789067\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_589291252\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_898492701\ranked_dicts	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1125615431\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Analytics	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_589291252\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1944974377\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_649773142\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Entities	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Sigma\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Sigma\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_205636253\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Mu\Other	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_2128532379\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_2128532379\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Mu\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1860097535\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_649773142\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_2128532379\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_898492701\male_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_898492701\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_740016716\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_740016716\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1922790143\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_143810931\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1374438032\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_898492701\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_633724617\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_777701682\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1457859875\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_589291252\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1091511756\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2168	powershell.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4008	msedge.exe
5852	msedge.exe
1316	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343113333366461"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{BDC6D731-B4D3-4D62-8161-1F0F661AFC45}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{7D168943-45D9-4399-8231-0EA3F2E08E39}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe
4440	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
740	msedgewebview2.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3932	wmic.exe
Token: SeSecurityPrivilege	3932	wmic.exe
Token: SeTakeOwnershipPrivilege	3932	wmic.exe
Token: SeLoadDriverPrivilege	3932	wmic.exe
Token: SeSystemProfilePrivilege	3932	wmic.exe
Token: SeSystemtimePrivilege	3932	wmic.exe
Token: SeProfSingleProcessPrivilege	3932	wmic.exe
Token: SeIncBasePriorityPrivilege	3932	wmic.exe
Token: SeCreatePagefilePrivilege	3932	wmic.exe
Token: SeBackupPrivilege	3932	wmic.exe
Token: SeRestorePrivilege	3932	wmic.exe
Token: SeShutdownPrivilege	3932	wmic.exe
Token: SeDebugPrivilege	3932	wmic.exe
Token: SeSystemEnvironmentPrivilege	3932	wmic.exe
Token: SeRemoteShutdownPrivilege	3932	wmic.exe
Token: SeUndockPrivilege	3932	wmic.exe
Token: SeManageVolumePrivilege	3932	wmic.exe
Token: 33	3932	wmic.exe
Token: 34	3932	wmic.exe
Token: 35	3932	wmic.exe
Token: 36	3932	wmic.exe
Token: SeIncreaseQuotaPrivilege	3932	wmic.exe
Token: SeSecurityPrivilege	3932	wmic.exe
Token: SeTakeOwnershipPrivilege	3932	wmic.exe
Token: SeLoadDriverPrivilege	3932	wmic.exe
Token: SeSystemProfilePrivilege	3932	wmic.exe
Token: SeSystemtimePrivilege	3932	wmic.exe
Token: SeProfSingleProcessPrivilege	3932	wmic.exe
Token: SeIncBasePriorityPrivilege	3932	wmic.exe
Token: SeCreatePagefilePrivilege	3932	wmic.exe
Token: SeBackupPrivilege	3932	wmic.exe
Token: SeRestorePrivilege	3932	wmic.exe
Token: SeShutdownPrivilege	3932	wmic.exe
Token: SeDebugPrivilege	3932	wmic.exe
Token: SeSystemEnvironmentPrivilege	3932	wmic.exe
Token: SeRemoteShutdownPrivilege	3932	wmic.exe
Token: SeUndockPrivilege	3932	wmic.exe
Token: SeManageVolumePrivilege	3932	wmic.exe
Token: 33	3932	wmic.exe
Token: 34	3932	wmic.exe
Token: 35	3932	wmic.exe
Token: 36	3932	wmic.exe
Token: SeIncreaseQuotaPrivilege	5068	wmic.exe
Token: SeSecurityPrivilege	5068	wmic.exe
Token: SeTakeOwnershipPrivilege	5068	wmic.exe
Token: SeLoadDriverPrivilege	5068	wmic.exe
Token: SeSystemProfilePrivilege	5068	wmic.exe
Token: SeSystemtimePrivilege	5068	wmic.exe
Token: SeProfSingleProcessPrivilege	5068	wmic.exe
Token: SeIncBasePriorityPrivilege	5068	wmic.exe
Token: SeCreatePagefilePrivilege	5068	wmic.exe
Token: SeBackupPrivilege	5068	wmic.exe
Token: SeRestorePrivilege	5068	wmic.exe
Token: SeShutdownPrivilege	5068	wmic.exe
Token: SeDebugPrivilege	5068	wmic.exe
Token: SeSystemEnvironmentPrivilege	5068	wmic.exe
Token: SeRemoteShutdownPrivilege	5068	wmic.exe
Token: SeUndockPrivilege	5068	wmic.exe
Token: SeManageVolumePrivilege	5068	wmic.exe
Token: 33	5068	wmic.exe
Token: 34	5068	wmic.exe
Token: 35	5068	wmic.exe
Token: 36	5068	wmic.exe
Token: SeIncreaseQuotaPrivilege	5068	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
4440	Nexomia.exe
2060	msedge.exe
4440	Nexomia.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2844	2060	msedge.exe	90
PID 2060 wrote to memory of 3844	2060	msedge.exe	91
PID 2060 wrote to memory of 4008	2060	msedge.exe	92
PID 2060 wrote to memory of 3844	2060	msedge.exe	91
PID 2060 wrote to memory of 3844	2060	msedge.exe	91
PID 2060 wrote to memory of 3296	2060	msedge.exe	94
PID 2060 wrote to memory of 3296	2060	msedge.exe	94
PID 2060 wrote to memory of 4984	2060	msedge.exe	95
PID 2060 wrote to memory of 4984	2060	msedge.exe	95
PID 2060 wrote to memory of 4984	2060	msedge.exe	95
PID 2060 wrote to memory of 5092	2060	msedge.exe	96
PID 2060 wrote to memory of 5092	2060	msedge.exe	96
PID 2060 wrote to memory of 5092	2060	msedge.exe	96
PID 2060 wrote to memory of 2088	2060	msedge.exe	97
PID 2060 wrote to memory of 3472	2060	msedge.exe	98
PID 2060 wrote to memory of 2088	2060	msedge.exe	97
PID 2060 wrote to memory of 2088	2060	msedge.exe	97
PID 2060 wrote to memory of 3472	2060	msedge.exe	98
PID 2060 wrote to memory of 3472	2060	msedge.exe	98
PID 2060 wrote to memory of 2324	2060	msedge.exe	101
PID 2060 wrote to memory of 2488	2060	msedge.exe	102
PID 2060 wrote to memory of 2324	2060	msedge.exe	101
PID 2060 wrote to memory of 2488	2060	msedge.exe	102
PID 2060 wrote to memory of 728	2060	msedge.exe	103
PID 2060 wrote to memory of 728	2060	msedge.exe	103
PID 2060 wrote to memory of 5088	2060	msedge.exe	104
PID 2060 wrote to memory of 5088	2060	msedge.exe	104
PID 2060 wrote to memory of 5088	2060	msedge.exe	104
PID 2060 wrote to memory of 4184	2060	msedge.exe	106
PID 2060 wrote to memory of 1868	2060	msedge.exe	111
PID 2060 wrote to memory of 2936	2060	msedge.exe	112
PID 2060 wrote to memory of 2936	2060	msedge.exe	112
PID 2060 wrote to memory of 2936	2060	msedge.exe	112
PID 2060 wrote to memory of 4440	2060	msedge.exe	113
PID 4440 wrote to memory of 740	4440	Nexomia.exe	115
PID 740 wrote to memory of 1312	740	msedgewebview2.exe	118
PID 740 wrote to memory of 5396	740	msedgewebview2.exe	121
PID 740 wrote to memory of 5396	740	msedgewebview2.exe	121
PID 740 wrote to memory of 5396	740	msedgewebview2.exe	121
PID 740 wrote to memory of 5424	740	msedgewebview2.exe	122
PID 740 wrote to memory of 5548	740	msedgewebview2.exe	123
PID 740 wrote to memory of 5548	740	msedgewebview2.exe	123
PID 740 wrote to memory of 5948	740	msedgewebview2.exe	124
PID 740 wrote to memory of 5948	740	msedgewebview2.exe	124
PID 740 wrote to memory of 5948	740	msedgewebview2.exe	124
PID 2060 wrote to memory of 6024	2060	msedge.exe	126
PID 6024 wrote to memory of 5320	6024	msedge.exe	127
PID 6024 wrote to memory of 3768	6024	msedge.exe	129
PID 6024 wrote to memory of 5852	6024	msedge.exe	128
PID 6024 wrote to memory of 3768	6024	msedge.exe	129
PID 6024 wrote to memory of 3768	6024	msedge.exe	129
PID 6024 wrote to memory of 4784	6024	msedge.exe	131
PID 6024 wrote to memory of 4784	6024	msedge.exe	131
PID 6024 wrote to memory of 3960	6024	msedge.exe	133
PID 4440 wrote to memory of 3932	4440	Nexomia.exe	134
PID 6024 wrote to memory of 5584	6024	msedge.exe	143
PID 6024 wrote to memory of 5584	6024	msedge.exe	143
PID 6024 wrote to memory of 1920	6024	msedge.exe	138
PID 6024 wrote to memory of 1920	6024	msedge.exe	138
PID 6024 wrote to memory of 3760	6024	msedge.exe	139
PID 6024 wrote to memory of 3760	6024	msedge.exe	139
PID 4440 wrote to memory of 5068	4440	Nexomia.exe	140
PID 6024 wrote to memory of 5900	6024	msedge.exe	142
PID 6024 wrote to memory of 5900	6024	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1522665947645612192/1550912187256676432/Nexomia.exe?ex=6ab00f07&is=6aaebd87&hm=6004f17e1010686908e0f2ce29fe5798dd009c2d9f1083ad697d4372d69c3691&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffaed5bc188,0x7ffaed5bc194,0x7ffaed5bc1a0
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,5382844269236130373,4098152591592620679,262144 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,2329004891453934987,3190092350300043429,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,5122432818123741381,1609539177567554904,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6883699541848655934,2488511554097251256,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14104561886434008540,7275915966497767065,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,3772875248054214694,729935322708239684,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,16117020264127458119,12072226070188753546,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16478858009853118630,11880152632953848506,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7767875169582223499,9092207018101956877,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,7865575903384123751,7925408383164290029,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5752,i,3580920905544197645,15446543464050819842,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8424592496967173485,8138168553299498520,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8424592496967173485,8138168553299498520,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,1670775178741823,17421431385699273449,524288 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4276,i,6959097827275535385,17592109208894133036,2097152 --field-trial-handle=2260,i,3051381550458092721,17444215109998061848,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2936
- C:\Users\Admin\Downloads\Nexomia.exe
  "C:\Users\Admin\Downloads\Nexomia.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4440.3268.4226323871638576521
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffae920b078,0x7ffae920b084,0x7ffae920b090
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1768,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2088,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1772,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3696,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4492,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4452,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4212,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4216,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2224,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4764,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3872,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
      4⤵
      PID:6756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4720,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1308,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:8
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4320,i,11947696893436658913,2728889190199408057,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
      4⤵
      PID:5772
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4364
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3832
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4896
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1516
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4744
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:804
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2784
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:964
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4876
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2168
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2368
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1776
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6288
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6508
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6824
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6928
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6148
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5084
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6712
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3876
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6824
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6520
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6580
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4680
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6808
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6828
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6928
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:836
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7124
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:220
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6204
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6408
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1760
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1732
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:884
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6648
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4496
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7004
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6860
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7136
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4032
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4916
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4652
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6504
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3280
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4496
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:540
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6832
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6508
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7152
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7160
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5016
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6404
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2012
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:452
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1792
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6524
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5048
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6728
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1716
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5088
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2300
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1344
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4948
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6432
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5016
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3272
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2640
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6940
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6612
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6728
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5912
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1192
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7020
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5272
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6888
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1648
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7144
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5636
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6324
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3272
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1376
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6472
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6216
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4500
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4528
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5712
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6772
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6820
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6860
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3332
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:804
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6464
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7160
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2176
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1592
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1984
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:920
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6736
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4588
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3272
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3700
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2712
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4908
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6588
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6708
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2328
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3036
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6104
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7020
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6064
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4192
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5444
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:564
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5256
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6468
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4956
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4500
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6552
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6592
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:464
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6792
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1564
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7020
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3316
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7084
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3520
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5444
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2292
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6548
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:228
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4520
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6572
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1168
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2256
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3900
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3036
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6924
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3332
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7120
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4288
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6952
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5388
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2420
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5020
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1080
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6732
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:228
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4824
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3312
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6656
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1812
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1564
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5124
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4132
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2000
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5440
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6320
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6116
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6708
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6588
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5104
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:548
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6596
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6516
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6608
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6836
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4132
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6644
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7000
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4372
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3316
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6752
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1764
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4284
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4008
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3644
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6636
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6588
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5148
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6692
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3196
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6436
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2604
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:412
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1960
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2420
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:60
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7044
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2208
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7028
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2100
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6572
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7036
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5048
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2188
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:456
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6612
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6864
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2348
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1932
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3492
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1880
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3752
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6752
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1764
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6068
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5836
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:688
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3420
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3280
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1240
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2668
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2008
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4920
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6960
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2552
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2964
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4712
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5016
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5080
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6620
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6628
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3644
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6496
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6432
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4792
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1468
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:920
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3680
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6788
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4380
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6608
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6240
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4764
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4776
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1576
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:60
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6296
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2448
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3760
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4404
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6616
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1552
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2940
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7032
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2368
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6836
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1368
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6612
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:816
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6824
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7008
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6500
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7064
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3800
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2388
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6400
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5080
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5448
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6448
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4628
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4404
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4792
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6616
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3280
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7032
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6924
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5208
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2364
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1932
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6484
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5936
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1888
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3384
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2568
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5084
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:452
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2292
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6620
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6720
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:228
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4040
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6420
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1060
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1116
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:920
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6776
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5908
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:936
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6324
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4204
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1800
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6656
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1600
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:872
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5240
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2564
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2116
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5844
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4888
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3644
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6316
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6648
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6452
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3680
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6792
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3396
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6652
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5956
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6960
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7128
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4132
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1728
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2196
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6208
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:860
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7152
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1136
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1576
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4804
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6916
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:640
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4956
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2532
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2668
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1988
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6232
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2064
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6204
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2368
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1956
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6436
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:668
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5376
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1268
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3832
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7064
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1136
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1576
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6732
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4128
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5080
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4780
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4136
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:384
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:1464
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:4040
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2100
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:464
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:2188
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3396
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6204
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5368
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:7124
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6832
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6308
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:5148
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6216
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:3304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
    3⤵
    PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaed5bc188,0x7ffaed5bc194,0x7ffaed5bc1a0
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,16179274455983663204,4158873679508875727,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6885507515487852743,16889521755357836047,262144 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,18110666615068634930,15618068954770242146,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,7120062768387966919,16616166453003862232,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,7120062768387966919,16616166453003862232,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,13562254672897431663,13413633848352299306,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,12091938176700561322,5465121952823075922,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,6066354388068244565,9519432255620503457,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,401468570484989826,5761226454650641956,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,14064319519221359935,4181510334171556696,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,2505962967817029153,5126666133192839303,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10278313906871642611,905130819837495510,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12320468277128733580,10128225277696482716,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,4914382120595038059,8437471715471821219,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,15367999948477158706,306968644070435158,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
    3⤵
    PID:332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,8374184089800761845,954933792429993825,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,15197224213087649265,3023586190616465884,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5072,i,12475944484036694377,1291610814419931696,262144 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8313863114463775569,849181718018690087,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,12019477671159398555,11820417654665777012,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,13340693906582828109,16260152763555817704,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11311340070116048580,15403265109397286502,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,9238665907392929444,10419654608137889761,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
    3⤵
    PID:176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,13237976255720152910,16037847384478489731,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,16693173686906637902,15761820706014508624,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,5103162048970497918,7653172569075929870,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,14872833373746840663,5734642899757696897,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,15332442461022455827,16735786918812075552,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,10707032686651531241,709261525882506267,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,14583570407851358615,5282253256741301656,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7237071372107889344,8686221830522165733,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5065061499629584379,7124831781208223758,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9240618338814305773,4193212766582180038,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,6161630663029250013,6967487378780078876,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,2539074680662801052,8367045242040010145,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9329552492233948217,13965675897017947211,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,11261622727098942463,8304139512855206218,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1065861534375087786,317123399006715136,524288 --field-trial-handle=2280,i,12773134322233253042,4310070599229613429,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffae6eac728,0x7ffae6eac734,0x7ffae6eac740
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,10487434578049238060,5833811383290875623,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2793630725026629347,15950856933643234978,262144 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,13741698364375651982,14061665369031487474,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2895451637252548895,9650816518503746915,2097152 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,2107664797162345308,5876767814890043400,2097152 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4180,i,2195726818638454046,13376272236616965124,2097152 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,10309866965388835166,13242106069955640683,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:6372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,8841205940921725787,13773792297310065371,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,18016245056824915697,11673357357658064162,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,972719039658079434,9752181994751906721,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5344,i,397167973939967398,13589188371702319475,262144 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1148 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1304,i,17999425668774828616,2670729106358471302,524288 --field-trial-handle=2064,i,11564163096397423630,11861566699496355762,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:6932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1294585739\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1374438032\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1426806055\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_143810931\manifest.json
Size 53B
SHA256 920ebcad2d6434116e19e96be9f39cded421dcfbeaf67c20608f1ee2bb8387e8
MD5 f33d006d7963db8ed6ed284375c10db4
SHA1 bfa356b70526e3e7936e7ee409951753a475cfd8
SHA512 795af91cb503b6bab9a76037fd84d71ffc0c563ed4f5443522ec3f0ada6007bcfe11800eb4d2d6d2d3140200a5a3c779c2ecf8167194d562f55c05076656fa9e
TLSH
T19E9002600414921716C10E506570B8C1A391661955891D1D04451568029586CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1457859875\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1601789067\_metadata\verified_contents.json
Size 1KB
SHA256 721a6439a0b19869aaace755c9e795f83aed516e4b42d8a13f4fd978d0586d18
MD5 61be80a9c93aef9160d69c843d290855
SHA1 b4ccbdc935f95400b730d1c9b00bde4dc5146872
SHA512 8754c4795a7cef4acb6a90807614ba2c4bc2e9e7e58bbc9944c0cbc121d88f19b8a5f349582dd968738f10324d0652e904d28dfa91646f4f5064219e8f047fa5
TLSH
T1B73119A4C40EE21BF5BF33252E593E3F0717A1DBA1D8E7236690145F10C4A4E9313562
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1922790143\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1944974377\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_1972491057\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_205636253\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_2128532379\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
TLSH
T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_280803542\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
TLSH
T134C04C5185005D72509D87781D6C97054B12CF4618947509DDC68309EC1DCCB64B234E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_649773142\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_740016716\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6024_767912438\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1091511756\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1125615431\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1125615431\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1287556609\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-af.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1645644737\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_2142714173\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_445733566\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_589291252\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_898492701\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8235c9a33cd107930186170ebf1f7fa54d273ad43f0ee8ed4826ee3a9699ec23
MD5 0e8c3651ffba4269afc687855d92d800
SHA1 59e1c2d9e1c025ab29c9c254a00c71728d13e6cb
SHA512 8f82f6412b138edc184b376c63454d1004600c107627f2e00d31c42b2e35dd3ecd2d78cdf8ea136eb14a6b36ad1df39b1d491ce786763996fdb33b1e554847e0
TLSH
T19DF078A9C821AC7B1CFC172820A80F87FB90136B2781895F3B3D960C8FF463B418582C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5c9b1bb545d339b521261f899a9a6835dbc1be5bd4e6a878624ff038970a073
MD5 be53a886edb34cff5a4308d0416b7dcd
SHA1 5c450b7efb703a1c63e97dced17b936e81b9a245
SHA512 b58cb8bd995b5cbafd67d7bf1017049d83a40233337cc22ed00714189788c056c207abbd14dcf14082d828ef128a0cdbc95bfddca68d427a5ed0f940357b1d36
TLSH
T185516CB7C7D48B7DC81156F49B216E1FCD2D0A64522C3C26C8D4AE5B53E29B2D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8a51a981c381742753b107e22071cb341cd265b31f628b5dfb3d82733eda8556
MD5 dd9bcb49cd7d63f348e605c8f4a4809e
SHA1 85deee294047ce613ee36928a903f500e8df84ff
SHA512 c7e011865d411788f3e89a829582a842d29846e2fdabc8509adc48126d9815cd957b17e6d200816641150a90aef12a4f297026190a6aba164fbcd62bd978243a
TLSH
T1BA516BB7C7D48B7DC81156F49B216E1FCD2D0E68522C3C26C8D4AE5B53E29B2D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dbd6e140488c24cf7e82bcc36567c88124764d17dde069eb6b91b13af3f65b06
MD5 1b390cba16b892c2bb97247bc1851b5b
SHA1 a4c587f4a30c3cec601f5075e15a9ac10242ad90
SHA512 18d1cd0b6f770618de2eaf5cd813b1d8b88f88d415eba50cf10134ac4f42f66fa7107404f46c15780c11c724a1852e1b315b1790b579d67324bfcce88d801c17
TLSH
T140518BB7D3D4CA6DC41166F49B216E2FDD3D0A28121C3C62C9D4AE5B53E29B3D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e22150c3a3713e2fccdb9fca3d4fdc4723bab5e53397025526c4ebb015d34d22
MD5 c86ee125857cff2901be301c5e9f7280
SHA1 b3e92c3af7a092d4ed23836d177fac8ad8995306
SHA512 b3adbea49c02a08d2827ba7863ba82ff0ec92a194863668ce39c3dde0cc9909a2d71d530b8770532e44278c4b98c3581e95941097bad16e191a96e214981964d
TLSH
T197518EB7D3E48A6DC511A6F49B116E1FDD7D0A24121C3C61C8D4AE5B53E25B3D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff5db966124638779caee403baa4983b236d37e5a4e2713f59c49535da5ca206
MD5 5e71b191f5410ac4dfc6d51b92496bee
SHA1 8fcf348a59e664768edcb76b1841cf9da1640e7d
SHA512 0eae49440bf178905d095fc1211b127ebc967cc4007271fd737ec725ee7d8446ae9ff6f6e349cb32340c2a755e9bcce071f2da6b37fd176b97eea8ef8732b087
TLSH
T129617CB7D7D48B6DC41166F49B216E1FCD3D0E68122C3C22C8D8AE5B53E29B2D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 56c637af5739552fb464406049faebb25117fbf84ab1a58813b89626c6717b00
MD5 dee48dc8b65881a874a3021fab806834
SHA1 e0ea6e4654b82d07611932d4158a247c0af1ff39
SHA512 35205d4315f541d9dad9e78286187a7271fb86be463d2a9bd43545529eecacae15fe11104c81e2c3269234ab45857a83303a94d2a15d53640e37c7c2f92dc8d0
TLSH
T1CB518DB7D3D48A6DC511A6F49A216E1FDD3D0924122C3C6188D4AE5B53E29B3D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c926b390ce0f6a7a267d2e0a6e2e570a813b46ca5773f071120916b0962331b2
MD5 950e0fb0e89e69258447d962d9a2c261
SHA1 dac57109ae758ea9151df070d371639a6e712f70
SHA512 78d1b8cfddda15c21d50aec93acf2399eb7aaec1a3062ef3c14d3b76c7793aec6f8168922a36767c79a36510b832bfbf3469d27c5516f1e26fac1e75fbe862d7
TLSH
T195F059A7DB7DB477607A16AF5F08F8091CB5A8B8028158F4CE6A437CA0C94EB0F07443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 959cfa390026383a5701a2cd5cc497ed5bb6ef4d253baa7c83b154cb25532880
MD5 af8983e2b900d359f2ec7cfbc850cef0
SHA1 8483dfea0314a4efc2088793ba4e507d813037ac
SHA512 91fe2c6efba791298a5fc91dff7f97f76cf70a59747819fd8c52521dbdecbeb05dfaa14f2b90e25756b1f2ec50a2e7219a93011469b05c5513de7a09e8186b33
SSDEEP 192:aRSjw8rbv7UpAPRp2v9/Hsb+WNnmo0bT281kwmww+VyIsnAUgraJ:aRSjtjAUXchwL0v2AGb2e
TLSH
T1A742822DBD10753B5CDBD22AE9167B53E3F5202224942E84E6FC8E7C19E75CC222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4d151bfe73b5313a6ea6a6868ff563b01406d65f74c7d9260b5b12b12491484a
MD5 7756a3dde039677ee5564ddcf52dd36d
SHA1 bc4deb55833a78438e2f9311944436460ee654e7
SHA512 32ec8f49d39c7f82ceb5d340937a3f39850ee448b9c305facc58a9b60732da0df455aa85eda23cb91579163f2fba2bc6bd7d6506bd0ac7371783a58474d27e95
SSDEEP 192:aRSjw8rvv7UpAPRp2v9/Hsb+WNnmo0LT281kwmwd+VyIsnAUgtaJ:aRSjtnAUXchwL0/2AGy28
TLSH
T1C132922DBD20753B5CDBC22AE9267B53E3F5202124942E84EAFC8D7C19E75CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2cfdba6707f1d9df829d6ca0c97f2d674259803f0209c5b22a00b2866539f3b
MD5 d7c1177086c50abe06433ceb1a4c93af
SHA1 61d5bbcb450bcd8e89ee2b9a1e45afc64b34f722
SHA512 686d5296968081a48aa4360cf870d1bc4a3ac4418d38cf64f21e2eaa0e7552fe6ebb1d7ce1e17ff464ee97ca2b29906d182069014d52584fa430eab55e1946b3
SSDEEP 192:aRSjw8rYnv7UpDPRp0v9/Hsb+WNnmo0iT281kwmw6+VyIsnAUgraJ:aRSjtYvA9X6hwL0I2AG/2e
TLSH
T1B042622DBD10753B5CDBD22AF9167B52D3F5202124942E84E6FC8D7C19EB5CC221B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4e6fa9189264c5ed6520f913a6f110a649615e1c4c699853c9a6c8cfd2e1bac1
MD5 cafb15092e810b3a91d0a8e4fe4b20d7
SHA1 86038d23dd1a18b98110d3da1d25f9ec5336ba7d
SHA512 ea1ed44a291147ff69f9be9145a311439a74635c83e23759348808c57226e8daa5ba822d9457a94a97cc82a2f19fdb4bd7ae0735c5e3bd24a169587c815a6d3b
SSDEEP 192:aRSjc8rYnv7UpDPRp0v9/Hsb+WNnmo0iT281kwmw6+VyIsnAUgraJ:aRSj5YvA9X6hwL0I2AG/2e
TLSH
T1DE42622DBD10753B5CDBD22AF9167B52E3F5202124A42E84EAFC8E7C19EB5CC221B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c1566a1cb0c80d2810ff5ded27e81c3d45c65e3aa47b448a206aa95983967d04
MD5 52a88b106c514c1f43b9425c8a890cf4
SHA1 1fdc573ca786b6b0041b1be298a43b0d2a80eb8d
SHA512 8a24fd91534b808db878a0ca9df6a20790dd1bce198d7f4b3244ebec6e3c10c6a68edf47598c7a2e067e28fe018d534a6dc23cd2ef78497ef15d316ed41be2c2
SSDEEP 3072:xAS+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:qS+hFD+7t56OD9ZfSApprE
TLSH
T17DD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 45e1d2679b8f5511260f000f2613bed88016a6518815958f82b71b9c937d49d0
MD5 ede733fecfc4105aff1a3a55fc5639bc
SHA1 d8d88661bb237fd8e89cf74a56ba0f67ea01c2bc
SHA512 43e5012e0fff989a2b0ec59af6efa85e1442ab77c26ed0e500df012d708941b813e1222c4913ca1c1496b69818ef9432198a5e0f9a6693f47bbc0b6bfaf8352c
SSDEEP 6144:7OEhyHuhD8tzc4Ul6+hFD+7t56OD9ZfSApprh:7/2GD8tQ4Ul6yFSXD9ZfS4T
TLSH
T1AE4423637F69A93386BC6186A24B93C5CCB5B8DD12DC930A400AAF4B50DF9CD0367723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 301KB
SHA256 a351c26f1173c8823f0a26e66ec03a4ac367359548f97358119a305b8a66fa2c
MD5 ff80b64922bef4059faa970c0f4316db
SHA1 7b5d8c48126839f749a25d1ca93f96045886b9ce
SHA512 23513295caa860cc3222b263b20447d6b77cfdbb90beb35d4f547612cb8dfbabfd8c0bc6dc1ee42dccee3b424e5eff8164117d3a2900610915c096e5f5e88b68
SSDEEP 6144:7RvH6Zy6Ci4ATEhyHuhD8tzc4Ul6+hFD+7t56OD9ZfSApprh:7Rv6Zj4V2GD8tQ4Ul6yFSXD9ZfS4T
TLSH
T1D06423227E5AAD73CABC2446A28B6345CDF5B8ED12D9971D40097F8B50DF58C062BB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 838ab6e0df6561e979aac83843c57d47145a67ae022853db2b0a7824144abd14
MD5 615660692faf882f7dedd66aea4a656f
SHA1 30aa1c006b863de7978852068bab5aa96a888be5
SHA512 257506648ccc3ab00175fc62d997e03d3a21ecb6acca6098f09eb67802f227a9008294601599f3ea0b5df0cc81cc80c789246034d7151899d98105b78d9a41ba
SSDEEP 6144:v/0EhyHuhD8tzc4Ul6+hFD+7t56OD9ZfSApprh:v92GD8tQ4Ul6yFSXD9ZfS4T
TLSH
T1474423737F65AD338ABD658AA24B6385CCB5B8ED12CC960D4009AF4B50DF9CC0667723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 5db64119b7fa2b83c83e7978a1ca861326bec1ff753ae8da5a2998c7a79e5351
MD5 6eda6d8f8ca00147470f76e8b25353f3
SHA1 e083015f2fb73c0809774607c0e323df2fe8c4ab
SHA512 2349547e3b310e784ee60071861767daa2cbdbd529816caa34cfed6683072575c8ea6279de9a70ab21d36b04a56c683b2df11d489da17b23c9d367e8db41b03b
SSDEEP 6144:SOEhyHuhD8tzc4Ul6+hFD+7t56OD9ZfSApprh:S/2GD8tQ4Ul6yFSXD9ZfS4T
TLSH
T1C64413637F69A93386BC6186A24B93C5CCB5B8DD12DC934A400AAF4B50DF9CD0367727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8fc8f2e44e12702a6b7e0c8e058f1f8606ae29f9648a7a48b445c25a31ed19d2
MD5 8b3588f6115ea733f65a57bc1d23bab9
SHA1 6ebfead657c6b3189b9eb45b1163c756da9d5385
SHA512 418dd946de2959e57cc401dbde186803f4694e8ebddeb0c2607b9fe5670737ddb0eca558d471c6f35f49575b5ec570ae95a82da16701313aa25c43d91c85e167
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T129B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39599d4ee12a1f27723176ca897e6c0813f869b4107b7cd7c97af9d0b89b07af
MD5 68e4f9b862e0c9adad05d3b72e63f9d0
SHA1 6877937bed9834ec00a407f363bdf825b2caae88
SHA512 563c288c16ab5efc15b6625df18e548b499bc71945a5440a13d8364b285b24fefac94eb1dc5491525e8f8b616e67d8c57a59070353ff299eb0b4675eaccfedaf
TLSH
T191D0C014E3C4BCD5C00600720150439131CE409C2013A303C8901388478F93381C14A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 601b253973c17042c463386e9577f41da89d825c91eef548e95de85ec7744f96
MD5 683a7ce40eadfeaae6e816fc8eb31d14
SHA1 f65c513a71b03cf72784222f3dc5066e39a44b56
SHA512 91ffd353dd7be2b40edc941ff5d706f1de254172e61b7bab103f628b72c3cfa703b5631a00c8bdde8fc94b721f81f5182e00223cc701dfdc538fae21c87d63dc
TLSH
T187E0208805C9C72DD18DA547D1788B0C81803B0BD3CC6A451704CC44790158476D7764
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3739013894347def97d518713646848b6c287dca8c149aa5b53f106195627f6f
MD5 9b33365f3651aceb6e9726f19d9d4d32
SHA1 bc51f3b9590d0b2b7ead84af884400845b49204f
SHA512 7b924c48d41d67bb12cfdc2a6cf15f91d7cc6f3f525ee003aed31563acf399033c63e65e22162c6b7539dbef2c15c56e7a8bb75b70c2799c140aa845b61d3b6c
TLSH
T17FE0ABBAD9609C230CFD1B1D90100A81EB6013072F408D0F3A3C820E8FB453A4286C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f3beb04b0c4f5323b965d747bf19eb3f7cbb04f382d790973c073bd8c98b99d6
MD5 a8f9f0eced786ab2ffbda17dbae1f7c0
SHA1 d008eb9efd79a3212c2807a3a3686d8831b02a12
SHA512 3b092049e75deceeed37d0a0ee84022beb9346cd51e9368c6a1cb2af26b18b6b9e2182d08796daedd3d5897cbb1993eff0e9adfcf36f058feff2e33d12061edd
SSDEEP 192:DP9c6xd8dVUrBXXlxBVwTww9fpSsyauX9uuGbMNU27fQm0Bn6spEd2FldQ2pB6RP:x7xd8dVSjBS9fRGcMNxTu6wIk4DWR
TLSH
T10113D63D36042DDAF3D76A7E812B6B326732D931E8E61B4766F4F99262103568C1F910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 be2e08a6a8e9f52959e61f92d45b77d56f40a6423fc0648465c24eadac8be7a1
MD5 859cbe76a391c3cffb1c11125951e6e9
SHA1 6da5a95041b269606bfef7dfaa371a1c67014273
SHA512 2b7192d7a0f18b5722396a2cb7647dec944b710ebb02172203edb5d77f4e5a08d6dd24a12045f7422eb11ff946f10e282c0396ab46a3877945f5e3b9d48f9fdb
SSDEEP 1536:Ba/uyL/WvL/BTgbJH6X+1fpbh9QkhrZgL/GL/xL/6:BQuyL/AL/2NBhr+L/GL/xL/
TLSH
T123445FF71951A04BDBA852F5E2033E3EC1B7451D7CD1F8A9E1788CD22825B31B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8355109b56e01df2ec4e370e43df180a34bf48ca29f4a68c71d1036d254a04f0
MD5 0dcc150ce45a2be12388ef3522f09c82
SHA1 6b4254dfdc3673eaaae1fe855be6736df746fa2e
SHA512 2bec67c9d7f35503beaeb7250b77230147f906ecc5f2b9bed220e9fbb18187ce3d76d063499fe41f62a1270138c5fd585c209424fb01fd5351729e2a773f3331
SSDEEP 3072:pWXLxHVnKD7DZEHhr5tOFfouoIxgM5dJrEqW8kC2BOCmT:i2D7DZEB1tkTxgM5duv8mBOCmT
TLSH
T13B2528EEC7682C82DF6B8770B0E0D9077E712182BA5DC0D39944C5D897D2B8576E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 22906229dd2e451b0bb07692ed204bb82fa8489b334db31e553cce924a62d138
MD5 d61069082aea84bb6706263416050bc5
SHA1 3c96a98d5237f37098116cbd2794ff8e11c8ddd4
SHA512 e5fafd5d0645664059b657d369a26e6550eb547c1c172c59ca7625f6dac6a833d16d12d59484a7627568a77a236553474cb7c26d28a8f41f9c5e77d3abd52c0d
SSDEEP 24576:QnVYNXY5GspmFuXuztfBFKZrNEzWYZoWXB9:8YNoTpm0uz5BFWrKC0oQ9
TLSH
T148167CEDCA7858C3DD639A30B4F0E9477C7413C3F955C1D28898C58402ABBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b22586b2a0a8ebbe7eb07308ed2cbc8c83c7e36cc0ab77d4ea3ce1936f97af12
MD5 1cba467ed39c61f8f0681a65a7844667
SHA1 d06f32abfe2985d56f699976c986be25bf275857
SHA512 f86a3b5d468828f942f04ba8de565eacadeb0c2f251c6457fc7bc67f78681c4ecd5547389a1bee627fa742d4e7d8505f5472695068872bdbf180d9196ada5faa
TLSH
T182615075F45888F9F7E8A47096D61DBBB2347A754D8B5F5270E4FB78018AB8E4C02047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a2a4.TMP
Size 3KB
SHA256 d634558331e0a542965ee80a52522929fc26a3a1e28df766f13861adb7677afe
MD5 4eed869624f52730bb831e399a41e217
SHA1 bc7f6f7c5c368fdb26634b43656d6070a2ad73ed
SHA512 b894fe6618867055688fe96a0aa85f0ab6a56e4b79c08faeb420572e8ebf28c988391b5a106dbb118bc54bc9499dc84e7e87072a0eb4beb0db54be0566b52b76
TLSH
T150615075F85888F9F7E8A47096D61DBBB1347AB44D8B5F5270E4FB78018AB8E4C02047
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 0fc610ae47d9eae37e18d6eb519422d00b99629218890a67c742af0b5b5dae02
MD5 7165e4d1c0c79f3b4ce530cf7847e70e
SHA1 aa7f07f845b5d1aacac353140720dbc29abb35ce
SHA512 ece138669dd2019c92ec3c030a5806f69921a6c04fcff85b9be568d8cbce07f62414885943581c00ea5c331735adeb11b2137e9802e2e2a2dbadd6a12ead0ad1
TLSH
T186E0209955C6C66DE95C35D792755F4881D47982D68DFE431704CCC87B02202F2D35D6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9cd70ae75c6a9fb4b9e6ef47934c7b0992549bc0bf7d5e314d110fc4a0acec88
MD5 b977e37f365640ac897a782100b48f8f
SHA1 78eb1764c09a3098d961564e08922f745d7bd631
SHA512 c3c75afe501b237755a1cba1c56c6bfbbd8aeda96b78d8576a7b8587a56533bd80f071ae05960ef377bbf584718b7a41a4e56e67135392c6fcdd2259961381ad
TLSH
T1C9E0865804CDD67AE19C7AA3C37D5748C7E53996A68C7A03574E88C07201A45E2DB690
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 75018a1a3e2ea289e882d17a0e90a0f51556e8bc084e485fdf5e413c011f0190
MD5 8ee41ce6f3e17146185160ef9f6b2947
SHA1 6cf18b491d530b659c1861a143a8d74cd990da38
SHA512 fc523d90fd54f7131dbb3a5dfc016842a225693b6b760ce5f3bf35f1b65d5e234b51fc27c4acf284f662763c5fc63f0394b74965671bc477ddc160d035b74857
SSDEEP 96:n4FNxRIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+H:n4FNxRf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T133142F1E5F642721CDBD917629E744A35D7CF03F8B5366CA686104B4CEE2B52A02C8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 8ebb30825c59b9036b50944d052af8912c33247e039f3061d43d9a007bd40010
MD5 3c0d51f20243e737e4e6af999f3245ff
SHA1 3e983d41883950cc0ca1f0bc3fa60aa8d1b52de1
SHA512 bf2681c0346d40dad2f8e0c0eb662c2a38d193039952615f6b69a0527a4bb6664242a444efd96459b1857eb3b535228450546585c1d8103054303909f7e72cf3
TLSH
T182E020A644CDC26D914C615FD33E6F0CC7B13946D68C7F031B099D80B105004E3D71D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 020bd8ed17d7882f812d12b422e9a1c13a7e8c26a83870721fb6529529c79504
MD5 0d4e47f02eead98e83edc9e9271e0009
SHA1 e55a0ca66118ccbbc105a695fe370befd25945d8
SHA512 36c0527e6841dd3cc57f56f740fc0dfb1ee8e9b8f6bfc8c87606ebb453a7d50e8ed3354ac8b3c649a475a8cf8b15d34b475ca3418a8895d2e161ebe3a542030f
SSDEEP 48:TtLopFMatSaw/auUOt8BmoI8dmq+OSW+otwGhIcI2eLPwH:9eMatUaAKh+cZa3A
TLSH
T1C492620D0F346A11C0E44F31EAD080A73F7C206ED3A77A99DA4420F38D6A65BF50666A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 524adb0a9e485d8e8c947027b7610e90b5a68922f6b4de9c02c7d4e7bc6814d1
MD5 3e4103769a8a2aaf6cc79176b588672a
SHA1 206aa4c807a90b84f274f330f69b2758025e6103
SHA512 d9580d956054b4db23307bdfc2ec3c16c19fadb10bdcf53cd16e040dd4ec0fe559205ee36fe2e0f797eeeeb4be3372abba767e0ebfe809c9e945e3467e04b0b6
TLSH
T191219BF3C7D5866EC90116F06A24AE1BCE1D0A15422C3D1B89D4EFABD7E3476E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4eaa437d6418d40ec022e761aff47742c3ed1631d4a30aa8d4e64c2163d09ec
MD5 8879bd71133c79bf6ae2ad896756a8f7
SHA1 5f5908060e5235b4a732d77939843d3afb2cb658
SHA512 e0b1e4a3a4e1609f50313955aac8ac14cbb29aa9e0cd28f61713bdfc9dfa7aeb45b824d850ceda0a853eb952d4a0048ba99c76b9eaeee3cfea49576e501617cf
TLSH
T1E54169F3C7E8866EC90156F0AB246E1BCE2D0954422C3D5AC8E4EF6B97E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d852022b4ae22c54c3d5577e44f7f4168cfa03039277427c8df12ded95383bbb
MD5 b92ad0abd1498a85740115a150a75219
SHA1 dfadae85750a39a7b3b7b8f2c59adef027f9bf1e
SHA512 f7ccbd90cffdf23d883bf214560734246d42965b7562f8afc123a4a5ab18e12e97d474e7247a647f1cbd343b7e876ce3beb2053c4c21e9b14a2f1123a8fe6ed8
SSDEEP 192:sxZ4uRDng/ffsSBIdpJHW6+WNGY364NTIgrJ:sxZ4uxg/ffsSqJHbGXS9
TLSH
T1D912C7566E38A57B8CCBE20DBA25BF53D6F9503261D41E58EAFC861C04E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 68c3978b068f2dc5a5e18722e17bd8290a2b0c1a42b300b5dcd213cf3f2218f4
MD5 cfbdac2bb1b0d365e3fae7adcb633a93
SHA1 c3a808e42bbf23518a196a2dd48fcc6cac38081e
SHA512 0ba317c257c2f942faa5db49b2349089d0f17f112ec520713fdf09f5480039db6aef27da8fc5bf46c8dc592d6d45afba24df7f31c31e383fb0fa19c26e22d0aa
SSDEEP 192:sxZ4uRPng/ffsrWpVdBIdpJHW6+WNGY36NtrlIgFJ:sxZ4utg/ffsrWvdqJHbGXvtv
TLSH
T1E422B7167E28A57B8CC7E20DBB257F53D6F9103261D51E58AAFC862C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a045504c1e53665065e622dca379551bac6b205cbd6ced089a513ac7f15aa663
MD5 2a9dfb2d476ffbeb30b44b9dc0f611f6
SHA1 1f9f550cb81e3724519e248007f64c327daa65fd
SHA512 69c1cff765d9ac5738d0b28be6dcd85018cd0071eada493147b957c1daf54245f5a833e6d7ccc6d38eefca5c2318f0779bd7f2837ee6b70335c794465b65995d
SSDEEP 192:sxZ4uRP9g/ffsaWpVSyZ8aIdpJHW6+WNGY36Nt3TIgyJ:sxZ4u3g/ffsaWvSU8zJHbGXv7O
TLSH
T10C32C715BE28A57B8CC6E21DBB257F53D6F95032A0D51E48AAFC862C05E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1b5eb9f48433d0a615e0646a5a6b28c5c50c7adf9fcaaa5b37ce97cc4057e822
MD5 8e9641045d3e631b544812510d95a2ae
SHA1 97abf1f031afc1ffb83c18890b7574434c3405c5
SHA512 6fd62b3045007d0bc3257a0048ab802ffeaca7d8b1f9892c43bebb2cd62eba4ce28089b0e546e24d9deb7fb0245534ef7823eb31a88a1d5f9dafb24b299e5f80
SSDEEP 192:sxZ4uRP9g/ffsaWpV9yZ8aIdpJHW6+WNGY36rt3TIgkJ:sxZ4u3g/ffsaWv9U8zJHbGX57o
TLSH
T1C532C715BE28A97B8CC7E21DBB257F53D6F95032A0951E44AAFC8B2C05E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6a82fedd1eb643b94fe787c102c53e5e8071af7b3b5a94855dacc16d4fc46a6e
MD5 c82c5044adb0052b8e6b0341780f44b9
SHA1 8e1ece42d7bba6daba77bf23b990c95aa195c2a2
SHA512 41f34ee93486b19129d08ede34817fd9a0cb9818975ca16b281c66ad405e00ce6eaef909860f6997813452648e848a35110c4c4f209a991e5899059d866d80f3
SSDEEP 768:zzKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Qrojc:zzKlm7QWvUYe0u1ja8/L/E/7jc
TLSH
T139C2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 bf32732330f5f86d93a2c35bfdedce59de895068382cfb11e6a23e6f11c6ebe2
MD5 2fec86eaa80c84af161f1360e3db1442
SHA1 98d6e67b8db2ac3abb0e86772527b8b21930f1e7
SHA512 f7553f55bec6edd8b6d8cef1b3555ca553d4111819c0e5b4abea5a0fa8784fa09c401e8cd3c22c6478ac5c5a747789275334ca792273c15c69cb67940fff52ae
TLSH
T150E0261455C8E3FDE15E638353BA970883E87B47D2CC3E027F81CC447242504B2D3190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 b5f24a3874d9bab9a7562ac397ccb155dcb4eff6f5eedc1594babb7e5469fb71
MD5 1d3a4a7b9fa23080906461ebc574be27
SHA1 4043becf82017529f3d8b8e8e204389e012786c7
SHA512 0e4b4bc24ce1c5d316ecd75be2a5910a71e5161208f0aec7261eabf5a83c1640d20403c37b49c10a01113a932edf58e6b74bbc718fc7ec5d02123062f1fc5030
TLSH
T1CFE0D82437C9D7AEA18E62879379E70881A27B53D6DC7A117B089840730614073C3150
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 34a81b9b3a2539a6687932f674b8adf842e2ab17ea020f86ac9f04863f1bf663
MD5 8759fcf2a33baa605a2fd5570d45a5a7
SHA1 96b3bd8e70dfeb49d4696673159f779277e5bf18
SHA512 139963767522eebe8c8ce4aa2139789da0761bd8ac6edfd7a2070587435c9c738b6bec7341d2cfcba77a283b7682a0e58df51b00f2ef459fc13739a290e3268f
TLSH
T12DE04F7467C9D77D9149A68283789B0887B47D66D79C7A46D70C4C50B301144B3EA991
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c16973b235f591194e106aee266034389b393114aa9810f238fe2e9bb5b120c3
MD5 67c3b50301e7b36bee03f63bfe352588
SHA1 deedd7143df73bdb16a254ae0f97d5269b65afd7
SHA512 9984e09741cb84c57bd0ae93db8972cbeede5e73ba7eb5066890ea48dc6fa8ea9d0c954a6391c5b1585f38933c66525f2000030c4a2970add41903aa9b68d5e7
SSDEEP 96:KcmEKbKWu9yKmIQz+lBz1VxwhgsmZxKO4mTxiLj4ZVSGbi:SDVNz+lBz1VihglZf4mToLj4ZVSV
TLSH
T109A1A441367B020579BD695D9279972E524172F33028F63BBFBC10A59E2AE041EFF5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 58ec4feb72f43a0787460ef5d08abc44b4f13ac91647a68855ced4ffc713bfff
MD5 2b94f220c4c8f4c6739917adb5e079e3
SHA1 550757efc9d0440621461354a6f308adbfc2df5a
SHA512 24e2edbf2aef9f12ef6acf55c06398c577172d20e9bcf328f2b1e129f16cb8a7cafc44bd793666e39382371a79332714eebfe110dac8b6782deb55b41f4b1963
SSDEEP 96:KcmEKbKWu9yKmIQz+lBz1VxwhgsmZxKO4mTxiLj4ZVSGbyKkMBIgKFiig:SDVNz+lBz1VihglZf4mToLj4ZVSRBvg
TLSH
T1C3D15351367B020579BEA54D92BA972F424176B37018F63B7BBC00E59E2AE042DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 90bab7d8b1053b8cacb396456e3aa6f6db25b4902ab1759d4692173bfcbd9e63
MD5 eb1014eb38ba771e32d4d799f6e5e71a
SHA1 d8456d1555d1ed84990522dcfa8be9a967ab93af
SHA512 40fa6be0384e136acd4c0441a535e3942bffe8953ceef796bee66ed61d073635cee25ce3d1690ee7fff5ae7eece1730aa8d0d2292eaec614da65acf1dd23dfd3
SSDEEP 192:P+xWNComfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxpZfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T19E24630A7B747001EDE6D9721CB080771A3C716ECF22A6916DB254698DF2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 28493c24926521155b6b842986f048410f05b42f3323c3ecfd96683ab6beb58e
MD5 41e5ce6e45e2513889eeb9ee95b4636f
SHA1 5ad5387c51992519326f39eff32e4ff0a4c2ad6d
SHA512 2966582fa91c21cc9031221f2aff41f6ead615c1fab25931000eda58b72a5c5aa7131b1afd6e2fe46f27547cc13df501921975bfff099aed4943a6c6fcb3afc1
TLSH
T1A83143C1B7A91048BECDFA92D23E5603A0B13F77220DA972232E41F49F48C181A2FD21
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 c70ab8460acf38da44e1c02fe2246b45035967a0e4b9f31c35133254bd0290f6
MD5 31edebb5dbcf9fe30498e30039dc21da
SHA1 e26c7e7481410afc7ff845c7370f70b620d39eb1
SHA512 ed09c2ae9101830800441b77fd7263875253a892411bd47ec7865b9ae13724bf39633abe19fd78248d5597bcdf69dfcc35d9192dfa80d194bd5745d81c2f0225
SSDEEP 192:P95QkIIIbbLMIMNsYcYOUlOAWAsJl9H+rs2VqQrQzQwQ:P95QkIIIbbLMIM2BVAfsLQshQrQzQwQ
TLSH
T11072A76AA7895733C2AF9EBE136A47410BD55C420493320C70522D5F5DF2B9BD2E2AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f63130c385c3436b10c8f536a90b528004870af3f19aee8c12a1fec25b804156
MD5 f74eba1fd90925ac02130e0697d1245c
SHA1 9fc8c59d9336489d04f6b70900b1b0a0800054ca
SHA512 27ada18f041a0d03c2eaece4f53a94cf8a7f450b8976ec4c95321097d444fb0e7a1ec2754518f4f4587308b1a30271d11aafbf87710c06f94e56a08382246f9b
TLSH
T1BFE02694ACCCC2FEE15D3287513A4708C3A43E53EB8CFA075F0EC884B601508B2CB191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8e2052769f5156a229a4667a061eccaa6f2031eefbcbdb9faebb8cd727a8aea6
MD5 b2c06dee5be953392cde448211b72d91
SHA1 5bf2dbcb95eb73b2d9bff8056889726a55fa923a
SHA512 259b41e404b6741aa3f1d060715504ab9bd0adfb82980da1b377d7688d94eb5c7e8e5969a3560ba04ac2c9604a585846b3112838505d560c6e70be61205b2d70
TLSH
T1F5216896F331C008C689867A147E97290334E4068FF8EC0F09BA6034BFB6B050D4B6F6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 57b7a3e7f3adaba8f210b70b616a4840d791002fe12561fdecfdb864c07f600a
MD5 a61536b225751d34bff3b8ca6e803c7a
SHA1 52c6355306efad08b768418b535d82838b302a00
SHA512 8abeac0d9b4834e44aed5c11ca9a10b7693b458a7aa8c8d7d7fa549b1bc50df7f0638fb433ebf9d32bf3c7e62f14cf8dcfce861306dc498ced8ec8d68fa1e43e
TLSH
T1A6E0DF94A8C8C2EF91593283417A8748C3A53D92EB8CBF025F0A8C84AA01549B28B191
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.24\data.txt
Size 151KB
SHA256 1c271b4577299894f3067f9cc9c1ea1e65b773d00ace564931e0cd8f6e6e584e
MD5 9618e6ae9cc98d7b1fddc19e1be020c1
SHA1 60fb455dd66d62644837051fb1e161416196e7c2
SHA512 18c119ccceee04b8e3636a4678037504f3098e9eefb79eddb69df67bb612fe836db6b19ca243c2399b92204595ac7548eaa2236d5c89ceaabbf561b21b5faece
SSDEEP 3072:8vPAgDcCHaLHl65aynyosxb3+BLvHtAu/3r0YJqN9HDwUB/g:2X1aI5aZoKzMGAr3JqNpUmI
TLSH
T1FAE3F1108DC45BECDBE82D1890BE0B0DA7E08A4E852AD989DB67BD0FAFD7B0457135C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59983f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59983f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5fcb6e7cd49810ee2a350fbfd750e0cdba0deec8600297c0eea3edaa65fba990
MD5 8cd15a3388f2373bae97f93cfed93195
SHA1 fe6402fdc5a3aef366b8f6cdbf9c9bb49259415d
SHA512 b2d2b747b6d160155157434cda17f5c953c7ec1b9b234db1325ec63bef885c550ef13488829b57b25786acf1ccb5038beae103c57335425f5ad95b7e3e12c767
SSDEEP 384:niZcIZsNzXZbFykuh//oT2AC38AN9E27Vaai9VdvZLe7Izy74HV:QZbT/AT2As5N9E27Vaamda74HV
TLSH
T1B6A26CB1A864ACF78DF2E9C5B2067B036EB4117B86D45D58C5FDAB3F109A5B80303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87a45ba72138827b634e217fb4f89823d386507804d8b797af94a525345bd6b1
MD5 8233a79335630fa90b7b6d657115be34
SHA1 0eb3f08cacee1e7a20ff54ecb30357727305c593
SHA512 c1b50df4b0c406cf6179106a7cf478915979733c820351fcd5c59e2720cfd20d0e254f9faae1abd47e34e934d08a22e1baa5cdd6c51752b4d1e6549fa2e3915c
SSDEEP 96:KqONkFQsjpfbUmjH5ih/cIPURHl8h4otop5wqaDw/gBKP4v+Y1xf//ojd2xyY5qn:BONh6JUm0QmiUywXw/Eso//oTpBC4lU6
TLSH
T1A402E839BC74ACBB9EE3AE45B0477B239FA4106BA6911F84DAD95F2D01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 9c8709892405c78cd6769b45efdc453988f867218d3018f49a1ce3a394ead117
MD5 7ed63b0c1facb8cd8ad36bb3e0bc456c
SHA1 1309c4fb085bf7b1a7773ecaefd80d19c64398fe
SHA512 1c8e17da1be11c633fb8dec1d4eaa3791e420362ebae229917180755ded4cfbd7c4defb2d0386aac499472e2b09747141c4298c1cb0cce6f67b70db8b3b725fc
SSDEEP 768:2FSZWwgMPQsrAQU7GYSsEXj3b7MYIHqu8aPs5N9Ed7Vaamda74HV:DZ3AF7VBEXrxI1qsd7Vaamda7IV
TLSH
T12613AE76D8A0DEBBDDF6D7C1B60A7A069EF011B7858C8894C5EC6E2E109B4EC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c993c69420381eda242bdb41469ff04924059e6ff9c3c0580cce4073b1e152e5
MD5 4262e182deefba8812decfb2d9eea8f0
SHA1 18dc7423d9b0f6c27bc95e6959947d694f42e44e
SHA512 af0ae35458b8af4c44d0befb88f37c342b310f602fbb6718e5e193949721de63fccd97df3cada41120214999c94354b919f60585d4dd2b23f029dc53781e32b2
SSDEEP 384:nPZcIZsNOuZbFykuh//oT5Ve+ZA7Vaai9VdvZLe7Izy74HV:HZvT/AT/jZA7Vaamda74HV
TLSH
T13A927BB56CB4ECB75CA7E184F15A3B03AEB420B7DAD44F84D5E9AB1F04C25A81B07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 be2bedd93777fc48a69587f8dbe1332e06767875ff049285dffb65811dca5281
MD5 22764d35e82b1882860de05b5b865ef6
SHA1 22f554ca81828206db74eaeccd666055996d49c4
SHA512 b2ffd6382e34904efda93697bc74a0ae87eb90e27b1be8d490c24fe6de78009df7513bb15ddcf43c0cc781832f64fe3d967a870606da95d0221ebde71f5b70fb
SSDEEP 384:zZcIZsNIuZbF2kuh//oT5VeQzO9vFA8+Z7oBkL2A7Vaai9VdJ74HR:rZZT/AT/9zA681BkL2A7VaamdJ74HR
TLSH
T190A24BB5D8A46CF788A2E9C1B446F7036EB4217782981E4CD5F9BB3A249F4F40713C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 cb4a58145059c3ab9b4a1fa517ebcf0a666d8e58dec087566c0ce0608479b3a5
MD5 2fdcd52642149c694f69e66e2c4e1c8f
SHA1 d26209a00cf832f106bae2051a66de064216d24d
SHA512 5c141f944c1bd70f269435b72ffd42170a8d318bd31eecbaa2959008ebb5e16b169b74a5cc13d584c13e9b007edc9e81030dc906bf7478742fad67994701985c
SSDEEP 384:zZcIZsNIuZbFtkuh//oT5VeQzO9vFA8+Z7oBkL2A7Vaai9VdJ74HR:rZST/AT/9zA681BkL2A7VaamdJ74HR
TLSH
T1C8A24BB5D8A46CF788A2E9C1B446F7036EB4217782981E4CD5F9BB3A249F4F40713C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 485767fb7e60cec7f98a7cc195144325b63fbf7aaa0154c7a1a8eb5ee88bef96
MD5 6f775bf27058b4d0d133c6ef77a07681
SHA1 1e52f03b0c64faf8333e88a8d82671301d378bcb
SHA512 f43a47fbde134fd4d8f9b3ea49bee60a8f65227c695df973ca18dd55211507123c22152800e743f6e25507a666503d7e082488ddce80fc57df373c8c659bee9a
SSDEEP 192:BONR6JUNQmiUywNw/Evo//oT5Veq8Nx1/jU6:BONR6+Lbvo//oT5VeV5U6
TLSH
T134121835B878FC7B5D93A580F04336138EA44077EB85AF90DACD6B2C06DA1AC5307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 825af5b088f96e2a0f95adf3480e7c4c0a7f18c785d3d09c8700f05a28ff2bbb
MD5 fbe0456f55d3c499bf81691e5d5c6ca9
SHA1 64073d074f4f1b8b4611874cd589f4194d174274
SHA512 a45f1e348ddac3e6a9e863578cb600aadad06bdc878a4e1817f7b8e6952eb3d4754f31d9865909725ea36a595582ffba574ba0ac03483511c32ce07ae790fa0e
SSDEEP 192:udIsNIuQnUbAMQmiU1wuw//kB4h//oT5Veqnao1/jA7nEkMvOLHiewqPsdu:psNIuZbBckuh//oT5Ve25A7Vaai9Vdu
TLSH
T1ED624A36B874AC775EA3A184F0073B038E7050BB97945F94DADE6B1E06DA1E85307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 66fee6216106e727b0ec671417ffa3f03696a1cdef01f7bd0f7985be5ef4535d
MD5 6ebd05ae549f089e6b5417bc0e385c8d
SHA1 f6f9e529059cdc202cf4f38e6568f234362e0b02
SHA512 135df049d910f85931c2db88f258d2de7192dc09209ddca2f3a46ddcef91b8f1e7b03516eb3dc9e298c3ee0cd52882e09c190ad00fda9299163f6a5622e2c7b8
SSDEEP 384:nFZcIZsNOXZbFykuh//oT5Ve+ZA7Vaai9VdvZLe7Izy74HV:9ZIT/AT/jZA7Vaamda74HV
TLSH
T1BD927BB56CB4ECB75CA7E184F15A3B03AEB420B7DAD84F84D5E99B1F04C25A81B07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety_tips.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
Size 163KB
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
TLSH
T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
Size 3KB
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
TLSH
T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cdfcd4cced2adcc89c9ae14a2632df17c2b4b0491ba6b94365570da961f2286d
MD5 5b8991e88f6af110d45c697e3a120b08
SHA1 094aef6f73be8cfa63ef5986df6968dab4afb33b
SHA512 754699722c44614e30a72643ba96a5114ce63f5d00afa2517a3f781ea46ec6f1cc100ee4bc53253e77ee249d5853230f34f707dea30d21b74087010dc6fe1de6
TLSH
T1383103E05C3D1ED2C5BD0DBFB09B36EC94E89312B8A434396858ED689A3E51E310083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ed6f13af4d23eb0fae3eeb6f116875b98baea8b85c64671cdcb9622373de239
MD5 ef02f4b8cd75b185f45eca8ccea2e6fc
SHA1 15c05c3e162dd5e4da0616bb9c33ace719a7b1a6
SHA512 794c5119bb048ed811133aa6b357649cf402d2e897d76c3a2224020d86989827d8c9c9115ca19e84f4607ff121078128ad4e6611b2b3c65515894873a07322ca
TLSH
T1643120E05C3D19C2C1BD0DBFB0972AEC44E89212F8A87439289CE858963E51E205083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ab44ef7e9a0b72ec6666f08e7488453ed286bee23b20aee2a8512a64c720ea19
MD5 4e0d787426e5d8f6a056f95b5ca03af4
SHA1 612f8bd187914288bec3b39d637443edfb14cd4e
SHA512 195348ae168466da26bd99be52bf75dd024c74a00d4f6701245fe1f95f4e9d4a78f9e0d7c476e3a4af4b21560724e5128b28604aa9daf64e1395e0fd7c0b9c2a
TLSH
T1454102E05C3D1ED5C5BD0DBFB48B26EC94E89712B8E434792858ED689A3E51D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4c60484946038748330653d91e6498286b244facac2f25640c67682c01be7b80
MD5 b22b8b233487942298c2542e7d1ab579
SHA1 b4d8f64f6e72c6e251202e0de3021f588dfee5f3
SHA512 7de77f611c1ca226b8780e5f34979469f9aae114529b2f5683cbf6c21035524f00f2daa02dca866697c9fc6ccfde1684ec883c999c5dd14d06ef918b91a72821
TLSH
T15D3104E05C3D1ED1C1BD0DBFB09726EC54EC9612B8A83438689DE968993E51E355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 96e9becb84067c67a6e2ba424a6c0d985d1ca1bc899b02b81236f454f286ca8e
MD5 133eca54e24e0711651de6045568e3a5
SHA1 8325f2bc6dbb92ce76a490f51006b1911d5c26cb
SHA512 6acf758b9ffb669ff4c8580b08565617d9d53acfa259282d157e4989af0a20c62632ef93e212c590ce9364a3484f205187c811ad6d5b9282b977b24b9b8d77f3
TLSH
T1354123E0483D1ED1C4BD0DBEB48B35EC94EC9722B8A4343D289CEDA89A7E51D210083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4ec183e8e2c7d8401830c76f9b6b1bbf74760a37e81203f273b25742aa04a50
MD5 cd7968feba1cd21c19231f4768eb5a28
SHA1 543c5b69d023340065d48d0a766ad613477a20bb
SHA512 b0105ebd3120d6532149e04c929066d182f52782e0651d27909b1579defc7f01fa56873f0f000d1db0f0a792a13d3b0e00336b039720918034e88e5ea88d311e
TLSH
T186310FE15C3D19C2C1BD0DAFB0972AEC54E89612F8983438289CE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 67f16574c61501c1b39f81d138c90882e2293a41cb33f6c8cc61bace8f87aedf
MD5 aea20833d0b98210e74cdddef359aa3d
SHA1 bb803bce6ed8362c272e65e2ced82477c58bc913
SHA512 899dffedfc9c78dcda4de34d500c26f7631a6ce13f715688ecb6717f1d3b47cd98896ee741447b166cee4a5cf7a76989c3b16604c3285f1935c1e9824190c439
TLSH
T152413D58FBE91148B3B76F49ABF7A86E447F79731E0AD45E10110E4F0A62A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

0f580bac-fc65-4166-bbeb-c25bfd417863.tmp

Path C:\Users\Admin\AppData\Local\Temp\0f580bac-fc65-4166-bbeb-c25bfd417863.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_roqwsab2.bgz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_roqwsab2.bgz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c78c044a-14a1-4901-a4da-b8a8b7ebe0fa.tmp

Path C:\Users\Admin\AppData\Local\Temp\c78c044a-14a1-4901-a4da-b8a8b7ebe0fa.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6024_1255519060\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bab058a-faf0-412a-8199-d1346b6a6f9b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6024_401779958\3bab058a-faf0-412a-8199-d1346b6a6f9b.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ec4c23e351258d6a7758e9be891133614ad3449e932b6ddb929a8e6b88f4922
MD5 7652dd684ed177a22035ba480209efc4
SHA1 71ef7365647dfb23ef705d8732c84f87e07264d0
SHA512 0bbb51f69d452c69708846998b04538550a251dc85302c6ff7b120036b85c0572b0a358bb8c98849570ddbf763bded2afd3bdcb8d991284805dc899d06de3044
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 108edc79f4db8430a82874a2355490797c5e0e866734c4949cbdd3ef6dd20afc
MD5 c3280eb33d4c0a2869d79dda8f0ff8a5
SHA1 ae552dc63844e6f8afb270006e81dc70c779bc8b
SHA512 f82c01e0d558e48aa4cddba5ef280dcdaa5be725acb972fc37dd05b7a75395377890b55cfb76009643a981bc3bf254328d48dc27c54c6fbdaadb370b86bcd122
TLSH
T171D0222333C30238C0203033A0E3B20C2C00C22F822E80C0AC3EEA2E2F0A0A00E23883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 5ec9779ee613834feebbb56010855136b4da883a96ecd44d268f0a341045ddf1
MD5 3f36bb723e3615630ae39cb8fa19278b
SHA1 81fff92901ce80458ca060e232b30c342cdfae41
SHA512 cc9214fd6e1796bdea7289ec772b98a50827088cb5a1f5b561c8bafe294df4dfd385ed0df3af1fa116ee69a28936fcff1dea402c2a03dd7bbd6e4282a6c8860c
TLSH
T172F09AD883D8D0F9FF0AF1360DE21CF130672C2F19521703708A8A60EC876E59AA8F10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597d25.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe597d25.TMP
Size 48B
SHA256 715cbd0839e0288a7918a5639bf1e9164da8d9a25ec6bac340a8449048e4c05f
MD5 ee60dfdee6b4710a757674152da17a96
SHA1 5886b46eac2b053f9b76fd8c033264d3358ce0ba
SHA512 37646605ff815be305c9d374d69a771a527a5e1df7dc1a17e206587713cbf9a0e4778cb433e20953d3cd6e6a83fb6d2cdb239455d9dd1badfec449cbf3cae633
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 766B
SHA256 e8d841b8f93166b0ce60213ff9d8d29b047189989f25abba4e138372e14f35eb
MD5 bb3fcaaa3491f4715ee340b91ff3172d
SHA1 142fd70f649ae75c05da49ae5502a5db12cc8d21
SHA512 842118bf4ae3e15192ba2b00b8c01e6f4c34eaa61912cf04a139e3153fcc40a7056b709f8037c569bf5e56b3c533e455f28e5c9df5b37c1982fd0bcfef820743
TLSH
T16A01B1B343B0C5BE4700A6A477343D0BCD3D0016631C6E778DE9AB6657A20B1D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 766B
SHA256 a38b24233ce90ec5e80020b7f149be3b2b6a413f8c34968ca6b5af660ec22d12
MD5 a96130c3d4f0621c0e0463b368796f63
SHA1 30ecab0111f332f766bf57d1122e7d7b7bd4fc70
SHA512 2f70b9a808388f1e89441987f18cb14e30572c23d98d594ffe69e44e0a27e88d30a891e986d12833f03a7e90216de799853bf182cffe2b8fd064e7b04d9dcfe1
TLSH
T15901B1B343B0C5BE4700A6A477343D0BCD3D0016631C6E778DE9AB6657A20B1D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 766B
SHA256 a42690478b3cc9b4db75c8ad756ccb67467828f16d7184c2a6919524d2851f3e
MD5 66b56a9d92ebdc2e089003420ee28deb
SHA1 d7a93ed759849d74afd8650c312696fa206be68d
SHA512 61bdfa239da8a0e2224586b5ce57f155843de299ddc1edb310827189489cba7020615a5dcf9ba46e18365ecd1550582e10300caccac427387850825c545886ba
TLSH
T12D0161B383B0C5BE4710A6A477343D17CD7D0416531C6E779DE9AB6657A20B1D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59b5d9.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe59b5d9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 32bf88545c692c27d4dc32b6fa02666d6ff2a27005f919ea509dbbcd2be5f65a
MD5 413968466bde7d6f4c03cfe4a53772eb
SHA1 e3b73b6663a61c45f2a2f9ad35403fd735700f95
SHA512 7c101248aac7e2298227c95a9300e30370605ea8c6aefd53f62921c0b28ba8b043e5a4666a4b9be8a07d47203c5d61db539d99d1d6c47ed1ae4bbdb9ea1e228e
TLSH
T1D3F09EE6C67FF17B106C1DE60C487C165F36B8310061ACF4D992517CB1826FB4A17071
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 ace4b5c391bf32e90dae9d49edecacd51edc4a3ba5cd91f5d1a3852a63b6e38b
MD5 17eef27c8914c7e33500d74a66072bd1
SHA1 f28b9709ce0016e51f14a6bdb9bde3f88a6b6060
SHA512 cd7dd416d7ab49200e596140a1467835224cb4cbae10bb3ce066675bb12fe02b3458e0182b42df7cd734e555e123bb152b2e6b837ced7352816754b34e57d1cf
TLSH
T14CF0C9E2C63FA0BB20691D6609483C164B36B93002117CE0D992413C70811F36A17821
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 0cbc719dd9b7e42a979f31d7361e1af3840ba499567a141aa4f20dffe739c910
MD5 6cd76f3da7adbd6b1098e4a21288c829
SHA1 588d4ba5b50d28423bac326319ce636dea3883e5
SHA512 4efee5b83d19b1444cfbd7ee73a8a644f87c3686e81b25d89c4890d62de82c2ae859de10188f00693020e91412cae2ac78f1016caec45ea3d689728c251321a7
TLSH
T14FF059A3817FB5BB20681D6A1C187C665F3AB87015516CE4DAE2413D61425F39A17071
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 25016401f57608a7fc81d39b086b68381b5270e27ab74358a30784aa1c17ed2e
MD5 acfc40c2f6ebf1db76405559f280ce14
SHA1 191d8185f744becc7a7bef28e591162bed1e1e61
SHA512 8e872b4c4b98f9720fea4b8432ee4956e448750ae8acc8b2cf473388ba30288ee3d5b0dc67db43066c7bb73f2a8b51caa1aea5e11acf7dc1b2abfcbfdd305997
TLSH
T1C3F09EE286BFF97F30681D661D487C125F36B930206178F8D99241BDB2425F79A1B032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59483a.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity~RFe59483a.TMP
Size 524B
SHA256 fb3790c94f3168262747576b45f42e2ecfb5b511ca59326d042b35b0b49e3a5b
MD5 2a1aff4d2a66e7c0e2c3ed561942c0b4
SHA1 bf1b9487831a9941ac9cf6508ac96b952f5fbe91
SHA512 45c89e429612addf1dd2bde69d3c526506fd440e1d80a282986896669b93ee819cd97bd6ac1e60e53f5b095f6a8f35c16bac20590c94134c93da37352fd13cd2
TLSH
T190F09EA2C67FF57B20691EF60C487C265F36B8310061A8F4C992417CF1426F74A17071
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 2c497401c8979b8e0241e7bdd381537fa5125a294885aa3cc449ce557954e391
MD5 cf6cbc9a0ad81a5ac4b7e81f6f5c3bbd
SHA1 572c4c6fed39fc457eea76926441a9deeeff67a2
SHA512 d212792e171b4537b23a12edbe7cb4adc205b419ce48cdeee87bfc314b37dd225add4dee3ccef9c4d15133afe96ee870d3b670ce4af0b4c2407feddedff24d05
SSDEEP 96:st105bQOdb98ff5Z8i0vhEYktqm/7qx+WVHMSm+uecJDY1idQjR+gmTMEB:st10xMfBZ8pajn/S+WiTDYwdooTM8
TLSH
T10AD1A906AE68B9774CC7F619BA35FF52D2F5206161D40D98EBFD872C08D66CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 49a9d3605e3f9a373578a802bdc34e663b72dc2c3fbd57fbbb350df30f520764
MD5 fdd2a7e4144197bb61df9d9b665d4d92
SHA1 955155699b6666de50e0f6e8a75daf2253e59e04
SHA512 2042f27bd711512d4e0054486677bd8bce2f868987de5cc511bb97a35cb631e31b71e83c4ab4cdc2b92c61e634a53104d88ee8aec8e296bf48e708b30b20b4fc
SSDEEP 96:st105bQOdb9vff5Z8i0vhEYktqm/7qx+WVHMSm+uecJipjMdQjR+gMTMOB:st10x/fBZ8pajn/S+WiTipodoyTMC
TLSH
T1E1E1CA066E28B9774CC7F6197A35BF52E2F5606251D40E98EBFD872C08E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe590c5a.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe590c5a.TMP
Size 6KB
SHA256 8b2115c3a3f543ba5e1912877b8e9889d02567b646f908086a181a7fb760406d
MD5 535b0529758036af0b24c908f54eb8e2
SHA1 56ec86d030d4b1652ba7517165bb92040e92ed71
SHA512 f104de5c34273e16bde1ec9cddfd8bceee91bcb8942ede62ab8507996183c716a9485d3daf4324d6101358596b9c7249e53dc5739978149a100bfc6267371a3f
SSDEEP 96:st105bQOdb98ffldZ8i0oEYktqm/7qx+WVHMSm+uecJDY1idQjR+gmTMEB:st10xMfnZ8pFjn/S+WiTDYwdooTM8
TLSH
T130D1B906AE68B9774CC7F219B935BF52D2F6206161D50D98E7FD872C0CD66CC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 a1e7e6fdd946c8026d560db41d192a595ab8d2814df4de32312e2b8b88e38e04
MD5 ff7884b21104bf686abef63321898921
SHA1 69711c424d731d359d49ec8d64cdaa28b8ca8cea
SHA512 9cd3cbca7d0209504cfc23521d71bf0f3c40e53bc9c847b11d9222569057dce1dc4ea72df9f65913d9087d4186d4b3ba54bcf27f928b9d2fd1f37f7b442a4059
SSDEEP 384:zC+aQikB+z/xvxjg/qhEaNbbA5WNhDMXG:5/UxvxjgC+PwhD4G
TLSH
T14C729D2A696D3E3249F3F505BA481B8BDAB494B290C56DE849ED5F0E0ACB3CC1303D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 1KB
SHA256 a3a0d95021cc70c10cfabaa5040ede6353b51e365584fbca4c526a699eedf907
MD5 004828026041ca547ff9ac2f60fcba60
SHA1 bd767e1754e1d9a463eebda3a8e5b9e2b68672e2
SHA512 4af56217da854c1df26845f78d0b1586f5ef7cd09b9cf11c2f2efb379af9adeef6578b9af30a759763a1b324deb028801739614e2ccce80e8fbfdfe352874a90
TLSH
T1C03162B2F9583FB14C92A485F205BE9B6E2120A9D1614EC891DF4B2E06DA28D9537C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 4873300837de59e6e9df486d8a959b98b14ff02dfacef09d6f65ae88125cc64f
MD5 2a0a0ea6d255a13a1eafeafd5dedc98c
SHA1 8b0eb044857ade534059c49d173a01cc7f2dd269
SHA512 d06425618c064ba405ed9cbd75e6092c655a9d3f88944fee7dec2bd3d8b8e73247e85078fc17b37af03c10877703d83300e3d02ca4f8753976d68b164e793039
TLSH
T14051D773BD087AB64DE39944B9093F13D93560E1E5721FD099DE0B1D00DA28D2313C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 eb9c74cfb90e269f22f23d997900a2274fa60fb8d484caab80a356abaab158f7
MD5 1108db26610a23adcc5d687af08bb410
SHA1 52f39df225281822bc63838f9e497d9fd6c666cd
SHA512 199e3066c97d60e8d01f6bb6ce0cb0ea54136c6c6cd7f8a64765abe2869f37b10a14c6a4b059cb20157a2b7b975527a1868e0f949926900c770829ccf7274a00
TLSH
T1F671B66AB968A9774DE3A900F9852F17B6656172E4A53FE4C9EE0F1D01DB38C2312C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 053052e005182790824847dbab937f307418144cd7b1add78bc3b9381ecc35f2
MD5 f9c02717311578feaf9818569c1237ac
SHA1 0ee58b92f205847259f336da674d4ddc84402544
SHA512 bca08974af17b89b062f08b03d3692fa0f34c9eba2c4ef554f44204c1f790b661639a4eeb4e1eedd29ffa272f4142a029310f0581b194115c0f66d8a992d72f1
SSDEEP 96:zudtNkCECfbYkEwl8Frh/cInURoDoto+56vDfB5Z36U3ZUwOTulxa:z4tNbjYkEzooDUh0p5ZZG5
TLSH
T16F91B426B974AA774DF2E944B9453F03AA6460A2E4A52FD8C9ED0F1D01DB3CC1303C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 33220f51f9cb3bc118babc19cf45ca5fe94b94150c4f69a0499ee3db1fd0451e
MD5 3a9bf1cd06662daf8d65d918dbaab510
SHA1 a2c22991a48394ecf766d124db34ced04426ec04
SHA512 cec9319de2fa71d620ce6b823a2548d302cea6dec944b8f996af1024180bd70d349deea82f15cf5abfe8a6e2ef33a61e7a2795106cb5027ea0654aaf28c75bae
SSDEEP 384:zg+aQikB+z/xvxjg/qhEeNbkx5WNhDMXG:b/UxvxjgC+ZwhD4G
TLSH
T16F728D2A65783E3649F3F5057A481B8BDAB494B290C5ADE84DED5F1E0ACB3D81303D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589b22.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe589b22.TMP
Size 1KB
SHA256 28a9cd5d650fc1d75629ff59a2bd6283911c8f764d50631244c4e0933809d8a5
MD5 8f62fff457d67a4f6b21a3fe6f2cf08c
SHA1 8a15e936b916630a9dc399c9919f7a58e8d81c01
SHA512 a34284d5d9cf9da081a5eb6b47d6e453be5e7cfc9a390123930fde4332b9cbeacb2db58ac0e2c0e86d45500d13f3fe31d3158bff73c0baed9dac0ad119d93bc0
TLSH
T1F22165B7F4583EB55C919445F205BE4B2D2060F9E1354E9891CE072E06DB19D9537C33
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Trust Protection Lists\1.0.0.38\manifest.fingerprint
Size 66B
SHA256 403e6e5965571238c03bb289a9e533261775fe381e5a91300788cd37e465b4a2
MD5 bd493e5a161e6d66c7253da476ecb4b6
SHA1 4ce1686e9532aa7190f90457cc648bd55e1a8bf5
SHA512 ae673a5aaf2d5c73eb3a0331cd9dc6b7d8d481aff6afb3015c745079debe10a73c089026c2c614bd847d3d364bcac6e6910f896e785225d88ef81a98ac24c15b
TLSH
T186A022E2E8F3B8802CA0200C08CB32C0A022B3E300800EF8C0000E8C02A2C2CF020AA2
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 1044d6a4f4824bd70960b9244e35b8574168d2351df606ac64abf8758286305b
MD5 59d16c87e953b21f802dabc1dcbe678b
SHA1 cde251ade3e21dc31b34f8f765cbd9bf6bf39071
SHA512 d09abf49d4250dc089be14676e61a1013564a54f86ae3992ff4123981301fade806804a2908f4d85461d78a294e4222cd36d69cb47b605b548c1e0d4b1b82a1c
TLSH
T184517CF0BA88E48307E3821613B8D692A5F2A77B95C014F76B025BBA37B105618310EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 71daa6b37a4d89cb409e334ecd22a75a1cbd54d64497d6d49a6d34af64f8197a
MD5 1113ea62256613d07e69b97b6faa7caa
SHA1 ef7ddce15506e105faec50f2b7d2c69712e41a85
SHA512 8b59bd2aaa77fc7ab95a1189282b882f087f2f2f031253ef7e403fed374c31c55536608bb9f31e6fa9e64c569e9bce45d85497a340ff557e8b403bd129364548
TLSH
T169513BBB59D11EF054736584BA27F88EB8B2E057F5229690BA4234A2B5EFE0403065DD
MD5 SHA1 SHA512 TLSH

Submit Download

Nexomia.exe.crdownload

Path C:\Users\Admin\Downloads\Nexomia.exe.crdownload
Size 18.1MB
SHA256 f89002c16eeca46e8c05692db3e588f316c4fd0bad605b82a0cc7bc95cf7d21e
MD5 c776c47c9d36aeec94ccf539df80118d
SHA1 427b2f7182c41ca3fb3ade41c647cb6661672798
SHA512 6834d88e7e574ebcf35d26e6af2363c596054a99ba80715415172ea31323ce18953f02e2a948d2637d22eaee54a3f8381dea1174d290d59fd6c2bc6b2e310915
SSDEEP 196608:qN9w0wJu7GZNB9Vmta/qt0gVJM2JmkhowquSzwkp7TYEBVRWGO:qtwsuNYtiqt0YM2PhoH3p7LBVRPO
TLSH
T1D1179D42F66280F8C16AC175835A6233FA71B84907347AEB5BE48B253F6AFD0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2168-1075-0x000001CAFE2D0000-0x000001CAFE2F2000-memory.dmp

Download

memory/2168-1100-0x000001CAFEA50000-0x000001CAFEA5A000-memory.dmp

Download

memory/2168-1099-0x000001CAFEA40000-0x000001CAFEA46000-memory.dmp

Download

memory/2168-1098-0x000001CAFEA10000-0x000001CAFEA18000-memory.dmp

Download

memory/2168-1097-0x000001CAFEA60000-0x000001CAFEA7A000-memory.dmp

Download

memory/2168-1096-0x000001CAFEA00000-0x000001CAFEA0A000-memory.dmp

Download

memory/2168-1093-0x000001CAFEA20000-0x000001CAFEA3C000-memory.dmp

Download

memory/2168-1092-0x000001CAFE7D0000-0x000001CAFE7DA000-memory.dmp

Download

memory/2168-1091-0x000001CAFE800000-0x000001CAFE8B5000-memory.dmp

Download

memory/2168-1090-0x000001CAFE7E0000-0x000001CAFE7FC000-memory.dmp

Download

memory/4440-380-0x0000021501710000-0x0000021501711000-memory.dmp

Download

memory/4440-362-0x000002157F910000-0x000002157F911000-memory.dmp

Download

memory/4440-358-0x000002157F8D0000-0x000002157F8D1000-memory.dmp

Download

memory/4440-360-0x000002157F8F0000-0x000002157F8F1000-memory.dmp

Download

memory/4440-361-0x000002157F900000-0x000002157F901000-memory.dmp

Download

memory/4440-359-0x000002157F8E0000-0x000002157F8E1000-memory.dmp

Download

memory/4440-363-0x000002157FB20000-0x000002157FB21000-memory.dmp

Download

memory/4440-364-0x000002157FB30000-0x000002157FB31000-memory.dmp

Download

memory/4660-1660-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1668-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1658-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1669-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1667-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1665-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1659-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1670-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1664-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/4660-1666-0x000001C6DD140000-0x000001C6DD141000-memory.dmp

Download

memory/5396-215-0x00007FFB08420000-0x00007FFB08421000-memory.dmp

Download

memory/5548-287-0x00007FFB08760000-0x00007FFB08761000-memory.dmp

Download

memory/5548-286-0x00007FFB08A80000-0x00007FFB08A81000-memory.dmp

Download

memory/5948-307-0x00007FFB08420000-0x00007FFB08421000-memory.dmp

Download