Analysis
-
max time kernel
1050s -
max time network
1049s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 15:47
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SolaraBootstrapper.exe
Resource
win10v2004-20240426-en
General
-
Target
SolaraBootstrapper.exe
-
Size
12KB
-
MD5
06f13f50c4580846567a644eb03a11f2
-
SHA1
39ee712b6dfc5a29a9c641d92c7467a2c4445984
-
SHA256
0636e8f9816b17d7cff26ef5d280ce1c1aae992cda8165c6f4574029258a08a9
-
SHA512
f5166a295bb0960e59c176eefa89c341563fdf0eec23a45576e0ee5bf7e8271cc35eb9dd56b11d9c0bbe789f2eac112643108c46be3341fa332cfcf39b4a90b9
-
SSDEEP
192:cDnQvi7auc35nuKdhAWVIanaLvmr/XKTxnTc1BREVXLGDlNjA:cDn97auc35tAKIanayzKto1jEVQzj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
XcHvYYrNa.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XcHvYYrNa.exe -
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XcHvYYrNa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XcHvYYrNa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XcHvYYrNa.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SolaraBootstrapper.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation SolaraBootstrapper.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe -
Executes dropped EXE 40 IoCs
Processes:
XcHvYYrNa.exeRobloxPlayerInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_125.0.2535.51.exesetup.exesetup.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerInstaller.exeRobloxPlayerBeta.exeRobloxPlayerInstaller.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.187.37.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 3672 XcHvYYrNa.exe 3984 RobloxPlayerInstaller.exe 4792 MicrosoftEdgeWebview2Setup.exe 4324 MicrosoftEdgeUpdate.exe 4008 MicrosoftEdgeUpdate.exe 4104 MicrosoftEdgeUpdate.exe 1372 MicrosoftEdgeUpdateComRegisterShell64.exe 2860 MicrosoftEdgeUpdateComRegisterShell64.exe 2292 MicrosoftEdgeUpdateComRegisterShell64.exe 116 MicrosoftEdgeUpdate.exe 5048 MicrosoftEdgeUpdate.exe 1624 MicrosoftEdgeUpdate.exe 2120 MicrosoftEdgeUpdate.exe 2328 MicrosoftEdge_X64_125.0.2535.51.exe 4496 setup.exe 4340 setup.exe 4744 RobloxPlayerInstaller.exe 3000 MicrosoftEdgeUpdate.exe 1676 RobloxPlayerBeta.exe 4356 RobloxPlayerInstaller.exe 3216 RobloxPlayerBeta.exe 1760 RobloxPlayerInstaller.exe 4316 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 2464 RobloxPlayerBeta.exe 3172 MicrosoftEdgeUpdate.exe 4108 MicrosoftEdgeUpdate.exe 856 MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe 4344 MicrosoftEdgeUpdate.exe 2880 MicrosoftEdgeUpdate.exe 2416 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 3912 MicrosoftEdgeUpdateComRegisterShell64.exe 1016 MicrosoftEdgeUpdateComRegisterShell64.exe 2244 MicrosoftEdgeUpdateComRegisterShell64.exe 2220 MicrosoftEdgeUpdate.exe 64 RobloxPlayerBeta.exe 1288 MicrosoftEdgeUpdate.exe 1320 MicrosoftEdgeUpdate.exe 2428 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 48 IoCs
Processes:
XcHvYYrNa.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exetaskmgr.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 4324 MicrosoftEdgeUpdate.exe 4008 MicrosoftEdgeUpdate.exe 4104 MicrosoftEdgeUpdate.exe 1372 MicrosoftEdgeUpdateComRegisterShell64.exe 4104 MicrosoftEdgeUpdate.exe 2860 MicrosoftEdgeUpdateComRegisterShell64.exe 4104 MicrosoftEdgeUpdate.exe 2292 MicrosoftEdgeUpdateComRegisterShell64.exe 4104 MicrosoftEdgeUpdate.exe 116 MicrosoftEdgeUpdate.exe 5048 MicrosoftEdgeUpdate.exe 1624 MicrosoftEdgeUpdate.exe 1624 MicrosoftEdgeUpdate.exe 5048 MicrosoftEdgeUpdate.exe 2120 MicrosoftEdgeUpdate.exe 3000 MicrosoftEdgeUpdate.exe 1676 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 3900 taskmgr.exe 2464 RobloxPlayerBeta.exe 3172 MicrosoftEdgeUpdate.exe 4108 MicrosoftEdgeUpdate.exe 4108 MicrosoftEdgeUpdate.exe 3172 MicrosoftEdgeUpdate.exe 4344 MicrosoftEdgeUpdate.exe 2880 MicrosoftEdgeUpdate.exe 2416 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 3912 MicrosoftEdgeUpdateComRegisterShell64.exe 428 MicrosoftEdgeUpdate.exe 1016 MicrosoftEdgeUpdateComRegisterShell64.exe 428 MicrosoftEdgeUpdate.exe 2244 MicrosoftEdgeUpdateComRegisterShell64.exe 428 MicrosoftEdgeUpdate.exe 2220 MicrosoftEdgeUpdate.exe 64 RobloxPlayerBeta.exe 1288 MicrosoftEdgeUpdate.exe 1320 MicrosoftEdgeUpdate.exe 1320 MicrosoftEdgeUpdate.exe 1288 MicrosoftEdgeUpdate.exe 2428 MicrosoftEdgeUpdate.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.dll themida behavioral2/memory/3672-1908-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-1911-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-1910-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-1909-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-1956-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-2783-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-2964-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-3086-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-3248-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-3263-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-3340-0x0000000180000000-0x0000000180ACA000-memory.dmp themida behavioral2/memory/3672-4342-0x0000000180000000-0x0000000180ACA000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
XcHvYYrNa.exeRobloxPlayerInstaller.exeRobloxPlayerInstaller.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XcHvYYrNa.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 43 raw.githubusercontent.com 355 raw.githubusercontent.com 8 raw.githubusercontent.com 12 raw.githubusercontent.com -
Checks system information in the registry 2 TTPs 24 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 11 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 6 IoCs
Processes:
RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 1676 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 2464 RobloxPlayerBeta.exe 64 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
XcHvYYrNa.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 3672 XcHvYYrNa.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerInstaller.exeRobloxPlayerInstaller.exesetup.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdateSetup_X86_1.3.187.37.exedescription ioc process File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioSharedUI\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Controls\PlayStationController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\MenuBar\icon_maximize.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\sky\cloudDetail3D-bc4.dds RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\Locales\fil.pak setup.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\advClosed-hand-anchored.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\Cursors\DragDetector\HoverCursor.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\AnimationEditor\img_eventMarker_inner.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\TagEditor\VisibilityOffLightTheme.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\VoiceChat\MicLight\Error.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\fonts\FredokaOne-Regular.ttf RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_4.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Emotes\ErrorIcon.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Settings\Players\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\PublishPlaceAs\common_checkmarkCircle.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\TopBar\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.51\Trust Protection Lists\Mu\TransparentAdvertisers setup.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\LegacyRbxGui\health_greenBar.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\identity_proxy\win10\identity_helper.Sparse.Canary.msix setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\TerrainTools\mtrl_concrete_2022.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Emotes\Small\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaApp\icons\ic-more-events.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\VoiceChat\SpeakerDark\Unmuted100.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1F94.tmp\msedgeupdateres_es-419.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedge.exe.sig setup.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\MaterialManager\Delete.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Controls\PlayStationController\PS4\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Input\DashedLine.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\LayeredClothingEditor\Add Icon.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Controls\DefaultController\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\smallWhiteCircle.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\MaterialManager\List_LT.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioSharedUI\Help.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\AnimationEditor\button_radio_background.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Controls\XboxController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\PlayerList\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.51\msedge_pwa_launcher.exe setup.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\LayeredClothingEditor\WorkspaceIcons\Option Dots.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioToolbox\announcementConstruction.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\VoiceChat\SpeakerLight\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\Debugger\debugger_arrow.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\TerrainTools\mtrl_leafygrass.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioSharedUI\clear-hover.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\GameSettings\Arrow.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Settings\Help\GenericController.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaApp\graphic\noNetworkConnection.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaApp\dropdown\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaChat\icons\ic-back.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU654B.tmp\msedgeupdateres_km.dll MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\fonts\SourceSansPro-Regular.ttf RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\particles\explosion_alpha.dds RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioToolbox\AudioSoundEffect.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Chat\ChatDown.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\AssetImport\btn_dark_resetcam_28x28.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\TagEditor\VisibilityOnDarkTheme.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\ui\Controls\xboxY.png RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerInstaller.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\content\textures\loading\loadingTexture.png RobloxPlayerInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
Processes:
RobloxPlayerInstaller.exeRobloxPlayerInstaller.exeRobloxPlayerInstaller.exechrome.exeRobloxPlayerInstaller.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe -
Processes:
RobloxPlayerInstaller.exeRobloxPlayerInstaller.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609528817802436" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeXcHvYYrNa.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeRobloxPlayerInstaller.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" XcHvYYrNa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine.dll" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exechrome.exetaskmgr.exeRobloxPlayerBeta.exetaskmgr.exepid process 4508 chrome.exe 4508 chrome.exe 3984 RobloxPlayerInstaller.exe 3984 RobloxPlayerInstaller.exe 4324 MicrosoftEdgeUpdate.exe 4324 MicrosoftEdgeUpdate.exe 3556 chrome.exe 3556 chrome.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4324 MicrosoftEdgeUpdate.exe 4324 MicrosoftEdgeUpdate.exe 4324 MicrosoftEdgeUpdate.exe 4324 MicrosoftEdgeUpdate.exe 4628 taskmgr.exe 1676 RobloxPlayerBeta.exe 1676 RobloxPlayerBeta.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe 3900 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
taskmgr.exeXcHvYYrNa.exepid process 3900 taskmgr.exe 3672 XcHvYYrNa.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
Processes:
chrome.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SolaraBootstrapper.exechrome.exedescription pid process Token: SeDebugPrivilege 1736 SolaraBootstrapper.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeXcHvYYrNa.exetaskmgr.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 3672 XcHvYYrNa.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
XcHvYYrNa.exemspaint.exeOpenWith.exepid process 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 3672 XcHvYYrNa.exe 2120 mspaint.exe 860 OpenWith.exe -
Suspicious use of UnmapMainImage 6 IoCs
Processes:
RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exepid process 1676 RobloxPlayerBeta.exe 3216 RobloxPlayerBeta.exe 4316 RobloxPlayerBeta.exe 4664 RobloxPlayerBeta.exe 2464 RobloxPlayerBeta.exe 64 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SolaraBootstrapper.exechrome.exedescription pid process target process PID 1736 wrote to memory of 3672 1736 SolaraBootstrapper.exe XcHvYYrNa.exe PID 1736 wrote to memory of 3672 1736 SolaraBootstrapper.exe XcHvYYrNa.exe PID 4508 wrote to memory of 928 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 928 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 4860 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3416 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3416 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3056 4508 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe259ab58,0x7fffe259ab68,0x7fffe259ab782⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:22⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3344 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4304 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5004 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2348
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7db15ae48,0x7ff7db15ae58,0x7ff7db15ae683⤵PID:2280
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4764 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3220 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2744 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5156 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5468 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3124 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3240 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3200 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:656
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3984 -
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4792 -
C:\Program Files (x86)\Microsoft\Temp\EU1F94.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU1F94.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4008
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4104 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1372
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2860
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2292
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REY0NUEzMUMtNTJCNi00NEVCLTgxRjYtRUQ5MTA0NEJFNjg1fSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGQkJCOTg0Qy0xMjlCLTRCQTktODdFNC1DRkY0NkMyNzBBRDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7c0c5REo2TTNmWmtQN0NFTFdHbkR4Qyt3YVJhUUV1RUx2TElmWGsvTUF0Yz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3ODY0MzYzMjQiIGluc3RhbGxfdGltZV9tcz0iNzU3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:116
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{DF45A31C-52B6-44EB-81F6-ED91044BE685}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5048
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1676
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2660 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5616 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1608 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5724 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4316 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=1668 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:82⤵PID:3980
-
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:H4cydWNHSc520WbzhwDV57ytCPKTHjgGtNmNU2n-j7cPjR8GYxWS8HHZxMwoQQnKT_rz0vAMI-6F_q_jdEB04L22vAnZTbvbrm0AJi1A3pESS3scrjRGKQkVyBd9NpMfAoDuDNVSqxUw88DUGs2MThejAc01GPfVIe9h1_Sq-UNUo5P8Me1nMi0z0bWUPhswj0hn1u-WeV9jzLW7cEYgcox_Bbmt7z_g3TQcKd-LiSM+launchtime:1716479535709+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716479290829005%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Da96eab28-3cd7-4a30-9c37-c8d6f3d37c01%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716479290829005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6028 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:3476
-
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:n57v80T6wOr8bsXkmHmABfc7sb4dILax77Fzj-A2RP6YZz_k4DAfHnPFEG5XYu6-rK6-psAMai9tdc9g8DMzWu6HpOOY5S4jd6YaRNs6jAFfJaXn0JoFi4Cr5DdHDcG4-E6xBD0ngDXHvXPUlnWBYqFuuM30ov_VXJrI3YngS2piU5mJK5E7wTil0DTaDCzfHxwMGwDKby__rTMLwlkqxo4eYRscX2TzbMaoGNSa6P4+launchtime:1716479586583+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716479290829005%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Deb3abf4d-4744-432f-acc5-3728c9440466%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716479290829005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5168 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:4036
-
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:MB2q0zuB5Pi2gIrhr857AN7yi2O1UMf2VG4_ioJvbgsv8Md9sctttUa4COG3KSxI5QL6z0wpEV3PQX81UCwAdKD71u5f-RWU-rPWG51abCaztFdlU5aJG-Ir1S88IkJP0-tt77CGnLrVELeTR_cHK5KCLAXEPqJEDK9ON79mOMygdFYDALgOsm7IfKo1U3FPbe53qDbhR6zIBDi7ywdJZnS9Kvnh8_c41vXhBK64OO4+launchtime:1716479637302+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716479290829005%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Db44af95c-0515-4558-adbb-3902be6c3f86%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716479290829005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5852 --field-trial-handle=1924,i,5243879685711639774,9763217256886936738,131072 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:qPwlF3T57ImuRDR95bIruytvII42T-XqtE-oD0n1-OSR12Q0ji7CKs6BaNMNv_wVTT69wFOBspYLjw8ft4h5CyLy1eltxrQ1e1jGd8YMIaecUDoVoIZa5Lh4EdZspYJ-lim279EywhN2Gc-uLAWG0OzPF0hSpWIw2wGkn2HLd9tJ8owi4PNQZUbzoPYpNkaQAgHc6uOv_Vf7SLGBOOeNwi-LvM2s9iW7bqV8883mEJk+launchtime:1716479792563+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1716479290829005%26placeId%3D4483381587%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D8116b38d-4595-4a08-ac36-8fcaaed42399%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1716479290829005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of UnmapMainImage
PID:64
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2672
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:1624 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REY0NUEzMUMtNTJCNi00NEVCLTgxRjYtRUQ5MTA0NEJFNjg1fSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1Mjk1NDA3Ni1GNDRELTQwRDktOTdFNy05MTQzODU1REZFM0V9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3OTEzMzU2NjAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2120
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\MicrosoftEdge_X64_125.0.2535.51.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:2328 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\EDGEMITMP_64248.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\EDGEMITMP_64248.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4496 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\EDGEMITMP_64248.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\EDGEMITMP_64248.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{28114680-AB4D-4342-AED7-2287E6B066DB}\EDGEMITMP_64248.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6ffd84b18,0x7ff6ffd84b24,0x7ff6ffd84b304⤵
- Executes dropped EXE
PID:4340
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REY0NUEzMUMtNTJCNi00NEVCLTgxRjYtRUQ5MTA0NEJFNjg1fSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCMUMzNzhFNC02N0NBLTQwNDgtODkyNS01RThFNEI5M0Q5ODl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS41MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTgwMDI3NTY2MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4MDAzNTU1NjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTM0MzI1ODA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy80YmUwNTlkNi1hOGFiLTQ1ZDQtYTEwNS01MTE1MDQ1Y2E4ZDA_UDE9MTcxNzA4NDE4NSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1NQTFQNXdGRk9oTWE1bXdwUExyNGp0VnJBcWFkYyUyZnBIT0hzZmpISGtEbTdKT01VS25UUUlXNVUxRjhhdjZBaEUySXA1JTJmd3JoRTlnUkRDMEVXQU5MaEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM2NDIyODgiIHRvdGFsPSIxNzM2NDIyODgiIGRvd25sb2FkX3RpbWVfbXM9IjI2NTA0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjEzNDUzNTc5MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNDg4NDU2OTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2MDgzMTYzMzUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNTYiIGRvd25sb2FkX3RpbWVfbXM9IjMzNDA4IiBkb3dubG9hZGVkPSIxNzM2NDIyODgiIHRvdGFsPSIxNzM2NDIyODgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ1MDk5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3000
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3652
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:4744
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4628
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:4356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3900
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:1760 -
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\RobloxPlayerBeta.exe" -app -isInstallerLaunch2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:4316
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:4692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵PID:1896
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3172
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4108 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9063821-7A09-4B82-AAEF-9EAB9B75A0A8}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9063821-7A09-4B82-AAEF-9EAB9B75A0A8}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe" /update /sessionid "{D6E640AB-23B5-4116-BE68-3E3108BD3B7C}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:856 -
C:\Program Files (x86)\Microsoft\Temp\EU654B.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU654B.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{D6E640AB-23B5-4116-BE68-3E3108BD3B7C}"3⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2880 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2416
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:428 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3912
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1016
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2244
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDZFNjQwQUItMjNCNS00MTE2LUJFNjgtM0UzMTA4QkQzQjdDfSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QjBDNzAxRTYtMDNCNC00QjFFLUE5QjctNDhGQjE3OURCQUM3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM3IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE2NDc5MzgyIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODk0MDIxNTI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2220
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDZFNjQwQUItMjNCNS00MTE2LUJFNjgtM0UzMTA4QkQzQjdDfSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGRjM4QzNGQi1CM0E4LTQxMTAtOTI3Ny1CRDdBMjQyRjAxNjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MjQ2OTMyMDMwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkyNDcyNDUxNjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk4NzIzNzA4OTEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xZGY0MjA4My0xN2ExLTQ0YjktOTQ1YS00MTY4NzExNDY4YzI_UDE9MTcxNzA4NDUyOSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1aWHU2YlVOdXFxN3hDNFFoWXVXOWpCZDY2Q1JmMSUyYkR6SUlPajF6dTBacVElMmJ3Q212cEpJdFlGdjBocWY2YjNGZ0lmQkpHMER4Mk9NMTNSczR5MUJDZ2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODcyMzcwODkxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xZGY0MjA4My0xN2ExLTQ0YjktOTQ1YS00MTY4NzExNDY4YzI_UDE9MTcxNzA4NDUyOSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1aWHU2YlVOdXFxN3hDNFFoWXVXOWpCZDY2Q1JmMSUyYkR6SUlPajF6dTBacVElMmJ3Q212cEpJdFlGdjBocWY2YjNGZ0lmQkpHMER4Mk9NMTNSczR5MUJDZ2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjIyMDcyIiB0b3RhbD0iMTYyMjA3MiIgZG93bmxvYWRfdGltZV9tcz0iNTgxNTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTg3MjUyNzMzOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODc3ODM5ODQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iMjciIHJkPSI2MzI1IiBwaW5nX2ZyZXNobmVzcz0ie0I2RDU4NjYyLTYxNTYtNDNFOS1CNDM5LTM5MDFDRkE3QkIyNX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTg2MTE1Njc1NjcwNTkwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMjciIHI9IjI3IiBhZD0iNjMyNSIgcmQ9IjYzMjUiIHBpbmdfZnJlc2huZXNzPSJ7MzE1NEE3NkUtQzRGNC00MUNCLUE4NzktM0REOTBBRkE3NDdBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjUuMC4yNTM1LjUxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzNDkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntEOUEyREEzOS1ENzEyLTRDRUItQjZFMi04NkNDN0Y5ODZDODN9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4344
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ImportPop.jpg" /ForceBootstrapPaint3D1⤵
- Suspicious use of SetWindowsHookEx
PID:2120
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:1760
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:860
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1320 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTkwNTRBQjAtRjhENS00QUY3LUEzRTUtOEYyNTYxNTgzMUQ2fSIgdXNlcmlkPSJ7OTYzQkE0OEUtRkNDRC00QzcyLUFENDQtODVGNzhGQjY5OTA0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDMyMjBGMUMtQzZCRi00NzNGLUI0NjQtQUI3NDhBMEEyMjkxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0Q2anhQZVVtS2ZoOHl0eTZGMDdZeE0xZVpESC9UVjZGUVQyZmZEaVp5d3c9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNyIgaW5zdGFsbGRhdGV0aW1lPSIxNzE0MTM1OTkyIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTg2MzM3MDY4MjE5MDE5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI4ODc0MTcyNTAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
MD50e2485bb7949cd48315238d8b4e0b26e
SHA1afa46533ba37cef46189ed676db4bf586e187fb4
SHA2561a3d50530e998787561309b08a797f10fe97833e5a6c1f5b35a26b9068d8c3e8
SHA512e40fcfb989e370606469cb4ca4519ce1b98704d38dbfa044bf1ad4b49dbcaf39e05e76822e7dc34cb1bb8f52e8d556c3cbf3adb4646869aba0181c6212806b96
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe
Filesize1.5MB
MD5160e6276e0672426a912797869c7ae17
SHA178ff24e7ba4271f2e00fab0cf6839afcc427f582
SHA256503088d22461fee5d7b6b011609d73ffd5869d3ace1dbb0f00f8f3b9d122c514
SHA51217907c756df5083341f71ec9393a7153f355536306fd991de84f51b3a9cdf510912f150df1cbe981dbf3670bfa99c4cb66d46bc3016755d25da729d01b2e63b4
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
5.3MB
MD50469bb703f1233c733ba4e8cb45afda2
SHA1a07afd7ecf1d0b740b0e2eddfcde79dcf6e1767f
SHA25600314da401908da37ebfe9b642506cab81a4467c092719fcf007be045bc4a9e0
SHA512342c9629e705eb78c7bd52b3efe4a92b6a8bece9933956390450600635e4c0511ca96ccaa25e6920e9d25ccdf444dabfea7b09f8fbcba2f371655f87633b6d67
-
C:\Program Files (x86)\Roblox\Versions\version-d8aa63d3654646d0\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
280B
MD523e656be369ad022af664d1b6bc756d5
SHA10a771c6e78979ee9030253b003e2e4eb4fcc77b4
SHA256cba0469d087c617d8a97ca5a996761713d40735900cabceac462859c95477584
SHA512ec76f7c4b3eef7a50918abed9832a21adda9f1fd8f2c64d58beeba2fd65614f9f5fef1a2333d40809119ac675412c47a46ae3b7c8303c507f2ee87d731a34966
-
Filesize
89KB
MD5fa5ea77a5d8f2e83666c3b1f4bfeb986
SHA1791a7e57d2435f180b10b929d2090a21f3f6ffb2
SHA2565ea680d9d07b0f2fa9b74c624069a2527d9ea2fd56851915c086de3f909f8995
SHA5128342da1206216c659c31d82b33fc73a31172b03602a4a632c811b98acc7a1ab1e6ca69392bb988cd1e71edb9e852b6860229f7662afbbc8ec09500f2888e54a9
-
Filesize
87KB
MD53944ec974f9d57012447b02314e03231
SHA1125677c1232fc7c771ad1ad7348820c252b87217
SHA256fb9a3ce419e5466534c7338eabf1d80a9b05ef20cb76ccd429100c29b0a59be1
SHA5124f4c97210e00d7ccf2f13f54572c15f8ae2a310e5c64a9ed8e3ea9fe2c54833f5745212e2f65e07da551ccb6981e7e0d19becd672485ee77499c271a5f9503b2
-
Filesize
4KB
MD5d65c9697e2c9cd933f0ce449e48f772c
SHA16a87a1d07b2f8df4385f575a88d405e2a2dd9177
SHA2560f0aafa4dacb24b81ce06e9baa166b42b9e73bf0fa61de048ec6270e18fd4773
SHA5121b85aab7b4af1d85e9a67f5fd79b32a0fcd842ed9b3e02153dfbc24c83e04fc6471e8e566affc97d23758e86676708455aa7084c9e2a97033b22cd5b4fb895d1
-
Filesize
2KB
MD51d6b5f02fd858e2d19391c5309953782
SHA131228eb9922108701fdfaa1f65af9e21cceed35b
SHA256bb61fdcb358473d0c5d625035f19ea6d9b84390274acd69a288b565d4438a38d
SHA512f3123b43a034aa978173644f02895b96476ef7e117aa8b34b1ce632205455c6f512a7c853f18c14e46609b534c4f9a0da5f955ec992f6fc27bd1ce4ac8954549
-
Filesize
5KB
MD5fbe057d8552f08f7564b7ed752d0cf85
SHA18aef86eb8101b283c7c33af5cf824b0f24eb97d2
SHA256b29cee7130fcb3b0a876076cfe234cdd8f98160660611c48e1f99887cb85dd72
SHA5128c40a211fca51db04f88bd31b5d41b3492e5c95091f17e7c9e3370c00bbe6d9e99203ee1cd8b7a0385dcc6c9a01b5f1f0b85b4848d47ff7155edc298b74c486f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD53dd4d3b84f6ddbcc7a5a096e8eaf27dd
SHA16058cd364dc6f1ab90d5d20eca58f53c2a69de19
SHA25640831ea2ae1a27e739a959abf2b8dfaab62512e4403d00f696abfcb1ee4a47b2
SHA512bf815ed5765cd0630b260558f4fd68a5d97149917d433a28f4627a20c30155d32c80fa5523c61ebf36f83d522a1d2b6f1b841dd1d6da1ce5fbf47429205cf996
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD59ff7142051a9115a67ff927a2777ee02
SHA102dd910e67482b8b4487f99d73c1dc437b3b9435
SHA256acb0159e1d065ed22b0be7de80a46bf291149ce23b79e0a6446c528e6266a3c8
SHA51273d08a642c6711734cedc85404895412e3fa685238985abfc9f8a8667c4e8cf7aa04b35e3807dd19667ec9656d9fb35569b82720d92b137ea48c1607bb1ec2f0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe585dda.TMP
Filesize347B
MD529a1fb684215fb7b71d931255a4a44ab
SHA184bf3156606ad8c4607e336e8b97af6419cc2636
SHA256082ad4f9c24f3e02516de47a4a2230ee9b956200b5cb4f0ee5d7d3522018c730
SHA51259cdfea270e39929649e0124639c16f22afd7559dec5bf5316c1520d1f5daf583c1abf5e9dd51f107489e0c74897b9bdbb6e20ee0fd3eb49ac2fd33cb72acc09
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\23ecd80f-0007-444f-913f-2fde5cc32757.tmp
Filesize3KB
MD5713b92ab04dedefa144d0796aaec4e30
SHA1916f09ef16b5a8de5653494e29fd1d6b56665c65
SHA25677bced1f7ad0728fd1a9b373470d869eab2306db5ed1a857acdbbbaaeb177d63
SHA512fc5bcedbf61ed24b05f52a079c706896be647a1553dceb4a3f6b33a50dc41b011e524d42763c26b05ea7f5f0437905f62127b232c8bb785b495271ae39e0039a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7272b1b3-b21a-4313-89a3-f4597c1937d1.tmp
Filesize5KB
MD5619206bbad1caf8418e4a843f5ddad28
SHA1c8106e9e9f7f90f3afdaa879c5aaa6fa5f3c02e9
SHA2560de726d8d60f2cb6987d77f8c99396daf3fceaab9faee7ccc1794cab8f48e969
SHA5129d0636267c7d0de4b36cba176e79f4319b2f619fc813acbc53b6dfd0c47a97595386322c2bf1d6d52c970c1951482d397e903f8e5786821ed8d7d4b0138c2492
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7e8a0356-3cf6-4f26-8a3d-5e61bd352be7.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD50d4910d66b7f77b151bcbac085bb64c4
SHA17f5ccb023746bbdf9c7e93a4402439b0be735ba3
SHA256255fc3668474207753371a5298cfd0d48bb7343327812e63846e5df13552bdf1
SHA5122c6a67e0842f09f78450db678312ac72c1e35b3aacf6ad66df4ef89d5508d0928495408ee466399a09b6d378503f8dd20c25014bce91e421e2189edc128ad1f5
-
Filesize
10KB
MD52704540ec516112c36a179f5cd45e94e
SHA1d28f82c31f6b4609d0d692d6129e397f8338bfdb
SHA25676e49631d752a8f34727324a453fa46181a5331d4c2f9328db6b76d206d6718f
SHA512f6ac45993135f63142c017d1129a349149ad77712267c36eb035fcaf329aaf9779ba9446b947b365c9861f9648a1ba65ad20f7f71ec301ed06ee4184b1d9f82d
-
Filesize
9KB
MD5074ffd54dcda75c58088bdb345318596
SHA1b1ba70b991a0db264e18c4bb60f1ea9d7a180000
SHA256b16003ab2aef3d18e807f567dfdb6d5f8f9d628d2259ccdab4ef02a558d02e1e
SHA512852b28c4fcba9afa5a3123c56e2f0e965efa0104395d2478edd9d6c501e35e3522209513dce9acef1be24af204c54758dd5bc76d518671477308c888095be573
-
Filesize
4KB
MD5f020085c9b6969ff8d49c4d699e5f3a0
SHA1726d24a54a5939ebbff6bc97c4772da512c91aa3
SHA2567c4bed11a1730c13b30ea4227029550ffd32d87767448f130d5fb81525695a74
SHA512131f2da0d0d97fdfe6bc619193061e550fbb2ac6083be8f840e7c138d96dd921e71b492d1d363b80f0b257d282e3e05b35b65a4612a2da86a3a2c6442319d850
-
Filesize
1KB
MD5983a5738e88fe795447cf62d18708eea
SHA1602069d90a563bf0196ada090e969cfcb5778a82
SHA25616a918a689c03fcbce4ccf11de6e3a8079c143614c80f7d164dab7374e781154
SHA5120bfc9721cdb141ee56286c13c40b180937515443834b7057555531177af8d55096dc32f8ddca8ec581a83de6f8c9d55cc05ff00716a5d2dcd987a3fd9364fef1
-
Filesize
4KB
MD50ccbd33ae6929fe1d6347bdc7b48051e
SHA16544e90cc150b31f09d294f97f9141ae2ae0106e
SHA256562fb6cdccb7bf9d65b4c50812806184e160ebc27fdf111ccfd94b2e88a2ed06
SHA512c556bee4f0a6ac345c9e387435904d16ccfe5dac07a27418d7658c3af9b41c9bcca7a410a1216981777e7c63f27b0fe0bd65f9630f407a8e78548f3a7d7ec6d0
-
Filesize
4KB
MD568dfb229695c97b799f38c51e6572df8
SHA14eedd85d3aac45fa809a5fa965afbeeb436f663e
SHA256be41e0b665ce2e978d331332058fd725692a022c0c16d05acce03047e302ec6b
SHA512cc73c8f11b4bd71ea30b580e320dc42f9d328830977049a723acf62758a5e2fc54f1309d4fd93cbbb9d4ed363ea5b8f20233ca098cd2f00e8fb1753854f3429a
-
Filesize
5KB
MD519a775a456931f9a149caeb8710036d5
SHA110b35b444d5dc70f07e5eb8d130b17342627a85e
SHA256116630e7db326fd8da53f777e344f4658b19eab4cfc9dc4ac501a969aa669e39
SHA5128e2e521ece2bee809a16c74ffd667b4d71901fcc0753651c9c79ee65f9ebcebeb88b0a5b04c54ee818142310cf0036b262b81779f8495b993a09b2c3347b0462
-
Filesize
5KB
MD5f698f6942dc854144888091bc8a7f205
SHA1e2cf015d917271bcf9a7057fc689384b9150c34e
SHA256755f94f924faa18a8c377cf7abb68577be9efc15bf110108d54662e353f6ce36
SHA512836254bc14cd8ae4d648e527e7bd62fa5f40e1b8111e04db398f248b0b14735ade0232f2fa121cb1016474cec9fc8fa56994f505e469759d91761871bec7c4de
-
Filesize
354B
MD54d1c39f528c532bd5eaab993a5820211
SHA18f89593e0c8706e8b6759f6ca8f2311691836419
SHA2567d749d8e45904aca3c015b1ae65522a7d5d062e1e90dbac7454c62b9bd96c784
SHA512c626df84994d2871adb452157a643298d21aeb9701c297735ef47aab0759f85a5b0795dd221c6e4dd9fec561948f020d60b7ba401d10628d5e57117b412db167
-
Filesize
4KB
MD54349c109acfdcff29c1d9f893178800a
SHA12acd392ffdae34c89e30a84235b077bf212ca4fe
SHA256a84deb36a8611580d97e49e14b7dbce7701719597a6875b493172609bb7c8860
SHA512a62dd61c17bc57e000ca95633631cb0abf88fe209ba185f99f2a5a703ada24d8096267ad74b56eb2d525ac21b74acf0da4cdbf6bca6b80878a2dd6e57e1c0c5e
-
Filesize
4KB
MD5244d9d724377fdc5ef41d808b698187c
SHA18866bc03fc5785141cab08ac26c1d138192e1807
SHA256022ddc3be50dad768c8f2b192fbff7fff4031f8eee43db6c54f3c254d36dbca8
SHA51244d259071da6e35f5e5178c03c9a9ef88e8f584531f86ce99c66b392ecee5bbd8c585d8f613207d651ac9b812b43cb100b07e9e2322733ba6920299dc0e8920a
-
Filesize
4KB
MD53ac8ac1e83e2192ed5a685fece7ab97a
SHA1b8a0a3d8509ff3870d93a6c60460bdbf49cc1be2
SHA256918bc9a810259d9799222d588d5d48bcc57bc8b4b670aadd8bf292ef71a6bd83
SHA5121d6ba344548ebb1acc249ff453e643cadb6a8b7c4f10db4563dcb4693d35f49a153f9b14ee60e4a021cb5be4b5ec15d3c8ac070f80ef727393f5bb4fd98c1d63
-
Filesize
4KB
MD5c482b5aa435a2a674619d4c512420ee3
SHA155725c22728c7db9b61b252ec0bbdd197201b305
SHA256b5d5abfaafc8b6bfd4c779e99ebde038c9e877cf6ab1ba7aac685b26da3716a7
SHA5121d674b7ce4e55a5062ef5717e3305a8669e50e342946d7f6d7eed628d4fba434d08f434ea18f047acc72eed862322da271612b37262fc0340f416d17ed379b24
-
Filesize
4KB
MD5f1345e95e8c89c9b3f9def57c6f66c53
SHA193fd67ad691697afd01105f12477761ae39721c2
SHA256757b0e91f488bef790c2efe99ff6905b12eac3fd70ad497f85a54a92b93e11ea
SHA512eb5dc9da724f0b4e84082b7f4af64099f232994e78e7320bd9ad9b13eb8f81eb122b6873b3d29f82cbb2b6fb714a37339464684064fc50cb49357d48d9fd34e9
-
Filesize
4KB
MD5c93fa4f51477da2361e07b28b9db6aa1
SHA18eea63ecbb19a6352d0d3a59dc0bbc5692297684
SHA2563f62ffcc85e3911fad073eaeba1b4b45ecce944a91e90f09478739f765a5d03c
SHA512e72ea75fa844f0dc0597f8461062a10a1ee116c253d9c028f353d74b38f5855c40d0130623d69e85fedaea97bde9cf04164b5f038e8ec06f1c243ce1aedd0f2e
-
Filesize
4KB
MD5d7a89e83d22c74780bef2a2520dcc5fa
SHA14c5b410627bf0f9d16e1037916f397ae1cd19cae
SHA256805e6c3bee16c8cdb4e4b06d8f587b0c5f0a2776a1c75f2b22bfe7862dc1b518
SHA512a4757dd5e120201ff2f23e30c23e6eb79be8aaf51abf658e08d620d8743c58696acc49ae426d37d00d23abd5b047b3e02931b28301c5a5860c677ccd7dc2b062
-
Filesize
5KB
MD59f16736b8efdb4dd21de387e911431d2
SHA11542bcc8bf4992e452292646914a38f916e6dffa
SHA256db85f712862cdc38a555fca6f6d7a17a58878fa43c80a6a5f1fc9777d8e92caf
SHA512b09a0752786b775449d0f77f8fdead593cfb8bef59ff501f6233a142a2bab9e8d40bada803575ac5ebf424cbfe814ea3840b9d18242d179ce44a8bf18ad5ca2a
-
Filesize
5KB
MD52d984d625eaa9eb1eeebe0f196442cfc
SHA1c445b63174e7054d48ed8046d598ec7e9b661113
SHA256887c55d22d5fa499abeeb5650f0fc495bd960152bddd2957fdad841321368830
SHA51297d7958f155e17f1dab0b970b2cdb59b9b46cdf62772616d87bd35e3b1256ba39926ef6246905fbd6af7c52e979bd232b52d400e7d4809851a1b1f9e8d8a4b64
-
Filesize
5KB
MD52e1555801e6144aaeef60008662c2c94
SHA1a3a441313a6db6a380d3bce59a877bc203fd4787
SHA256110992ded5b846c040ab3176984813573c74388ccb9466a30a376a293c0eadda
SHA512004930099b0ea4f5e96cfb78c12889700202067f48db03bc58bb0a765698bd5ecaff4d93b6099f533cedc068e926195ae567cea4ad760001617a028584c17797
-
Filesize
4KB
MD52d0be62b0c64aa660285ad8e19771c4e
SHA107ed1600acf6aadb9c482480ad796b7754a5f17b
SHA25649a3eb3f66fc017af1015bf26e7c7d507d923c310f87a8d44a341a7d57468014
SHA512a02d5f9c407b8de3119d9a58b0da932355715dcf54824a589d19e8024f9b5da197212a0e691f579888af99eafe6001eaa21ac4fde195458e255ab402659bcf0e
-
Filesize
4KB
MD5204ba0e1e5815b646f9be14d22a1f601
SHA14ff66b52a0d6e13127794b45d1ca0d324360ccfd
SHA2565f1387bc236e96b1a0cae065320fe995a1e1f1a8266e47c219275443d178ef22
SHA51208ddc7a51fa63ef9cc3c10f2078ff2264c4fbd80ff069bd29bdc20f11f2a05f909e62dc4d847624a53d889f7e1a2811f1fb59f8d332e22bfae869b484b29d80a
-
Filesize
5KB
MD53e78d63d925854cfeabb687cc3eb20d9
SHA130c6852e6f44e6fdbd844b2240bfe72e2196d883
SHA2561a7bcbbb47afbff4d4ca00da12ddaac07f301e35914e2a0386c4b3172b61964b
SHA512d2f6b1a3b46331bbdfc14a59f37b20f556e4f55fe4b9e811b3a1ed1215566e942dd1a6f0d2060bfc30e3b06fc7c829df023425e9551a7da347eec36c1094d8f7
-
Filesize
5KB
MD5896fabef2fa828ff20942e39b60a3bea
SHA1bd7d866e7065d89edd0b8c845dd5eccf7290c36e
SHA256cb508fd0e6bdd80cf47dd91bd162bf6e1d552ccc4837347238944abc7da4ef18
SHA51283bb9e7bcdc9435c591004795394011c2060ba4e9679a7cf592c17d5eb13c0da5a17412ec04ca3d4b145a53f3183cd0f8447ac9a615a17e1bea877cf7f1dcc67
-
Filesize
5KB
MD5bfcc68bf29634ebf4e059adf6efaa3cb
SHA1e6020e4e9ad7e7fc3c49cc848e4b9297f1510af8
SHA256781acd62b50b120b33131890710d59088b79f3da3403db6dd1ac884655dd7acf
SHA5121e4eec9418fef75db5da594d3c44f878fb8041e5c0097b40fb6e3dd64874470a84889952938f043053cb9ad538afa869734bd533db9027a551b0b4ccaf9dcab8
-
Filesize
5KB
MD5132e24ede974b9d0fc99808f9dd42633
SHA152ba0ec6a488297cd140687b68aa460488c5af2c
SHA256d54350a9ca6741fe1e216d86e1875da8524e828f91526113d77d6cbe8ba5cdfe
SHA51275b97f5492801ea7804329917c1a82d3277471add920b6316dd4ef4b0e1a28e077b010207e2c84091c10de726ab5d7288541fa111eca1deeb0be157bbc769051
-
Filesize
4KB
MD56e42d9f033cf98dd75988abce39d7e53
SHA1869b542e476644f5a21046f19727ca7a7997e0ae
SHA256db4f6750b8dca07723aced3445bc046fb28c6a9a87539112d27d413cc895d352
SHA512c7393d51a1aff9164ec72348f03d1c1833ee67c680619b0af169aa48793c75c1ddbe84ec988841993c33105775ba88b05ed8e5a6e2b47140009bf5f5ecc48f1c
-
Filesize
4KB
MD5adba3e1e630d84936a69f4c7b1117aab
SHA15d01471eabc444d07a7ddd9421614f6bfa5a63ce
SHA256e44ebc9b089364def6eedbf0840c435251341a8ac7e5ffe03bfb3427ebecda12
SHA51272b4407690b910c14c991943c6f9610b8cdce95cc4d1fbfe356e7f44103b589f88da164e6230d3c789fba08ae2226fd1543e51c5ea44070052eda0dfb7f486c2
-
Filesize
5KB
MD5e0d81ba9d217ab7d4c1bdd409c9e8810
SHA11719c9838fbf198cc7572d50b395752b36e4df8a
SHA2562fe841b4119078f8a9b5e63eecbf3211434bf1519dd5077448935fe2adeb5db6
SHA5124a14a7bdd68c495650f8d18ba0547afc7ea28de8de47bdd4740946ef17a627325d72c758eced024e6c0f7c3d6da596bdc9cd59b69cbd003707c300cc4f7bb24f
-
Filesize
5KB
MD55d525de13ca4a651807f58eb43ca36c1
SHA11d10b133fafff3d5e11f2cd354ba76589c554143
SHA256228ed78b8c75c691f2ce109a72137350d9b8741626470175d34b8ef09cf357be
SHA512f8c0e812ff2fa7c1081dde4b1292c7ad273eb9c0c8a33cc7639c8b595d7dc1d54b67f884e358c4d903d6ff4821c03f84856e6715fa687113ade330d1e4ced64d
-
Filesize
5KB
MD5f0e89de8555395cbbd403e33f194d385
SHA157f372943ba6a2fd1d2016225f9fb0f5e3c578d9
SHA256b8f2a733dc325358ac1e01352756dec69d69ad73f9bef4cbdb3045f3b6207a45
SHA512e049102d8357a01c9d6f287d46c2d7e1b62da994f849e8063b84b15a2b6afab679d6569e1ad398d1ca6e08bfdff2ab91abcca37d61dc45af6d5e75d5b5b2bde6
-
Filesize
5KB
MD52560eefdd6f1682c5ba1ee3eaf2f80f8
SHA1f85cf9d2ba41823fcf32d93abe2c064aecc12901
SHA2568ee6f48b5a5e3e76ffc48b7ceb42fbe6d355b171adc338c824d51fd514a5ad5d
SHA5128e5ddd048b6c9f32555c4ef39e402f667cb6fc3c3462101816142b41c45c183011a415fc5d9768cdc603fbbc290d51605fb29cc524bf3437fe3a870f89c714fb
-
Filesize
5KB
MD59422979e387e754dda51e2410e61ff9b
SHA1f15e2a616029c397c54a8c99d3e98c73717a22bb
SHA256ea15bd0ac21ad4be08d8acd9e34533b1c975ae75683dd5f524d1f877dc571696
SHA5123aa96f4ee5407c1115517fba0e13711b99917be6cef29714e2d5c2656cc399ff07645a76145173d2d190c65c13c3deb93f91d7b463ebb7298f30e7aaa5530c83
-
Filesize
4KB
MD553b1c8e218cfdd1536fc19fcb55576f5
SHA1427f12226a3c86ac2eec626eac2fd28627af2615
SHA256819be98dae40e415634c39cfb2620072841ad26431c214bbcc3ef6f0b1a89669
SHA512d5a8e252745c99d9757127138da237e6f8a902d0885643eb27ea4451e821bded0f6a9086c1f6fab6788ae7e882cb7e0ea379736917203d67534885dc581f6f35
-
Filesize
5KB
MD5e39e10a7f2aaef7ed251caf66a5d468a
SHA1803f725f730071cda8e48b031fa57b06254fbdac
SHA256265406388bcdef70e12a6e31c988f3cb97a1f8e145182f83a6482cfc5f22a7c5
SHA5126f7df0176cea63a861402c71414b288873947e4037019e062a9ad663a5cdf71d8c4b0854c85d398b28abc47cc6d963dbf70926116ccd8fef90fe99ab7d65bd7a
-
Filesize
5KB
MD5d3b98ade88321cee81e6e0abf8684f18
SHA143e272766756fcafd825c6b8c0e04881fbb338eb
SHA2567e9a89c5c87a1f1f3551ad1ff1db0aa84d0a1cec00eec3a09d53a47088fc14b0
SHA5122962e97c284839b02ae316bb21c411db5d928c3f4be06c162a3686a939b1ef1d28687d44f0119e383c4c54bf1e01a7327e434a889308994545bcd7b5b155a5ce
-
Filesize
4KB
MD5c81ec0ded63a7202d6f53310238bfa4f
SHA1d937d1dbdfc608f5572732b670c21e1d3a5d51cc
SHA25693b032fe54c1f424180744769f51c54953454386cb15c4cebf5d733608f9d93c
SHA512d62d4a304a0dcb45c0f0eaac233de9cee7a0404299aeb70f22b94dda7191a4c7e6d83cd3df5da49070547e8643f3a8f6ab6409907fa6b5d72620850cd95c62be
-
Filesize
5KB
MD55bbd92221a3e9409eb7ee745fd8ae83a
SHA1977da0892b9f36836437667527fb874b6421974e
SHA2563d9e97f889ac91113dafb13a93bce32675119a33ba2c1e2d46463d34186dc73e
SHA512044f3a872ca339376b47110b6b0570d87bda2d88b90a78e7e8950c934aa4b6516d38d36f72249bb465c82f5ceafa1d60ac56dc20f6a64cf8dfc770b96be33047
-
Filesize
5KB
MD5c2340e53570480faedbfac95f098a21f
SHA1399256cddb868b6153b16983ccb97ad9c43a61a1
SHA2562890dac0ba8dc62fb03501ae7fa5a8e82b91e3d73272be73d72a3f641d7b1859
SHA5125249f5606fbbaa90a9a83afb0a2b13b999778401b459d037298165bdf7812143c96fb0b52bc7e3bc85b22a7749a7bf3e7b83fa5bbf1aad4d1aba49b74f13f709
-
Filesize
5KB
MD577a019000998412c34570167b166e248
SHA10f40b944265a8f665271896cbc57a9e93f37d047
SHA25600e4b5f51d5ebfb76923e869e3b52d6b8ea2339b86e2ec329e56d70841cd1ed0
SHA5126a14773ed4de8854517c6748cec3dba74828053347696f524da38a4c55a0552acec78da82a3f476fbd0fe3f6773e845b209d5aa96fa00bedcbb4c0ee84ab99d5
-
Filesize
5KB
MD5522a7e389c845f3cbf39ec96c9aad25d
SHA1d345f378fc210e9f83858e5a6a895c8876f34525
SHA2569202c32a63a29780b86038f8cf47b9621e37448f054ff7acd2033d3f3bc3f16e
SHA5123f286917b87f3c94866e893d7acbf94254f4af4bad1548c42e5b0bf97094a94bda371d34b27f30ab4444c0b3d3ef5c8fad1c18aedf49927450e00f06a5a6cf6a
-
Filesize
1KB
MD5c9399ebb4da9148891b691a856d3825e
SHA1d9a5d72e2d905c3b148672d068287460756c04de
SHA25660495fcb520f63c5a8e2877482ebb886cf70c107e2ba8f5c596d1f55af615378
SHA512eb8ddf54e72d8d900a35b834f86472045cc4552d8faf52e1fe296eeeb9a8366ec60d459b9a15358e4f7d49cd5986db35bd68f3518f72068b0c7c4986ad7b2930
-
Filesize
4KB
MD5fa069adc72a3b7047e3f26baaa2aa4cf
SHA1487bcfa375656925f14fcee99960f291bdceded0
SHA256c45d65832b085b05a2458760981063c4c1a3aefedadd97c392e3c3bdb19115a4
SHA51231697cbef659c274b33e3deeef4a6b6e6d704edd613a176093c03d4ed6c8f3eedba7a706f7cdfbb5cbceac837c55c3097a6a494415302707d958fc77afbeaad7
-
Filesize
5KB
MD555974e5e2dc28c1d89d830c4003605ba
SHA10ed0317df18271f87a2c39262f5a30ad714f39ae
SHA256c6130c4202837e64de3195526b4707982bba620ddccb9ac78d1de875f2ee44ae
SHA5120b87c8d276f55e8586439b2c22e45e65ce9c72ed02cd146094ebd5dc8fe5aef6d827b920b13019edb1a84615ffef87f7937c7ee5ee9ab6c94cf93c0ffeb7592e
-
Filesize
5KB
MD5ce85173dbfef7bc668aea46e48b805c7
SHA1ffddee44e801574408ec0fcb9b5954bbba022a1b
SHA256cf44ded245e3aae14bb1f5efdd0769e3b306f1851675abf5183f69aba9a2b94b
SHA512fa89a9cbbf44fc8969d409ec01b146bc70e387edc1b1a04a42776ba151c1ecffcd0e9df5d73937ed13d28bd0b4aa10d15a52b09f9eb74af74a8fe3d97a4785d9
-
Filesize
4KB
MD57f55461e4522ea63e0979dfa19e53506
SHA1e9f731aea57a15e1b7cc14586660d2fc7ea6c4ff
SHA2565db63d6d0473dcf0e7ef3bf7e98539932f0ff289f3fe872c86db96a275f025dd
SHA512743b614cb1bbd60894663dfdfc3610424f84648297b5f7f785ab2ddf83d9993e678b5e82b611165e3c1fd11d2136ed856c3ad126a99d6239084284d036cf2bd6
-
Filesize
5KB
MD536d43dc02d99705b38fe8bb86ed5b5fd
SHA1f0c2f0153dbad67417153e51c263bea1faa361d6
SHA2567775b6b7a5a947b6d06887bdfe088765d17a00819cf818490c4264b9d41c0442
SHA5128a275e6e30077c2e477c3291b2b047e4c8a07338ba12b929b91e54aa470bd92cbe3008f89ae2fc68f67b001a49f77c7eeef02de16d76dd51230a08bb6998c437
-
Filesize
5KB
MD50278582d0ecca39920387cec1a602277
SHA1634c6e4f053a5955f5039f6113aaa9bd4b48c19b
SHA2569e5ba285d61b4356bc97677663783a7a294a998d7c80569b3d7ecf6f9fb86b1b
SHA5129176377a40293f9a9ea51faf7eba8936abc93f993b52a533a0e1fe0bf0810a0bf4b33e929c49d1d2b9a2b811c58a0bd434ec8f7196004d69efbaebf4403422ed
-
Filesize
5KB
MD5fdf07fc21ae592d64944787718451a77
SHA18eb787556055d94b65bed04ecc1040b2c60a2573
SHA2564b0669ee644a790f44c5e26814fb31e8833bbc05de4fde819ae2f39a22aec822
SHA51236eeaf98d787329fbc012d712ed247beef578552ae6c3b18852d706750497ed84172be7a119995bf8e0da838d96a0c809efe3081f148e1a65bdb8f6e27a5c321
-
Filesize
5KB
MD5f6a88ae1a3c9528a9cbbf04e5eb91e81
SHA1e7502db4fc0f673c906a37653e175ebbe625fd5b
SHA2568af4b71afd7bf533aac5e2ace95a2c6e955f3367ac54f121988a5fe88ada28e4
SHA512caa015dc788311447419db60b698950dbde49214f148cb41d27a48521eeef06de4128209a3d476d31d8041ec8e51fbb6af5f830565e9b083656cf3107afa2728
-
Filesize
5KB
MD5bf4f961a125df123572bb5eda658eb38
SHA1be3c0796f4d4e7c7ae651c65f3d3fde0c99da5f9
SHA25634babaa47ff146f15909c9f230ae2ddce464cdf106d14b6f69bf64aebd9ea0c4
SHA512f7283ec0f1f4999c5c766287a4c3d7749992e8f08b911d6793c477d1d065638c1ab2145b3dffe1a3ddb0aa18d5f3726fcc941948f050c205d66ac4762cb072c6
-
Filesize
5KB
MD5e93117a90afa7c41124bfa276aa91796
SHA1d7a315f00500421cb994698decfa40b9e9240034
SHA25650a151c839fc0f355421c1fb9c459381d2e4d11d409911214d56073a01ad462f
SHA51222e645ce9a474f2d3c32d7858a08d0c9677ea5a5206997e658bcc23ec23790a9c52eb0d9c96ea7df641538a93b1492a41071417bb9790bb51c07082578277bf0
-
Filesize
5KB
MD58c5582e0489a3bc6884a6a79827ee912
SHA134c99df1bf292706854383128ab7afc74e07c474
SHA256ecb67d815e80bc823e99ee5ab041c3dba545c0aac72462d09b6d31138d6a0e34
SHA512b3933165150aa56102f718f0eccd2ba7670f1eff1c4f403d6cbf8f256d87c4f1865fedfbcdc9a90abc1578b546d7f283e79ba35edb25cb5a67da45fb161feafb
-
Filesize
5KB
MD541eeac7456f083c5ab98a3c02752adeb
SHA1bdb56cfcd19cd74f958c4e3485f122f958a4076a
SHA256bf93c2dade60f81a0d973049c5bafb5b81580badb75faa22ba29da3161750fa7
SHA5129bf0574625b50f8230e82473ca82c36a08e96f57ab283d70e5b05de869e826c2401bc463869c429ca1bdedffee0d3efe3faa7d3d7744d7857a2035be8cc889c9
-
Filesize
5KB
MD52d1f4837f808e9e6062d7d85fd7d7a9a
SHA1be38c4a159f8c3c7bbdbae95fbf535b13f37af97
SHA2569f5bb0fa77e54defd4f80b65bcc20879f38d4516a3c698d98417706dbb2b5fbc
SHA512a05cb962760935cd2c174e80d1c2a3dcd18e8c6ed17234164acdc47773387b09690a27f120615b120dffd6ffd7039f879be01ef9039288b03cb38dd04c8cff11
-
Filesize
5KB
MD5c2cde2d115be656e0975395a55878b7a
SHA1f9b4a40b29ecb27ece54585575379b68b2cc2253
SHA256af41d3526be17deebf769ad647ffe87f94ab15cad8f93ef4bfa3349bf102285b
SHA51244553542fb37e5f99cba84bea091c8a6779d8232db78be8237ce9e94019b557218eae33e67483f9980ef109ee56034d83855e6dc06adc973c0afc3ce729fc8fc
-
Filesize
5KB
MD5e2221d88693cbbebc87af9e849871eab
SHA1b4870ea800c9214eb8203a192e5536886b19bcb2
SHA256b44dc64d34c582b9382c053bb8e829f2d073b9e0a779db8304b24a056e3445f7
SHA512f24c2380cfba2ba9554638d38775b374967c5dd62e432cbb593a54084de0739fd982650f68d8922ce0410f62aa16c57a97a6280db2a4bf86412e47f2a87024c9
-
Filesize
5KB
MD57c5b82a1eed2472faf98d581b79874ce
SHA18c16407ffb63b084732a1a2107fd5c8a51f6dd6b
SHA256beeb8554a4fe109413e9243633992975e154c5dd680b388680565754bb670f7e
SHA512e47bd29cfeb28df7699e85c5050e31fba3a1761a1ea5f9a5c57fb8427c064fcb66860f04c88f1320785cb4e173e5529ae45157556527fca4fad967022f9d3cad
-
Filesize
5KB
MD55ef58c82c73da4146cf430af7b899cae
SHA118bf6a01c25f7071df01a253703e01e2a2c470ec
SHA2563b4b7d11161b92786e5cf6a53eb372e2d7e522f144eb7fed9dca6146608c5aab
SHA5122479e31a46b8f782119d75cbba0d29f9c8bef58d2867caef10d1632104d20c62a9bf0a929d4f40a0e61995e7cec72da667270818b9348a45f21f69aaf8154097
-
Filesize
5KB
MD5e2f4054c240dd8c32d6cba5933d3ffad
SHA1367e69e643407f283b3ba9a9cf14e98af1a5762e
SHA256f1da4d824c1089eaea2457e50a77e7b47c0d67e49fde2da07297751e9122ecc7
SHA512dab0989dfe4f6181197a6c14dc7bdeccaf1815eefd5b0ca2e43bbcad2d9c224751916184cf77de2c553e63c7daa5e6f388b24b9045d43fa459691dcbf1fbf3d4
-
Filesize
5KB
MD5142db63748c0b6fa071717a4aa42a046
SHA1f76dfa43f2b7fd75e73b21b215ae01b0bed8aef8
SHA25686b503ef0983d16d36f34908bc5f78032043e9d354d5a1c9086fe37b32c7b9d9
SHA5129b5e7e9fb6513ae8fe0ee3788cf8a7d0d965535f95c0d636e530d19288f058707d13a29de5f5a0fb7d25251a15aaa7c7a86b709060778de5b0528ef92a3d1416
-
Filesize
5KB
MD5a26808cf423a62df12618e4bfa8c633f
SHA1eb652eeafafd7f95047c45609096eb13337da93e
SHA2568c0e8759a30785e487c0d0de0f85f42d844f3bc706874830b8447b6bd3e7564d
SHA5128c14a6317c11a65a47923a72ad89fa467c2d5b01c398080571b7d5512ec94bdd1e21ddb97706fa4ac6ad4cd00cf93e8da075c723f212aa4d52dee31225d1e564
-
Filesize
5KB
MD5019e6b86418b37b8d54b2ac913a78c08
SHA19b57a27cfb788d516401accd2e3e1f5f5714fd5f
SHA2567349876382d752795f10f5d99e7743b1e527a2902a851b054ac769746c614f2d
SHA5125d411120dab7c7b1fe0ea0d53d2d8e5189a2131179f94ee3c59e99348288365dad03734f4a18b9fa3f956cae0854163a459cb806f34d3b67c29821f7b7d539ce
-
Filesize
5KB
MD5fe9605a3bd76e0f0b10ac707e6c94b83
SHA1a4e2d23a1d8a502c79046ab50c5582c96b5eee63
SHA256915894670a5833936fd762ade9039a7f3b7b01fc992495e46b96c2bd2b3e0040
SHA5126902cafb1a816db72a00b35ea19c6b0d19cd24b59b50c1097202503f3c8e17c7fb736a0ca83025a2b5af3d77e475b99978efe2bb55881a734c515d55d84a61d8
-
Filesize
5KB
MD5b71bf8a55e4891e9d3c52ae4c142d523
SHA11b1fe07ba59f3cdd5997f66a5b88a7fe11657017
SHA256c4e67da1f0633b4fddcfc0c79a8205f7cf176205bda2f2a74ab97a20c06799ac
SHA512965dd3ad1446fbbe911c1bb24e263b1c1456633d096b31e6e256f5871fd64dbdd580f60f162712c630f3d8e4914d1d97ca2290e3860adfbf36ec15f98288eb93
-
Filesize
5KB
MD5ebde1367186b65594e52f92bfc0fc794
SHA1312402bde8a04e79af90b1c3ebe6a55262f10416
SHA2563f039dd3a93cc856a726cf343b58f8a467e7c6476ce5949e879bca14bd6f951f
SHA512419064de0c3486d4204bd49ffb9899790a4b4be59f3fa11a7fe437627c1d0ed285465b67cca4bf60f001403c5da3b23adfdd5e87904d8c650401e5e0e562bc37
-
Filesize
5KB
MD5d17cf192d30bdd548de176e0550fa10e
SHA1b10a65bd49ecb23283d2c80abea3207172fa255c
SHA256b3641ab079f70adea8c5886aa38848fc289065b4a8572353e4160c4390716cc1
SHA5120c5d7cf41b0a0f8dc0c3247379daa25dce5fed47fdea0d6f5cff1edf56f90bda64c3e3ac614a6a74213b91e822ec47488718fdc3631faffb8593ec48355e2e09
-
Filesize
5KB
MD5824f1483c5416224be1b1cd5609126af
SHA1609b6f0e0e72c8e76ecd52684d71d1346218cc86
SHA256efd6005262b543e31bd8747671d92b8598341103f116c5b18222ee44db55fe56
SHA512c41919f9f254453bd2ee4c19631683defe828753d8403348a1140b0618267c11ee9c4b20f18e4a470c89bae017bfd87cc7ef850334567e2549ec666dca91aefe
-
Filesize
5KB
MD59a7ddbc335cbdbe728c5192111e3bb43
SHA1a6f9f3e379ad633b0b0e5f88d00ff03a70ed1acf
SHA2561cfaa02ef90d4ba30c9e7c63eb2e118ee42c3c66d2c97e9ce3be48f8c3e0450d
SHA5124ab42c46b34b1f3b2decbab2d05f1f341b1aa964316a9a6b003906fbbc1960b274e0962058189d9c2090113113cd004c1382b9120427086e33eced6ef28eb2f4
-
Filesize
5KB
MD572f19c55eece9ab85acc1b5ba0f4b4e2
SHA158f42a36e8afd7780ce522af83f7b5f5a76ea09f
SHA25668cafad9c940932541a707cb7a52c26dc19e84f729ceaa4b9b9c57ff5fce8ef6
SHA51261c8428d69323570c445f2582166ef25083c2712525ec9ea7c3e89931899fe5c62eb01bc3f9809d0804d0b775f9f83fea42dc824b3606d16db6af4ab8a0204b1
-
Filesize
5KB
MD5fe246c205c48f92b3d2d82152b80212a
SHA17380096220fe4f349ddf26fb772eb81099b57d74
SHA25667ea58b723092d2b8e745e151997f42ebd9c325149025599ead0e0e07c066016
SHA5129854e1fb643da6881e5c7b8fbe01b53e47bc55155cd21d21cd3f5acda6977845be957676767d4f4e500e3209d47f103798ac743fccbcb6ffc2ccb54be99ae3da
-
Filesize
5KB
MD566b7f59fd905777e2a3fb41f021f2377
SHA138e19a775156b29cf56f309e41c00a47f766ee71
SHA256c9e3a698f959a737edfc23fd676a7344ec032f69f2fb21634b9b9f23cbd178f9
SHA512463cf721c573b54b4db92b91c27bb5cdcb3287233c94857b9d241ec356d685f999717b1b9066810a84e79024c16fb0cde12ddabd3ac3dec38cef1c229c0c5829
-
Filesize
5KB
MD562777f7d30ce6358f114de3353067243
SHA176bf5c5dded653c497568db0a06cfdd0d88ac0b1
SHA25636b1b53febef105811378d919accf9ac5d4eb49a8fb166ee3dfded61911c3964
SHA51248857cb11c44ab5a1da9845be411aa410852becd707f05a9d0143301ba2e37a69354cb5fcff2506e50cd0f33fec3c9bc83ea918f7f29df79188f4a44faa07a79
-
Filesize
5KB
MD5e7f44562824a4006bbcdbaa2f1d422f8
SHA14c4bbef491881d80c7be3e663b44eedef3264c4f
SHA256c9cfc5694c46e92e9a3c4bdd5147ac8d147e6bb59e98aff444b0913d98f8d851
SHA5122f7233712d3b03a9ddfd4e5737eee7a384c12687cfd027b40222aedae569dda077c53b1e15f25ec945c1a3f0d901e9ddbeba9515cd8f428e48764f5a3192f967
-
Filesize
5KB
MD5ade57af1f1835ea855772a035dc474f5
SHA1021af0d05cc5912f7d1f4e6876e439cff61d93c1
SHA2568fb62c69c4c315875d13dd5f90393c17725ef8ccc4bc5885aaa07cfd087927ed
SHA512126338def2374ae47060250f9204134425039aa6f097b712e4f45c47ce52955f7d79e259eee61cedc0f8f81a5041483cd4d330b04858bf7ee7a04c462a5dfe8e
-
Filesize
5KB
MD557e78165d70959acdfab2e5e61270b52
SHA1d8e7d54a5f24a281c5439b9a27da85c394a6be48
SHA25609c371695b8f9f192ba40b6c67d3570e2205eb3d3fdd2f86282e0ce692ee8215
SHA5122797dbd71f387414d3ac729d033d988c443007bcb4107da74ed4cce84d0d0550ff45a3d6279a69fc57b9735c643b7ffa113186985c3715e74c24da47b8026252
-
Filesize
5KB
MD5036bbb7a1381d4d6217de9f640455bfa
SHA1461cc0cdf29947b3b0c75661971d6bfeb5239c75
SHA2563fe0e54f8d180eded44cb1c1f301a23e23688a5735d8dfb3459415bcb3b8a769
SHA512d415e9d4c0f315388a097bd2fb9dea57455a831b487c8f81176368716f45d42f7c3e63f23a5a19f8ab1538fe45730bbbfa14adf6f3c4676ec3b5ea1097bf16a5
-
Filesize
5KB
MD50492669a5fc52ca33f69b47f161a0aa3
SHA14671d371eb295c057a0f16b5d292037d7d3fe571
SHA256522a89fcca6da1633e3dbf8e080ce24d1c9ca634d597aab4bce51efb3b7ac8de
SHA51203a8c7a04e110a13f902934a2e28249d93d49aa963d8a784a5571720f21e20188a4b79745ffba7e1672757dd942a62b9d9346e10b14ded881abf6e70175b9ce1
-
Filesize
5KB
MD595aae2a6000b1aaa0e01a397d0008a0e
SHA1f2961821e6b050d69f0e7c4f21c2a0c0b8c07166
SHA256aeca9ba183227f83e9667b9d53b60e8e4a6aea2a7c0266a21e57a0f4c1060e5f
SHA512990c7c147e96d3aabebfade4010c80be4cd6446e6c9d57014165fa656e53e77adf825f2a6e8bd9a4dcb2781b1f06e232497b89e58488172c7de39ee44c3c2fea
-
Filesize
5KB
MD53ea1a52c5d10f4d10a459596ef8184f6
SHA163221b3f37821310e70d84517cc7762e6e92753f
SHA25671c620ffec1f71c4c352a6fac96c743fdcfca092d5390df5449348777096b202
SHA512391f65195220db19045cb79e42ff4a12e3b70245fe004c83e4ac53eee6f4726f5918d8a5bbca05b3bda24a6fc2766847f9cff032a4a140d420e3df9a44510b2a
-
Filesize
5KB
MD5dae6c0ac8047211ef13051a9cdcc08db
SHA1632206b67126cadce2e62940daf8e7472d3d35b8
SHA25665d63fdc35a8910690590f0f732f801747e1a169c68eab8353fdbad3d68b16c3
SHA5126e9e29b6a1f972be3c537073c24688b43ee1057a5bd2e3158dd7bb6a79fdca1700a8d9d5c5f0537081627080ed144973b570e164fe6b6ca5690884a94968db9c
-
Filesize
5KB
MD50175ec28f1fd63dd84a4eb6d5fe81936
SHA1ef9ee4d486f043c3023563f900679b369368e92a
SHA2567bf8d2f51fdad70a9a658506277127967f382016d822bbbbc582431d51c6fc88
SHA512367fa63568a04161eb63f9a0f454008b26deaa544e4d7bfcbdd19f4134951e9d6c0d13b2f0ccf2dbe65430422a417c00a6c658cb61b384b8b679e9c1bd9551d3
-
Filesize
5KB
MD5ad020a7ed523f8b6b79d8f3bcfb9e558
SHA15ef51989010b0a9134a8657e043ad7f600c12073
SHA25684379d12b0873a5720a5d8bf2ce43a9053a094669d8c51181f1ea45520e78d72
SHA512aaf81a1ca5bd5cc44210371c7fb86b5ad882f02a53122913d160674d370b38fb3f1a8bd529e99070050e8e71b7b9458feefb49ece9a7b9730c117d2c4f5c6034
-
Filesize
5KB
MD56cf064b3414c029dbc2695bfcaa7e381
SHA15ac060da7314d946933663fcea9e897898c298b4
SHA256f7b52985c0d3643d3d1c74e2c3696a798a14e59bb85bb882f5d827bc6e5a8c1f
SHA51274e25a1ce82e2bf7c3338b87ce4340c9f3af7a87176703e18b0184172c60ea91a03b8819a502cc2681dc50e53f19c4d88c3de464c17b28032e3d23d1d1b0683c
-
Filesize
5KB
MD574b2c67389dad151f3c222c875dcf310
SHA128860e585a9dce1fb35799b536647f7a2e081a26
SHA2565eb3a1e62c2e2ebe3177a7218ca58fc3ef8d265b06d6abac78bb64b3a1783301
SHA512f26f2a4f573e95fc85d491af6627381ab1ff4022abfd42d80199c9f2ec69a2c9a5695b4ff8a2b3189f23092a4031f65066169eec67cc78b7208fb7c76fbb7f5a
-
Filesize
5KB
MD508efc4c87931e89e8f93c860c0e61664
SHA1044b25ee4cbc6ac25dcfcb31443d308d39a1fa16
SHA25613828971039f0411bb7160e86f642457c5795bd357949c7a2921a92e07cfdbfd
SHA512b0c8ecfe8f637cf5b065d2230d17e310087c4ae823f540c353d08959d07bc63b963af81af11c409305a59dbef90506699ed03e47d8eda144548e619d3da9c7fb
-
Filesize
5KB
MD5c0d1ffa15b0745d03768e5cb962782a9
SHA159d397d65832da457dd0cc009b2afac76d649c3e
SHA256f6100eecae4d4c11038533717f5927e37282519d1542083a815f78afeee27c28
SHA512862709268de39d3a839bb95a009adc7f5da3a709965faa4af680fedac7e644398b9a7cf682da111ce506b19a0a81c127dacb1ab8f6b7f1539463d795f62600be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a8488fdb-f5e4-40e4-8d04-2f2cd9a5ec4a.tmp
Filesize5KB
MD5024f7256871cf51a0ffad5b95c34951a
SHA13c54593d23839d73dd838dcb471a8b3b61a2751a
SHA256e599a25fecb9a3f2b9eef055435a2da71b11abfaaaa8546bb51f4bf9076a2ae6
SHA512f491eece71b0877768b2af435e6502dcaccd96a761f50afc2bc700c910d2ac5ed8ffb00c5cf3932614c11f699cf387d5646283e804a6c85690760c1f5290d53a
-
Filesize
7KB
MD577b2cc61f6c6e3c6fb483203c21119ca
SHA18bc713ff522b989521844580828442da045b4970
SHA25625bf57b6492e0e06cd3a64a826ea7ab7bcae024bc68283062d8fa40d02449693
SHA51287bc748ebb020aa33c0544a1a01ca9f0a9af5b8230565b57c9efb865c4962a756c44f72b682d27281b11b67d3c2052f267a15f56c75949ab1395cdc7487c1738
-
Filesize
7KB
MD5d74173522969f77402a3366ed0885920
SHA1893738e2f4ab3c9f60b13780fe7eb074c13ec414
SHA256077b94b50114975be0056433116760d7ab4b4f5e6aca7df3301bcda762a6a2ce
SHA51282fa0d602d0d86c526b3a4a83da9e67daaaa9bc68025f955e62d2a15588374a039b646be1c8eef8a497d79f6a5635c3faedde2dbd184ae1e606a96f6b915e189
-
Filesize
8KB
MD5617456662b36330266f26cbd2536094d
SHA1b7af4acb020482e57493aaaf1428b1ef20e89898
SHA25649b77599fd6df80f7014f8e492b4a82c8a799af0e7b94425c7ffcb844a3cff1c
SHA5129efb4c90e17c22c454962fc4dfec3c8a183079ffa1293fd3b990fe78e3e22ed8a4175823ca0fae392b6e76e9fcf15224fe23d9a18e73150b0778ce2fdb212afc
-
Filesize
8KB
MD55b5f156330b44e75aeacc03a8eff239b
SHA15b9c810c9440b40eb84b11f9313bf4fbda20c59e
SHA25631861590a677216b1fc602592cb037509618b5bc73da8f243dcfdab02a6494fe
SHA51294a908ef6cab043f68c9833a232410520f663bfda4deb8850aefb4eb3c2bb85f2e07a95e6b7bda715530068286d70becb900289caac0a9f355e89dc4f7f2d253
-
Filesize
16KB
MD524be10405afd4232890002c67276b7ca
SHA14af9b8fdfda6f80bdd7636e3914459fad9a4f2e1
SHA25624027ea6f76ad1b882792858a851912b3f38349af184e837becbaa00061a1404
SHA512a43f0b886f033b7345c787157554f8112dbd1b448e55d9b5f9f1be9d54f6125bda432c6ac5936cbe60276f74250ea4605324b3a0244aadf863b911e2037000f8
-
Filesize
260KB
MD537d654c30fe1f183076a77ab2bcf7489
SHA1defa9bd5fc3881c30ef1ccede8504e289d771e42
SHA256af13d9b5d58d38dda45b73ebdd5ee18294ea4d75085ab7e4cd14b3cd8346b4c9
SHA5122bb317052f24b7c0aa585769e33895b3dcf1b82043ae2a394f6612264b3a3922f6d055087f9a73a83461259193b0c74a55250c6ea65cfff5e15e89a40629f98f
-
Filesize
104KB
MD5b63131f6c2cafa8ec03842e2e07df762
SHA19346ae709528ca0ee9de88911aa0273ba68efcb6
SHA2568dcfab8520ddb6da2ee4ea4df4b9746dc7df4d1140294f4dd69f945bcc0f5c53
SHA512d99e3df1e64fd8ab5340f3a669a32092b673ba36c29b328bd529fafb267c41b2324628017a7a6a98b0249a7f75ce481b8fee9bd7ae356f20ee9d65306202e8de
-
Filesize
90KB
MD5bea36d24d8ee9fee751cfc07bfd84ba8
SHA19d19e72cb664667fe21c57679631e8f4e483a144
SHA256dc4c5517ebbe844098d0aeedd7ce7f81746ba640c0343c7d01a458cc5be4a6c2
SHA51233e9ce7ce02221ff2bcb3f018736a5954204bed8683ff2f4eb4843ff94e82435ebf5749e9d9909a9def74afb3c32fd4c1f94c19e4df357ebd7f8ae4371c99d43
-
Filesize
93KB
MD55f0fd1aa4f88e30265d22db8a821b3e0
SHA10d1f86d4f17870ce853918a481abec4312a2f783
SHA2565b0315144afb4f8f687653ede0080fd76dec456c27d7ed4e251da2fac22900ee
SHA512dd94abbe59baae773b7807fc5b1eda7f15b0d28e64b9cb0875deee79ab64ddc82329289c06b5d8a2251bb039c6ce9b82c8bdba432891261090f543cdb5828497
-
Filesize
107KB
MD5048258c8845fda047b3f01d1d73ba143
SHA1ff3ec6765cc74150d55417e530cf14e1cb388892
SHA2568af0a6a0b062f5d95af0b341106a9d7364695b9aae25d19b43518eaf1a7dc51f
SHA512d782eea14eb73f70670e90bd1191353d382f7bf45a5e10eca1c3e089b0170eab476c3b67b8470c54f5c6896cc4624e86b71ab6a3a00f7983699797664c3297a5
-
Filesize
89KB
MD5edbcb0ad54907c1dfe388d705f3864b4
SHA1c2ed92b0cbfbffa7c127bf02cb153b85737b345b
SHA25679ad84e18e7e878270abbedf78875aacf7a2b45d8b96ae1615e11ae81f555ea0
SHA51235bf96e33e6e997988dc4e045e77afece3a1e2b632448f15b59b894cda090bbe406e841f1cdb05e4933d9f2c676c839cd5211c03bc6839631489b8ad8d9e19d5
-
Filesize
5.7MB
MD5de55b55ef62fb1b17eb3c103f4fc0cef
SHA137dd8656942325f787227b65fc829508d48723a8
SHA25662f90bf759c32cd1d916627a4456b547a90641e7e94e3cbb2be6ff2033275f0b
SHA5127c312975a4825ddaaea32ffd48a80a5216a2a385c4556811a16accceee743122c396a41fd5a5b442689603ddbd4a3d0806c29f4e1b251fa824b9fb69abcf81b6
-
Filesize
488KB
MD5851fee9a41856b588847cf8272645f58
SHA1ee185a1ff257c86eb19d30a191bf0695d5ac72a1
SHA2565e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
SHA512cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
-
Filesize
43KB
MD534ec990ed346ec6a4f14841b12280c20
SHA16587164274a1ae7f47bdb9d71d066b83241576f0
SHA2561e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
SHA512b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
-
Filesize
139B
MD5d0104f79f0b4f03bbcd3b287fa04cf8c
SHA154f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA256997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
SHA512daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
-
Filesize
43B
MD5c28b0fe9be6e306cc2ad30fe00e3db10
SHA1af79c81bd61c9a937fca18425dd84cdf8317c8b9
SHA2560694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
SHA512e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9
-
Filesize
216B
MD5c2ab942102236f987048d0d84d73d960
SHA195462172699187ac02eaec6074024b26e6d71cff
SHA256948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
SHA512e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
-
Filesize
1KB
MD513babc4f212ce635d68da544339c962b
SHA14881ad2ec8eb2470a7049421047c6d076f48f1de
SHA256bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400
SHA51240e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182
-
Filesize
133KB
MD5a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1dd109ac34beb8289030e4ec0a026297b793f64a3
SHA25679d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
SHA5122a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
4.2MB
MD5114498719219c2427758b1ad9a11a991
SHA1742896c8ec63ddbf15bab5c1011eff512b9af722
SHA256913059869dca00dfa49bcf2691b384eb9804739d9148e3671cf1d6b89c828c42
SHA5124f36ea0c5e8af8087ecf92fa49e157dcc94a1cc68563fc97b3fe026b92c0abdbe640bf347c24a666f59b60380367f85daab1a15e2c4902921e63e1b741c01452
-
Filesize
85KB
MD55e1bc1ad542dc2295d546d25142d9629
SHA1dd697d1faceee724b5b6ae746116e228fe202d98
SHA2569cc1a5b9fd49158f5cca4b28475a518cb60330e0cad98539d2a56d9930bdf9f9
SHA512dc9dbecec37e47dd756cd00517f1bfe5b27832bd43c77f365defc649922cb7967eb7e5de76d79478b6ebfd99a1cc2e7e6b5119a05a42fd51a1c091b6f00f2456
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Filesize8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Filesize264KB
MD517bd7672040db656308d76d6e66a3095
SHA18ed1945d141244a8807a94d78f9150f4a311a31f
SHA25673c89191d5808f65ddf660bff7827dd0aaa68747418749c5f2835bb824a0e665
SHA512c3c8fdb9212f7187715454a64f4888f8cbe4805b8d0f754875fc11d623df27976c62eb58c64f35399d6e63d3094262ab9169c0255653d177feced62d8d6aa0b0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Filesize8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Filesize8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
522KB
MD5e31f5136d91bad0fcbce053aac798a30
SHA1ee785d2546aec4803bcae08cdebfd5d168c42337
SHA256ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671
SHA512a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6
-
Filesize
99KB
MD57a2b8cfcd543f6e4ebca43162b67d610
SHA1c1c45a326249bf0ccd2be2fbd412f1a62fb67024
SHA2567d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
SHA512e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8
-
Filesize
113KB
MD575365924730b0b2c1a6ee9028ef07685
SHA1a10687c37deb2ce5422140b541a64ac15534250f
SHA256945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b
SHA512c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
5.4MB
MD51f1ae0eb12231c472e7ab91a6df69b75
SHA13c0b44b3b18df2b9be602b551828b27604ef51fe
SHA2564f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60
SHA512470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e