hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqa3p2TFhGdElIcXZzYVNzMUlSTXJSbGtMUnVXUXxBQ3Jtc0tucDA5eXQzcEJrWTk0ZWx3RHEyR1duNWt0Y3NVRk1fNlNaQVgzNlhWTlBiZ211WmVtLVpYYXAtVl9FMEZBcGstd2ZIZjlRc1RxWFRtcmE0Wi1WWS1vY1ZZRWl1NzVnYW13NXVfRGtKcmFWV0YxVndPNA&q=https%3A%2F%2Furl[.]rw%2FSolara%2F&v=61zG-NiPfZw

Analysis

max time kernel
450s
max time network
450s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/08/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3p2TFhGdElIcXZzYVNzMUlSTXJSbGtMUnVXUXxBQ3Jtc0tucDA5eXQzcEJrWTk0ZWx3RHEyR1duNWt0Y3NVRk1fNlNaQVgzNlhWTlBiZ211WmVtLVpYYXAtVl9FMEZBcGstd2ZIZjlRc1RxWFRtcmE0Wi1WWS1vY1ZZRWl1NzVnYW13NXVfRGtKcmFWV0YxVndPNA&q=https%3A%2F%2Furl.rw%2FSolara%2F&v=61zG-NiPfZw

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 20 IoCs

pid	Process
432	RobloxPlayerInstaller.exe
4892	MicrosoftEdgeWebview2Setup.exe
3132	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdate.exe
2080	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdateComRegisterShell64.exe
576	MicrosoftEdgeUpdateComRegisterShell64.exe
3596	MicrosoftEdgeUpdateComRegisterShell64.exe
872	MicrosoftEdgeUpdate.exe
988	MicrosoftEdgeUpdate.exe
3380	MicrosoftEdgeUpdate.exe
2856	MicrosoftEdgeUpdate.exe
1872	MicrosoftEdge_X64_127.0.2651.86.exe
4876	setup.exe
1396	setup.exe
4492	MicrosoftEdgeUpdate.exe
1792	RobloxPlayerBeta.exe
2308	winrar-x64-701.exe
2068	RobloxPlayerBeta.exe
3012	winrar-x64-701.exe

Loads dropped DLL 18 IoCs

pid	Process
3132	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdate.exe
2080	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdateComRegisterShell64.exe
2080	MicrosoftEdgeUpdate.exe
576	MicrosoftEdgeUpdateComRegisterShell64.exe
2080	MicrosoftEdgeUpdate.exe
3596	MicrosoftEdgeUpdateComRegisterShell64.exe
2080	MicrosoftEdgeUpdate.exe
872	MicrosoftEdgeUpdate.exe
988	MicrosoftEdgeUpdate.exe
3380	MicrosoftEdgeUpdate.exe
3380	MicrosoftEdgeUpdate.exe
988	MicrosoftEdgeUpdate.exe
2856	MicrosoftEdgeUpdate.exe
4492	MicrosoftEdgeUpdate.exe
1792	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1792	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AvatarImporter\img_dark_RthroNarrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InspectMenu\ico_favorite_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\Radial\Backpack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\Roboto-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\btn_newGrey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\unlocked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-84x84.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\TopBar\dropshadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\af.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\unification\CollisionHead.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\avatar\unification\humanoidClassicAnimateDefaultChildren.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\Cursors\KeyboardMouse\IBeamCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioUIEditor\icon_rotate7.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\as.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\AvatarExperience\SelectionRing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AudioPreview\pause_hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\PlayerList\StarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Settings\ShareGame\icons.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\Merriweather-Italic.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TagEditor\VisibilityOffLightTheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Chat\MessageCounter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerInstaller.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\graphic\Auth\qqlogo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ManageCollaborators\closeWidget_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\sliderbar_grey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Menu\hoverPopupRight.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\kn.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AvatarEditorImages\gr-selection-border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\MaterialManager\All.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\CenterPlus.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\fonts\families\HighwayGothic.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\R15Migrator\ic-blue-arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\PlatformContent\pc\textures\water\normal_10.dds	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\AnimationEditor\button_collapse.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_da.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\Menu\buttonBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\StudioToolbox\alert-icon-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\TerrainTools\mt_regions.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\content\textures\CompositorDebugger\clip.png	RobloxPlayerInstaller.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4492	MicrosoftEdgeUpdate.exe
872	MicrosoftEdgeUpdate.exe
2856	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675327461607407"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-01a570a3cd0a46f2\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ezWwTYmb9tEG.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3780	chrome.exe
3780	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
432	RobloxPlayerInstaller.exe
432	RobloxPlayerInstaller.exe
3132	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
1792	RobloxPlayerBeta.exe
1792	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2308	winrar-x64-701.exe
2308	winrar-x64-701.exe
2308	winrar-x64-701.exe
956	MiniSearchHost.exe
3012	winrar-x64-701.exe
3012	winrar-x64-701.exe
3012	winrar-x64-701.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1792	RobloxPlayerBeta.exe
2068	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4688	3780	chrome.exe	77
PID 3780 wrote to memory of 4688	3780	chrome.exe	77
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 2992	3780	chrome.exe	78
PID 3780 wrote to memory of 1948	3780	chrome.exe	79
PID 3780 wrote to memory of 1948	3780	chrome.exe	79
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80
PID 3780 wrote to memory of 1424	3780	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3p2TFhGdElIcXZzYVNzMUlSTXJSbGtMUnVXUXxBQ3Jtc0tucDA5eXQzcEJrWTk0ZWx3RHEyR1duNWt0Y3NVRk1fNlNaQVgzNlhWTlBiZ211WmVtLVpYYXAtVl9FMEZBcGstd2ZIZjlRc1RxWFRtcmE0Wi1WWS1vY1ZZRWl1NzVnYW13NXVfRGtKcmFWV0YxVndPNA&q=https%3A%2F%2Furl.rw%2FSolara%2F&v=61zG-NiPfZw
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed1facc40,0x7ffed1facc4c,0x7ffed1facc58
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2140 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4488,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4552,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3548,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4896,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5176,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5192,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4936,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3252,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5184,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5520,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5564,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5804,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4280,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3276,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5500,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6644,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6484,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5508,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6280,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7044,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=4712,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3944,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6448,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3436,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1308
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6340,i,8026733814780512709,15323464427786185659,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:co8a7ocYSe8UiaW0rsZkSQH0wQGF-Hmv_hkV1NwEFw5iKL6t_4ZVkRe5WrxtfZ-3hTwb4qVL0D-XIOSdi9N0-M8mR7k-q8Ev3WxSdU-M_V8Y9t5twAdhb8za9xZCvp5-oBrvQtTTfw7xyEobNxWE66nyitD0JCrlkyTIX5NC_BG70BYj3UFxGHnl2ERTlg8wasPS5CZyMpeXLYlzQSOGRwoBOBhI_xG-XTdJyZ403NM+launchtime:1723059272037+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1723059163680001%26placeId%3D17625359962%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dfcbd7f69-fa0a-4958-8d69-47d73215391d%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1723059163680001+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2068

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2104

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:432
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
  MicrosoftEdgeWebview2Setup.exe /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2748
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2080
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:576
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3596
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxNDQwMDYtMDNDQS00ODYyLTg3RjQtMjVFRTA3QkFCQkI2fSIgdXNlcmlkPSJ7RjlBNkMyNDQtODhGMi00NjY0LUIyRUMtRDcxQkM5ODQyNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0NEFCMjQyNC1ENDBFLTQ2REItOTRFMy1GMEQ0MEZBQkFCQ0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0MDg1NDI1OTMiIGluc3RhbGxfdGltZV9tcz0iNzA4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:872
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{5D144006-03CA-4862-87F4-25EE07BABBB6}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:988
- C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1792

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3380
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxNDQwMDYtMDNDQS00ODYyLTg3RjQtMjVFRTA3QkFCQkI2fSIgdXNlcmlkPSJ7RjlBNkMyNDQtODhGMi00NjY0LUIyRUMtRDcxQkM5ODQyNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntENUY3NkI5Qy02QkYwLTQ2OEYtOENFMy00MUM1MkFDNEFBMTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQxMzAxMjMyOSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2856
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\EDGEMITMP_EB694.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\EDGEMITMP_EB694.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:4876
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\EDGEMITMP_EB694.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\EDGEMITMP_EB694.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EE625D19-236B-4809-BED9-786AE712CBC4}\EDGEMITMP_EB694.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e73cb7d0,0x7ff6e73cb7dc,0x7ff6e73cb7e8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1396
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxNDQwMDYtMDNDQS00ODYyLTg3RjQtMjVFRTA3QkFCQkI2fSIgdXNlcmlkPSJ7RjlBNkMyNDQtODhGMi00NjY0LUIyRUMtRDcxQkM5ODQyNTY2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCMUREMzZBMy02MDMzLTQ2RUEtOEQ1Qi0xNzQ2MzYyREM3Njh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjg2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDI4MzUyNzAzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQyODQyMjUyNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2Mzk1MzkwOTQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2IyMzVmYzNhLTg2YmYtNDIwZi1iMWJjLTZjNjdhM2E5NTg4OT9QMT0xNzIzNjY0MTIxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUtBJTJiWjQlMmY5YWJqY2ZlT1QycU8xbGVrSllYem9GeWZPJTJiSEhVOTdXUFgyVXQ4dGJMNSUyYlAwaEE1TFdqeG1qWDNtJTJiZndtNVd1TENHWG9XaEVRQ1lMRTQxZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgZG93bmxvYWRfdGltZV9tcz0iMTQ0OTkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NjM5Njk1Mjc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjY1MzY4MjE0NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzA4Mzc0Mjg4NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjExMjQiIGRvd25sb2FkX3RpbWVfbXM9IjIxMTIwIiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzMDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4492

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\8360a9a2347a4cb2ac64107c1697c295 /t 3012 /p 2308
1⤵
PID:2892

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:956

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
d45f2d476ed78fa3e30f16e11c1c61ea

SHA1
8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

SHA256
acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

SHA512
2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7c66526dc65de144f3444556c3dba7b8

SHA1
6721a1f45ac779e82eecc9a584bcf4bcee365940

SHA256
e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

SHA512
dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
b534e068001e8729faf212ad3c0da16c

SHA1
999fa33c5ea856d305cc359c18ea8e994a83f7a9

SHA256
445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

SHA512
e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
64c47a66830992f0bdfd05036a290498

SHA1
88b1b8faa511ee9f4a0e944a0289db48a8680640

SHA256
a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

SHA512
426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
3b8a5301c4cf21b439953c97bd3c441c

SHA1
8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

SHA256
abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

SHA512
068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
c90f33303c5bd706776e90c12aefabee

SHA1
1965550fe34b68ea37a24c8708eef1a0d561fb11

SHA256
e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

SHA512
b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3A4B.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
84a1cea9a31be831155aa1e12518e446

SHA1
670f4edd4dc8df97af8925f56241375757afb3da

SHA256
e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

SHA512
5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
24591f85e9569269a3b822d0da2e0626

SHA1
62641ade4943b93983b4e59ffd6ee4dcbd77c17e

SHA256
d29bcf294dd77568fd173adac8c705d991482d645127baccb7efca20f560a5a2

SHA512
d0bfe43ece2c598a12fe7d3f2cd12e0685b639aec0fc7a1bbdf0829b886c22208e4236500d8e6540d7faef1514769b87bbdc666602c5548649e50aa61f2077de

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-01a570a3cd0a46f2\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
1732ef0d35ad3207a56114d20c824b40

SHA1
9ef75a3814c60c6b4bf8093834cb948fb9d5a8c7

SHA256
3a245f5ec468d4fbedd8598df01f7519f3be6ee7bc78638eab5961505e9c5353

SHA512
f7a48442d4852e46c984970dd565ae6794ffd9df16e1ebb5d6bf97a3fc3653841d3fdd52ae35013380ab76c0a1c38d1cdc1e140570b73c8df621d5e4f3186524

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c1797c7-1dd8-48ed-8652-edee15f45ddc.tmp

Filesize
10KB

MD5
9b77c2e23f0cc496d1bbb866e27e00f3

SHA1
6e45b7c536405a986b0585fc230df7b398da5a8d

SHA256
669fa44a5730457f0125a5732346c5cc3cb8d612fbe50de7dfd0cb1f37bbf860

SHA512
e87c67ea638176dbaf437fb9c710a47a15ad83c4db44776b3b210d47b63497f5cee141bb6f041877bc065b6cf4b4b23f34979d8be56c6c6736f6942e34e64b59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d5

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
1b6e2c44a0a23109befa9302c9287b09

SHA1
bc3a1df4eb05587aa8142cc9f287b5da8f378e80

SHA256
5e6a8037280331ed10e301711584e31a429852e46ad526a98ebd8d0aa34deba4

SHA512
624e53a2b802bcf9fe1c2251f6443fb6f6dad7d7b15047c636bcdd0ccb46259b1019f77d43ca9c46ff330ccda30ab0fc33d6594f6fda1deb35fbcc3f5f907237

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
84c2d7a0f147b1b90e820a7c89689fab

SHA1
14a38b932256ab4b7753911fdcdf5a2de72988a9

SHA256
416dc04d1d74f7c515505f8ac12377cc43e1f5a53f9c7010018aea24f6e156c7

SHA512
d4c74d39c3959787dac499898296836381861fd11b7d47b621b3a69051fba980242bc9b137e5d4d9638ed543ddbc678e570c165278c3bd4e38bf49433cde7571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ceb1a44a6085dc3aebe2a04a95288ff3

SHA1
5a6fe104d27288725e4932982ade7c53f4283683

SHA256
84bd19a431a363ee191f7643bcd950ed385c42b138912ecd780ebc84bd082b3d

SHA512
d1ab36ddb5288ff17c29d26c389f5b68a16fc14025b99cd06507996f5dc09cbeb56b606ae862066e48e9cd27d75889b2af62d8f155d870be32d9c980369ea572

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
d0bb16540c28b5018063e98a4298a2f4

SHA1
ef9644d22911ab4804c96ab8eb263f54a5a7fc13

SHA256
c150de96601a36c9e07f391936730c847161f8fdb05bdfbe1d2ae18be67f4266

SHA512
c362343154c9d7fe4cd97dcb2b49849591d4ed67b00565e4857b1f377eafe1db4ceb6db8815a36bcf1573400e8777f8d3621107f08360b63fafbf54ea8572771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
411e96ee0c510b244820468276430436

SHA1
56d9d148d0c93efae06ae2e18c66b7813967ce62

SHA256
155b2c44e5923910e1f418deded0a45a1250f47aa5d56f40153224bdcecf1572

SHA512
55a9a38c63338251c837398a4067822b66d99be51a4cd0a357842d27b84aed18cb195d68948752eedd0a5686d94870744f04977923d7dfd48bf9857db3e2e19e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
bd40bee7b7e0e9f7faab1d889d089ec8

SHA1
658ed1c7702dde50c818d3105af1e76106f68c07

SHA256
046cb26f827cb1635c0171a7a8260ac0a1c1d4a830e9899b0292732bc7169d14

SHA512
03d5ae7d11100779b35f371be55cef425cbf49ea25990abe11b80705345e72a7ad3ffa53d6b5ad06fae2218a696e515db906f30384e3f212407c2d54d8375147

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe597303.TMP

Filesize
510B

MD5
9f90306c73a71ac7b48ee24b4795a04e

SHA1
cf79bcce056c5450c8c540c3daa1c107a4647e51

SHA256
f59a1edcbc62a7de4949a7a068ea565c69047dcfc7ed7e5fbe8aefaf7319de6e

SHA512
a1f2748da59fde7d4551e78777c5d3a0fac7567c32a60b84c43503b6fc004dc1e1e905fb0b403b27f5f089f826c2e21d75dae10bc252e5b96568711372a9ebc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
9a8fa2ae64e7a22664f8d8072fc7fea0

SHA1
fcd3cbe6663991fc79b8477315a13589daa69a40

SHA256
fe03be7501e5302dff2e1c974b5c143b34d0506b523d5d6e3c9960296fa9cc64

SHA512
61e0afee8bdfc2ee9b90e3fb1ddab5cde9d4fefedd37ce4e536b75ec8ab26d96fa5cd61e79d0d104c2e9a444997519111999f34448f0c10bea32f665f9d42a34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
9cc63ecfb7a1dbcef4203f2391318530

SHA1
8adfa422e7f180078bcc54458526ad086958655e

SHA256
94511b95c5cf5cc2297ca62ec0645f8321743b4240b6871134e5c6f761126bcd

SHA512
0f6c93181a0cada8968fc2504677d5ec07003344c8f762c13cded9f3bcd22ddca4ad2e9207837ac1ec46b0ad5de4253e78c64110fa5d85f8f4b55b336a633209

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
534b10fddf9b22b05c38353f5a6fa385

SHA1
bcd0a4940ccce9ed6f1bed82c535e33e8c5cbc41

SHA256
b6e894437f3fe3092465cde82e90daefe8e06e3c8419b9ffadcafdc4d3a485e9

SHA512
923cf7a2fde1cce8b2b082f1385abaeede770d9429e93bdefbff93be9bcd796c49d98af0f694e20728ba3c6e3563fc60bc6f4bb1afd2df1550052bc2cf0b0cef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
89cd17b7b4eb65c467de39a774a100c1

SHA1
d5d9b7b418753fc34fa3ff02aa74f5bd54839edd

SHA256
133e806bf333b54ea136733bfc52651426f45200d9fc4ba3472cfdeb8c42b157

SHA512
fb68d021fef463646cae100a2f292315c8c893655d11081f101bd8c9a1e4fcfa505eaa2f05654074192be0801255614930ba810dbd5a00f152f532d7dd7f751b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
02e33530fac3a46cb44cf99af54078ab

SHA1
211647c117c385e79d421cf5acd72af4458d7678

SHA256
4571c4f630e780ccf087e97d3959795ae4f9cce13fc00fe2af83ae7d00cacc13

SHA512
3ee003604a8fd10ae9a01c676411e6eba69d00e052fd8634338b150c2c66250b9f4a01926c87239320f80f0c540213a70201a65d53eb599fc7f0e3e178fbe341

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
07c6857b788eba47cd42f2eda4d8170e

SHA1
700bd899e1629e2664f922e4a598034f42d9ff76

SHA256
6f22e6cfa6ad4b51704606015398e8a85df6ced73966aad41da8033a2cbb5c4e

SHA512
213bdba79fa5633ce93f0b61e01620d3ac2a949bc1d8d634b08d582e0f2f4af52cc0ad5d343ab2bb6d1fc259eb2f9716bbe087f16a4481d8619de2a5677d02c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
51cb0282bcdbc0e6de96bde823971b00

SHA1
fe6224c1d182eebea7802519b73f223f8253c052

SHA256
8d724ab59e6cea2c105f78178f23bf3fea200844f06d273269ccc3651771ff68

SHA512
b12f50d9e966b8555b6d09244b4c2bebbf4e59602cb31b6ced7c71b3808773e4ad7c7f1781abeac6f062f90e380351f09ead85222517a9401f75967e2490f927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
dd876da4f155c33b51b6d3eb49b359ed

SHA1
877cf03f3944f8d1f10f4698b1ea3bf46fa31a33

SHA256
6d59e42dd2e44677d4cba072a91a330da535f1872d7a1a7288441d86c0599f6a

SHA512
e2bf4f33f85f16f8e0a0d48a98c2d5dabdbe964a8570b8094a72cd2e21c3ff49cf1603c0a9a2a2a8b0ea1de4f20a929f0ace040eb0b2720053db67aeadba7ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
74f276ecf12e433086d6a0863b048fac

SHA1
d0dc2ab86b40fa63da1ab086bcbe369a9331304b

SHA256
5a9b79844babef612e2ed15a112c491d71eb2f6167620c5d76ac8127986668ef

SHA512
d065dd87be6a04c6d1c36675c99c273091e4673c3a867353dee5e2e3b1b0004ba4d60618f442890b6ad66917b6be0c575a1ea797ff91722680ae0a3a62ed103f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
5bcf41587086b7e9cf6457e65814fcdc

SHA1
2804375500ce3bfbf24dd3b5669bb04eaf585c1c

SHA256
6deb0b2541aac8a696583b2bbdf93a5d67a659f0cfd4aede26c4d75a8d214660

SHA512
9ca9dc3338d0f8df91f6601e01d124b883dcaaf554b3400de32d9ea5e262856cdf4e6f43b2be41453e86318f26eed7db56450ee2dfba71e8b3029ea1fb07bf70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
221be240cbc48175a24e550bdf939a25

SHA1
479d19d893cfda4b42c0caa93db684582e910494

SHA256
8f80cfaf1c0fe281df4d49cab8888154b5fc922dd45d7aee5099c12e0630e547

SHA512
04238b363063d96f27bd5628ec38df16d0221aead45f4015d19a9d65977233d7d5590d55b6e3b51b67764a50d8fc84ac05a30031f9e96ab4df554dab37a9c557

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
d1b09b4640fe3f99f5178d5d62681084

SHA1
1d96e34b3791bccb7168de1985090a43f2358e8e

SHA256
d608b1431231db2e7f14de4584169f335093b4ef887a41b9b8e50ae2f4576fa7

SHA512
6a0387a692df3a68e0a2424801efc40d9f9d92a6cc7e49c194dcaaae5aa59bf0fcedb05d6126357c1c49b1020126e722ec13b830144b66bc2062906cc060aff2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
5c726ccd598dfa937066076b2d810c44

SHA1
f1ccaa979727566b45a6f69f8129ba66bae801fc

SHA256
3b53292635138a5d6a7f6692f606ec3bec45672542fd87894023c0764944e52b

SHA512
8aeab9a74ab0f1bf2281c79f7a091924d96d0a60659c95ba6be7c855889b129447fa1e8123854654a97e06b280d8e041ae44d5dc4c1e6381dedf3d9513dd8360

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
754e2cb066b2470b1a188119748bd590

SHA1
3b1b5c0ab963d4654c40d98b5c9d2ce30e575669

SHA256
85a34ed2fbd462a5093bbd38fea0737f423134a59d9ea5b63483939c8b06a3d5

SHA512
2d0dc71c508518979726154b3850e6adfc525c62d81ec0249b6093237f27a4b9599e894af66314b1135b353151bbc4152b076cbba40e2fbfec5ce0f368be2bb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
006ca02a76c80a3b9cc9c612cc890964

SHA1
e3c086b887eebb29730be973ccae2973ae9d8f06

SHA256
d42d2e87c8cd6ab68cbe043eec2ce3ec3d1233b10f477aa979678c763417d0b8

SHA512
3431233456ff7b2cc9360a85c96b9572479ded639dc8b23181b4a250e02a253813cd06aa5de3ccea9b35b4e0fb532d0f055bd9cee2a5aed097f31b89e9aa8e5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
54104eb05b54852e5696b0d95c9ba1b4

SHA1
52b7f673ded670c22a3a73b07316908df6833c82

SHA256
9f4605aca6a218aa9463ceaa3068f42b0f508dee4703419cc9a4b2c1463bc8ee

SHA512
35a4f5d187361e7e5e2ceb5a343e4746dda794c2b1370e5512c9793b6df36c8f2a1206f9dc312e72c7960201422703fdb88da4960aa9368a00146c0e688b064c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
3387b3e8e0e6f0209b107644edccdaf9

SHA1
db4035695a41b2c3c32ed4a273800a960d3425ca

SHA256
3b90692e989bc1895d3e2bf88d6673997acb3a2a59904ffbdc2d0c27aaefb19b

SHA512
d97aa7c868bf931c2a3350a506cca5d327cf67d019eda96ff5ebfa8abd7bf38b71dc64473fef0d1872f49ab8698c71e0aa2a4a83877e0ed96745d2698911651b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
b6f91878fe21ff37e7ec0d7b1c18460e

SHA1
481b3794325023f1e2ffc9f70c5186e8cfc532eb

SHA256
60eae525d0487176c543f98b71a6a669ea769c12937f8d1c583c0d20a459a9af

SHA512
ad510fa2503c70c01a4765781817c0d83f9e7d1a60e05ee877ab615fd23090fdf30cc2a739e9fc80717db2e1d0539a04851d83888227aafef60d2d9bef91ac94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
d0fc0307b544da089e2a826cccaff011

SHA1
50ad886cef21bf21154900ff503b896465d375ee

SHA256
1a52ea428ad3cd54d6fd83530d7fd1840b08fa37488f1bf88f45e1553f7416b8

SHA512
edcb0872e170ac3dbb21a76ee878aedd1d828ba6f4442969fc7928ac0b07d6957fbac268d67be0e7371e5ca00767c1c154ee904755d5411c9c9f1e9303f6012b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
1109d47f148d98fd13ca760ffa8c5b74

SHA1
47ac0a33cc81c86ab2cae7273fd98d6425cd1f7a

SHA256
89436fc60e9cd48c57c856e90fdf6bcb696bd5d82db31537b8d411589133f7c8

SHA512
3f3210d4d8131a6c58815c1ed477ea289b20e160f8316b06e19c245cebcd50ef0a62d3e92cc1e5fc69e5c3a9c9c5f9c2f8af532e4e5875e52a589ef9a503c531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
2d4ec4b095c3ab24e5e9b028bc060166

SHA1
9dd1bd5d092c3959241046a2732f9d5933e21760

SHA256
940103ab75161a62829653ad1a78e81e1b256835c562a48c0d7529b6cf5b1121

SHA512
71107d48a4f1de26aa3e9fc660db39502d697320f227cda55e19a211df07cf6c24f7b7880cb1d91f63495a414c73ccb61b609da8bfee15be114e90a3863de318

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
f7708fd412a68ad03d4145b535070982

SHA1
57dda443c5a25cfc1f42c5e72b4c34a7f36499bc

SHA256
6b53927997cc38a405338065fe53d9a4182d09bdfe097c20ef5c7a92071aec96

SHA512
376b6d287f3777448bbb9fdc5a3c8f6ccc8dfd7aeef25cc1d8a8ec7959b5200710dee59458bf2b8b60e6afb9cad461b8b8eef428f77a2b5d7b3c8c94499bfe66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
fbddde2888549d9878272304c0af53c1

SHA1
b5f725f9f8d745b09e1558fb8cb5282f4a1409cd

SHA256
465b1de9fc3be9d2081afb14d8d2cffb1dcae86b3bae0defb0c4c767297f55db

SHA512
30d82cfd4b2e379852deb557c41c8445ab83f6527e1fbd94121ffdd28f15fb1f5e6466a4f688ca6413d6fef73b334bb4f7d4f65526bc6c45248c9ec39563ca36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
cb9bdae64d93ddd22966054f3c49a155

SHA1
36ffa2c63d9625ab1c086f112f56ab757dc3dccb

SHA256
eb7b568ef8206b3bb4c2f7ba680373ef17fe7bb93aee03ed7667e9b56dfd68dc

SHA512
7497d66c97ba5ecb0b1b494eca6c78b8be850aa1219c2b6134af3822083f675d53ce0f6fa7806f80a82c36caae565f7c656107538135a7c78e333bfa339a7ab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
3838130e30ab24a7cfa02ad62ed6441c

SHA1
cae2315760c70c6a14758f55a542a80ea9a721c8

SHA256
20ccced10501e67e06433a1389901a6d13f3b26aa41fc7d9ee9c612a73144d0e

SHA512
01ddba26e0214a1853398500147249e9504fa2e222d96b5d043d886218cf264bd4a09ba625ef849df2ff9a63cab546c094593135c1298b82e7bb2497d0507409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
cff05b60e1b27aeda459c4239299e50d

SHA1
5bfb03d4ae8c77a9cd1526ef8cf487cf4c4e03a5

SHA256
9e9ef6d7592b7f6eb68ee27c47391bd99424e4a74ce6a008e76f771574fb3677

SHA512
76021ce4d1babb863906582c701076d7a4fbd7ac802dcdcae37c3840482b6f5dbb5cacb1a921d3c26784b4641ecbdbc9f15d37c22857e70fb4a1d57565f16962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
6215b10d30c695572f6a6210e6831a52

SHA1
040f8e9d7506a9e052390d7709689d06fbedb7ec

SHA256
beafe63a0ca7c657f31fefdbdfd2c80a85e0bd4af593a112807200b819e7e611

SHA512
b3fb7cca33b9545d384afdd6ba83cda2572d2c226f75cb6a31d572d59bc4a2354550bd18b23f93e4801a306589eb859e19fc7cc243e39ce77828ca4cbe4fa8ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
79a9788e4fa9ff2ac4f715cf45d95b6f

SHA1
6d2caad3a5f39db4198fc90370c9a9a72cedbc66

SHA256
18c25b3ab742d3cec72ff74d443228b185ef513c16e365ae8e94053371df25be

SHA512
cf0cecf8139d31701847c6d72ca002049f85ccb6463d74b027a5006234364182e5f98dfe008de59688810dd8bffe39d4a968a1906c99a77a1de7ab11062ac429

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
09059efc9e8bcdbfb670e4a593c8d7c2

SHA1
5bb75c9f72a33636bc02a6eef48783dacbe4f063

SHA256
a71666e8d9d28eba9c9604657c43d0716f3af8c7e80eb5edeabd785d67ebdee2

SHA512
8f89d33121ca75942d182237a92c0feeca3b0e438911ef4dba5ce277f2a473581a905ad9493228ea850afbd31ac3e0fce11f13d837ce874329ce8a05483874ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
baa5c4b0dc9f2ac892837ef3d3277a96

SHA1
bb1f555b5f3f8280a54bca6686698dfd9f1c1cba

SHA256
15dddf0b9009e44e9b4ddfda01c240382dff0e2e7af0cd0682ae88fac904d08b

SHA512
f4cfce3cab42ba56990f2726c10c5f7a9f420c44a96603e16d8a0e69653df181831f4af3a3588ed6b9c1a9c1ab7ea1c3ed4d544a066bf3c38196a39712b97849

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
919c0cb9b2098e93b20e4a532918c0d0

SHA1
20bd4434fead8c0bff13a24011318d009bddc784

SHA256
183f6513d5f904d04af9d165c2d7be9b4864667e17403c45c0ef46ea7f82befc

SHA512
17278353e09ee03aff29c95534b383f6f5592e383c13e455413027bfd4c0059fc80a2b729dcd69438efd77f04086338a17ff432e0a6a0b7c20735e7ab64f2dd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
a10abab57a7649a3c155645d3a3630ee

SHA1
595291ad17f329a2ff91fed048f863bf91950856

SHA256
f727d38187a52a02f9568226b9226162638c93f86cee366ac25b86a4333bbd0a

SHA512
68bd048f6ad1d05acfdac59ea3826c9ba1d8a0ee2b6103f88eb219c34e8f6e4051217dd103f0e27986dfedc064fc314b2bda0e22c50a9f7c183c5eb990b4d8fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
713002f818edba1ba9d0604c5c807b93

SHA1
d07ae1d02583c2c9a38d589394d0f5344168e0bb

SHA256
f734f2e0bb4f0ebcd4e1c0a4d53074b9782fe7eb10250f9d495bd43461dd270b

SHA512
dbc60e7d3cc010e037874ff58fe28270ae73a9aacb700efe7836824bb512ba8ecf671b19a5bea94822d570e9c1e8fca3c195f6920008f44ac3e1e6172463014b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
a9c5946c1824aafc04a334d724ce37de

SHA1
b8dd88d6cf3a97234a3ebf91cfea6573372706b4

SHA256
1f9ed22d4c57b1733fbe42b559d8183815ff7272544c727db8e8f34118bae284

SHA512
c6499d1f5d6806d7b821def3ffd23d359265bf817be482e8143c6d60d92e91640708ac89cf1c2aa798f5356f04bef4d39d3d0f5f32677ee877a571f471a7e87d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
44dfc760b77ab07bde9014eb6e425f14

SHA1
c55b2427eba1d8793ce5687f83a31e9669ea05ff

SHA256
c736a61de985512ff61bb6356f7db762ce60b769f1dcab66f99f28100b1a9ba0

SHA512
7d74d23da894d52edf789326b91254a1c87c6c6c8dcd9cf649610d006dbceccad2a6d582df0e81bfe34f09c69ed9c52f07645ed36b283c5f16786f869caca497

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
28d7313fc73300a7895d082238d33f48

SHA1
e3eb5e99a8c794ea6ca47ab4729582713a81d4f2

SHA256
c49764c9b5cf6879c91cbc95c56237f8d47da2bbbb28c2b73f0b3ad2b7113fb5

SHA512
804b49061082a2972f22a532f4a106622e517c17087e5d20d656a343eedd8c71d83d72d9b475dc6544c438b2bf4c0822704e01bf5876564ea2c2504b12cc1deb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
fd0d1e089c0216eb645764db64106b33

SHA1
9a57ed417e490ba7449dd59c4139f65aa2fa23da

SHA256
fa9f363e6b6e40918c96a1834572a25875f2237a2b46c3963938a783e676f7c5

SHA512
c02372c68577cedbaa4a222c406ac71f66c2bda72819e753868a282429e1d4604daa35879fbd36035d5dc09cbb264a894ea311aeebbb59c06aed8142174eb76d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
2ebd0f8adf356abb55c7a8ff8ab73119

SHA1
75e47e9328fd8fbc30c261dd9b094a95d24df3b5

SHA256
b3f40070299c75f30a30ffb2ef90ab069b5d511db8944a684180e3a6c8e5dac9

SHA512
4fd00a7426fc08f060e7546c63417083b50a602ffb1f72315cd7f495249c6f5488226aa350eec07b23e835d3552fdd80df51f75e36bdae3342e7b4fcc3f5f8b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
27daac36740b0f9edebc152a01bd55f3

SHA1
04504e3f43253fd3829d645ff9cf8337f3449053

SHA256
d23cccd0cdd38adb3a25d101e928975f46781bc3acad7e52ef52dda073c7917f

SHA512
3d4cfea0aa6f526477d9936fec1e2b4b6320634a73c0901dc2d541552976f7b5a4ea7d877cf08652212234b8066107a7469684091401c5b2374032c57022c702

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
666a2e4aa7f5aaa87fe85519873ba6cd

SHA1
20a3fb2a3b53ac9ee3aca2d93b41269276fbb8e8

SHA256
c3180a69a626cb583995a5e26eda74c5d78cdb7be2c5f788391003d24b2613c9

SHA512
405b1a32c21baf36fe5663d05f6d5ac2b5e64c05e0becbd8d18302776b0a0cdeb832f1c40d0ef8605e4ee43ac50774c8605d3fc4042070b68a1615ced01e7483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4796997c0362a44fdcbef6a3a2ce6b6b

SHA1
2856c112feb7ac633c733651434ba3ecf545fb70

SHA256
dc64069839085a84333e2374be57e169dee25cfb75ca5cb755091d794dbdc2f6

SHA512
2b3c373d35e1367ed537cf52cd126e311913f4f3b038b923de1afbc7951f252138abea32c1087d000a9ce72a23fde81cf5b1390a5927eb8544d715b55f2dc565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8d8cf150a20dcb41bf21217dd79cf534

SHA1
2af53e0a095090cd825f15468fd7b019b37bde2a

SHA256
c508161d6bbaea17d4c28d96baa78dfc359a8c3e11422af9f59f26fbd15dcb54

SHA512
a67b129b05194ee5e6714637d0a64901b642319713997a090d0e3b8aba19fea0f33b93d771308650dafdd152d24e73941acf86a25567c385e66ab644999a9fa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fff453d0d4164bbf5ef321bda55864d6

SHA1
0580213367814057cffec40a9824867cc824fb6d

SHA256
202b92968d7c76eff2392516f82b2e11f2661fcab9cd2cbd70894ff733b853f3

SHA512
59c28356ea80d4ac5c8fcfe7cb6dd71cafec4bd636edeb092fc804f4cd1859a151385715b6cb36914504bd959e50bb6f2a150e1aa2a064ce228e820a4aecf776

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
569cbbae81fc7aed2173a0fc64f79ee0

SHA1
b0fe1d861bfcdacdd19fa3355743f8dcbe486101

SHA256
9ce4281a7238fcd4c81bd981a812fa12b66f612d660c98a38d0abec34b0ac4c3

SHA512
4ff7398348138a0322abd5a3cd91174d6e60d4a676cf85c487dca6ba96e32e3b986feb7bc01cd7b46a84510a4d969c679bb4546e3ce508c8ed55d78f60515a91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4ac854e595b749850d1460a4268e7ab6

SHA1
72a3452c758f47163150679badd41ab4928e2969

SHA256
3bb863b3e9295a22cea90abfb851fc8e016258f391f27b452a1b44c4a6828a42

SHA512
7f582c1cdd01234e578ef8fef4aa40018e011562ab6511bef600d5642b779845e16e29e88bf95b00ecd9e5d27101f2d33f45c2ddcbff626caad8d29d3108faf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4781f2fc50c9436f170a28829ac627a0

SHA1
ac6ea0dd2e62d794332dedb3d5c1bdd5ba9d6137

SHA256
26a5ec615176ab8f8277ec8b3fb81bddc094eab4c9270f6f356a8ee6bcfa6a92

SHA512
bcb4c16401a4538e5de53c59c8b8e9e65ca918554189f2ecc0e7ddb5f9cc3e69a4c9ae221f1b7751581daf25593e0526b12e7e1ea68f8fbf469e76d4fa7fa204

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d7a3c380cf27d2f7061d5cc03fe8cb7a

SHA1
33f561d49f6e3018b3421985cf51e8e5440d9c3d

SHA256
3a13c2db60e189069429058caa28a6490cc12fbb873364d0a13942ae825e6721

SHA512
a91e584ce7810ce5dd86357f36a4fc18236039c9ee20827974cfcc71424ee9b6e0f39579fcab0b9184ecaecc424224dd5dba3e9bf8b6355164f6d9328589b509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
026bd89e5a7a9ed0a57c84562d30a607

SHA1
9b396e0c549379d655737af31fe9881331621d0d

SHA256
d9669f2203a44475b27100e8b34fcac7d4e9a58635df85913807d8925001a46a

SHA512
815b3dce91f1b84732e29e54d3fd4876b16fc2af24881d8a2333cf05b1e86ca5acdb08c89a716e79948ce9f3209e3f0c2a931d39d792c96c5de102327f861b74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4a92958044ec04f8edc53388bde9e26c

SHA1
cadf211c9fac9d486b3199752b5cdfe370373d69

SHA256
fdcdce3e4a4dcf304155515cc578e1f905112503188b1e2e6d50463aeffd8d39

SHA512
5e356e29069c551c74b5e01cb516facbc193bad67936ed5c5628a9ae7f8721bcdb2c21bcf8e47a7fe41b84cbde872db292edaba47e2b6e1ce672d05d4f13821b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8ca1246c153bd3fa72feef9be9fb7e85

SHA1
8b22a0e1683dbfd14663870683a49ac9072b1abf

SHA256
41ad9ae92c169fe160fc6880e3825e91d3080849f3ed95d6f9d30eb3d0a88c24

SHA512
16e43b280da8e7d559293d921c8a6f508515075dec0c14894ebe7b7d79a2937459f0231bb6d6c28fbee17517d6e906d56af54b54b0b0a8bcee0ab1833fb90c47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b5d9cea7ed1c4c3e0746667133496c07

SHA1
7f066fc676fc198bc745018086aafdcb103176a2

SHA256
20c4def06719f2b681f9974d67588580e284b83109f7300e9c58c2677da053c3

SHA512
e6aa2711816e6e1da459d21a3c45ccb1d1210419e7f16756ae07f3b595a627b4e69ddfb539f998c5407e7c420848e37c2fc4a55df7fc0f0353988c529dadc266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
83aa1fe0e99066f2e5fd108e09d207ca

SHA1
313b88554dbd035e314a0877f2ae47e4a980afb1

SHA256
7bcc2867423847780fe9efbea0d989ec6e361d8d1eca4d5cfb762b988c56f7fa

SHA512
1016e213a7c9f13669486d80ee428bf7be11344511b8f71a3ac7c2faa1d6f06277681c600b4d02ea91481a59364e01f0e08d435cbef868a14a1d4ee9e83922e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
31d84fb1780e746b6976c36b7a67dee4

SHA1
3c6647586e887bd31d31aa4865eb33e1efbf01ee

SHA256
d61abcff2fca061bd5da7f024996003aae6402e49fca070f14b070a71c94221d

SHA512
a3084cecc59d2f6550f1c4efdf58117ff14118258e9e93c406103c6ad10bb51c3b637919543effa061c118625614d01745c724e4f39b7f41ebe898bf0602c4a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e15fc3c492d37e1fd9b98c75cc4945a5

SHA1
6320b332b90b74a7799001082ea5a56919ae308a

SHA256
06d0d49945b15f090bf5940d03cb01497f1a114574ff62f9fe8c4591089dd6f2

SHA512
28c2b0d02a3fe19228e3423ba30e22c26aac3d49922907bbd87ef2b1619a5bc88a4494e8b49fb87a2932800b54520d8a1abfcae4ae811b7ab9928bece05810f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ed5b9a749b56006044f4ac23cc4d0e5b

SHA1
750823d8bb7c1eacb4baf7676fd0f8e778b69dae

SHA256
6a45ab9deb6d82f3c9854b495439780eae163e3d79fdcd3611708a88ea5b417a

SHA512
3d7683fe4fcb65a8d4bf982a8873b1342f5c185ec9cfacd8f4106d5589327876b7a2c509a1325c3a1d08b6a5fed28dc0088c3df5117836a92bc270063e35b4da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9f65e15450d9f25ceb8bd721416093ff

SHA1
ce88fecb3889b2a0c59522eacdd2a4bfe3272d45

SHA256
1426014b7528b21ff8977143119fbb0b63dc58714fba9567c923dd502720b6a8

SHA512
d25ec3cd9440a1f9172f58aba45681d928a11ac1867934766abdec4cc874d77ebafac29b3b17fb6d5864d24625272d9504d11038566d87b743ac2e48cd577fc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
46ba37a7e37c03a72979719b4bec8192

SHA1
c6aa934bc3d2afe915a8f1a3e486af54e7f3a40a

SHA256
3187e7733abcc7ec1d8f6065a64628dcfc7a7e8e588b3af0ed66fb9c32589336

SHA512
38b41f92e96a2db612ce79b186d99ed68a89d4c3d0d5d7d481c19e55b759f2a02457f6c248999ff494b518f795c295b8186ce49ea9b212167e47b5d99b4e6a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b39985535ce9260ce5191e8ab7f04ed1

SHA1
633490c8f7ce10b6fe346078e1009aebd6262d6a

SHA256
8b724aa825abee2e71bdd76bef7b97f8a1669a305e6a8bc21b82a0965dae5092

SHA512
a2b8615caa9de970f41a1e749812cd0f3ecf65dc6ccc07f8a127af5588696aa906ec6271db4e38b8d54375311e25cbaabd5b9e601ba46fe4bdd85d594fe81ee7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
dec7f17a15f476479a72ad5390afd0d1

SHA1
e0561cc3358f0b4f88a97226d249eb98797c1388

SHA256
3a7af44e31b49712c739170cdfe59ef047b714f1eb9e564da0e9b7172d537cfd

SHA512
3ec42e3a26bb0f385ad0aff59b1a2bf8b8a37c4edcf0aab70dbab0e5a028995b1d9a05d31c1813e8dd483940426f1eeb0a3da293c76a3373b11fa78930dc41b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e007a6ccaa26dbc230ea6aefc7ba6226

SHA1
20d954fe7f5e6fcab6c9999794b6913ddcc16f6a

SHA256
e674ce9ac58085008cd83ad08bafb2e3d3be7296eae8492af6e7bdc48f15b56e

SHA512
257854343f205f5f985620b4717873c71527f9e6377041f155f0dfdb8bde708ca9d40530de2a1f44ed1294bb9ca23cfcf8799a4e02a8f829c8f0e958c91976f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e9682e7765c0b1dd57238a80ff3beb94

SHA1
772198cbc077f0bce67d449e12540490efb855bc

SHA256
30be2fdfc2bc81809906a7057b1241507ea9ac079f3e8f5fa5073349f6dd667e

SHA512
2f33463b890e878cafcdd1f00141559fcc668472b1105caf4a42854d2fd20b156bbf9e6088908de664c1ffccd3c9a4c6b6a798fea5d61ca0af352a4d4c9c9e78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8ce17bc1c0ac258c773015b911f390cb

SHA1
e2e6dbc7414b25660b0af2ffbe002c3240d04d88

SHA256
dc0de14e4346b5b4fdf172f24df2da975ab55bdff76337c61412f5beaeb7bb16

SHA512
0eb6ebd4660a404da7b45b195b1d07189ee3ca1587f9737897fedc03c1b2f396ec9a38d3579c96be42876042419e1c4f108c612e1aff14d7d10c0cda7764dfaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
30efa4524f87a68df6d529e618514495

SHA1
5df224d528f3037b5f78b98036d3928eb1407356

SHA256
adfd82d0422ad9bf1ffc9d968d28cc094dbd879150627c25d94771bf2aee0163

SHA512
a9a7eace68b5dd9b29a9a41e85771e4de4d5c3aeabce6a45aeb9b33d5478e693f27a11b2c30d4933488101a92e8b9dc015b85bf47b71ff201dbcf6e5ea175c7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
12b5da3413b0f84dbbd461ac55954a21

SHA1
e7a4616f877995d5da981f031c4bd6c7f0dcbfc2

SHA256
aa7b9be208773708bcbc37c2c83c222c2ecfc124e022d8b69495ad0482311f69

SHA512
69c2dbdaca8244d25737a180e6ce57a4eb98c6526d7fffcd7b38642cc213f8f6d94b758ab04c793ede30dbd8469a52c55f6ea68c05e7d722a3e6a28eb6cd24e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
082c5b2f213fcd081a21c7bad9ea4971

SHA1
4f452b913a985204eed5ec6748ce83dc7d156687

SHA256
a6e74ac76447b59294436a74f5eda0f5951393e55c5a6057b1ed418a2b970542

SHA512
833f91f3fb128f865e220ba6a2f61e047e88447536588c2f790c8f1eb4e33b0a1b0367a8d67d03800ec24c7e627aea736d71d47aac7d748be3f606de38f96a0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8494733012baa2de2d86f587f72afbba

SHA1
52e57e056b8e58538f03bb6895e00b779109dbdc

SHA256
45e52bf98a7f3c652a567f0586f9cd754c2231c2c514dcc4558bc560f752e4c1

SHA512
8de430b198fdfaa517ba7a59c7f6ba16614088351d4274c67bdb9a126fdc4e042138d4c05051e3fbe2a41a453ac4ae2aaadba4d7a7cea3eef29fb2b02d63cae6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0982262db5fc8b00fc1e3a657b736ed1

SHA1
3dba534211e4114e025e587131b54f5f6cd3cf25

SHA256
9e17874d10746003b78be0eca68257650dc36bf2e220cccffae9b449976e5a1b

SHA512
2dbb9be948e430846a2ca4abe8982dede731fab942ab23875cd6be6db16249114d414352d7db91641a2ade8cfd5a7da2182512ea4f170cfc36bc666028d0dc5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
ac37f08cfc344f45ebdbb2ebdbd438af

SHA1
e97226794ab1fa2032b2357ec7254195a0feaebb

SHA256
66464375ee1d9ec9ee2b54430ac9681cf1e1dccd01dfcf7b5cfa8c4412e528fa

SHA512
96c2c75148779e83f28865872b18216cde06fb607e6d10412b5af7d651849546b39e865a7dfc0a0c5e6d1ae6156d65ad62c7901a8e50f6fddee5dd4fd44e49e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
33710239e19c1b163f65b8a934b0a3ff

SHA1
bc979e066ff3a66085f540965452c7e07bab95e5

SHA256
aa2e9c0d2dc613ee72e20064337d601ccb92857f6594eeb9429d7cfae06b2f87

SHA512
8b33ef05d017a9b340fa1cf33bdb3efd5d1f6d377bbfec237e43a2402e76ab3d8ee509805f2205bf9d2ef30ab8537ef0ae7a152d1af7b999e37d4f0cbefb6a06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
5dc776db1bea1471784823953271157a

SHA1
fbd14a5cfcee227003c914fdecbfd22f2f5e6627

SHA256
98524531f5262e5944335a516b03957df136ef07e84de81860ef926730e22937

SHA512
f10f40ce7882950bd35f1c25043a6797e2e370aa018f1f38151ea4fa44b2f80e5ae7ddfa0cfc6f538e00dacfa05a3d2c2d74dcebcb8eda71c0845fb9236a0625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
d37836d9159417179ce4f75ee9ddd6da

SHA1
285a3bf90d7e3e55e4a6c6348e06d14d3f376dda

SHA256
cc04b4d613d0edc2506be1cfe390b169ba859c3bd79153768dd9841e439d0c6d

SHA512
76273d524893085d3c1c0bbd4566d0160076a424b3cc94e31aeac1a81424bdeeee4e4a9a4c8e649da7d613a3a5602e250c699b9cfc7cdcbfaa57bc65af327a44

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
30c2adb131f57ca2148023a971ed6141

SHA1
f535cf082c6725f1ad3dd6b76c62eccf92d69ac8

SHA256
d36493da10ca4293605c21bda0a2f33e811019ca8df9d900c78554d5cee766db

SHA512
a8cba0f48738bcfb656d2caa3ebf90bf56ab86e94cf1e3a037f7885b6cbfc2fefa5e0754146005ec388db00f5a1fd3a9d66808fd5e573323ff237db7fa07f691

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4f09eefc418c08f275c2fa3f4b8d4dcf

Filesize
5.9MB

MD5
4f09eefc418c08f275c2fa3f4b8d4dcf

SHA1
1eabecb044e73dcfbf5326ab4fae00afdd22312e

SHA256
e9d623c447b1a1f3a279efbc835ce8e8ac396d85e3700b20c5c5ba6a0cdfab06

SHA512
d5515e3621ed19861eac2683b1409c0e34174920551058562dfa1fc009ec9973567a4109afe75577b960d42f1e876ea9cdcd09354c0d9ec48789767d534c6671

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.5MB

MD5
6399cb94a0d00b72ffb53432cb26c891

SHA1
d18c3616da0c6807771c0d7e501e811a9f2e7ded

SHA256
fec985e0648a7d41c434c8fed666139090f7bb5df85939da743a1f8859765811

SHA512
5f06f6e235c1e1c68255cf34fa22713ddd8a8667d9584ba316358c785801a0d9ca68a93ff2c2b20d55bca5c0502a2edaa2a06a8f45fec2292b880725f8ee5097

Download Submit
C:\Users\Admin\Downloads\ezWwTYmb9tEG.zip.crdownload

Filesize
8.8MB

MD5
a07a0491c7a6dc150e66f854d2873a9e

SHA1
e13ac68db20f21c9961ba65c71bf2351bbf74cf8

SHA256
6311747767115ab3ab6fee4fcd7d679d8d4902df00a49697ac089154de003cce

SHA512
2da36a033fa00bb9c716bdf973d5471cb47ce4ee9d715f154d573139574a2384edee9e7e62b08c5a820110f278ffd073ed3d84b6f3d8dc0fa2a69feadbfd340b

Download Submit
C:\Users\Admin\Downloads\ezWwTYmb9tEG.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
d39944e762856ee6f72230e06e395c32

SHA1
9649d31176e045836797a061213245d36323be3d

SHA256
f52babda26eaca3f430448fb53b9cc30f6c4c9d4c4261b54b0ef697c8b235c6c

SHA512
3f19f73e2819e26cd22b5de8c7961e2b65b62994a8d8aaf32f59fd345763bd91ec3d59e7fc00d99aeb41c99d3dcaed21c1f68ebd09024ccfa09587c1c5873bd4

Download Submit
memory/1792-1766-0x00007FFEDEEE0000-0x00007FFEDEEF0000-memory.dmp

Filesize
64KB

Download
memory/1792-1765-0x00007FFEDEEE0000-0x00007FFEDEEF0000-memory.dmp

Filesize
64KB

Download
memory/1792-1764-0x00007FFEDEE70000-0x00007FFEDEE80000-memory.dmp

Filesize
64KB

Download
memory/1792-1763-0x00007FFEDEE70000-0x00007FFEDEE80000-memory.dmp

Filesize
64KB

Download
memory/1792-1760-0x00007FFEDE600000-0x00007FFEDE610000-memory.dmp

Filesize
64KB

Download
memory/1792-1759-0x00007FFEDE5E0000-0x00007FFEDE5F0000-memory.dmp

Filesize
64KB

Download
memory/1792-1758-0x00007FFEDE5E0000-0x00007FFEDE5F0000-memory.dmp

Filesize
64KB

Download
memory/1792-1757-0x00007FFEDE5E0000-0x00007FFEDE5F0000-memory.dmp

Filesize
64KB

Download
memory/1792-1756-0x00007FFEDE430000-0x00007FFEDE440000-memory.dmp

Filesize
64KB

Download
memory/1792-1755-0x00007FFEDE430000-0x00007FFEDE440000-memory.dmp

Filesize
64KB

Download
memory/1792-1754-0x00007FFEDE2C0000-0x00007FFEDE2D0000-memory.dmp

Filesize
64KB

Download
memory/1792-1753-0x00007FFEDE2C0000-0x00007FFEDE2D0000-memory.dmp

Filesize
64KB

Download
memory/1792-1751-0x00007FFEDFFB0000-0x00007FFEDFFD0000-memory.dmp

Filesize
128KB

Download
memory/1792-1748-0x00007FFEDFFB0000-0x00007FFEDFFD0000-memory.dmp

Filesize
128KB

Download
memory/1792-1747-0x00007FFEDFFB0000-0x00007FFEDFFD0000-memory.dmp

Filesize
128KB

Download
memory/1792-1746-0x00007FFEDFF90000-0x00007FFEDFFA0000-memory.dmp

Filesize
64KB

Download
memory/1792-1745-0x00007FFEDFF90000-0x00007FFEDFFA0000-memory.dmp

Filesize
64KB

Download
memory/1792-1744-0x00007FFEDFF00000-0x00007FFEDFF10000-memory.dmp

Filesize
64KB

Download
memory/1792-1743-0x00007FFEDFF00000-0x00007FFEDFF10000-memory.dmp

Filesize
64KB

Download
memory/1792-1749-0x00007FFEDFFB0000-0x00007FFEDFFD0000-memory.dmp

Filesize
128KB

Download
memory/1792-1738-0x00007FFEE0E50000-0x00007FFEE0E80000-memory.dmp

Filesize
192KB

Download
memory/1792-1737-0x00007FFEE0E50000-0x00007FFEE0E80000-memory.dmp

Filesize
192KB

Download
memory/1792-1736-0x00007FFEE0E00000-0x00007FFEE0E10000-memory.dmp

Filesize
64KB

Download
memory/1792-1735-0x00007FFEE0E00000-0x00007FFEE0E10000-memory.dmp

Filesize
64KB

Download
memory/1792-1734-0x00007FFEE0CE0000-0x00007FFEE0CF0000-memory.dmp

Filesize
64KB

Download
memory/1792-1767-0x00007FFEDEF20000-0x00007FFEDEF2D000-memory.dmp

Filesize
52KB

Download
memory/1792-1768-0x00007FFEDEF20000-0x00007FFEDEF2D000-memory.dmp

Filesize
52KB

Download
memory/1792-1769-0x00007FFEDEF20000-0x00007FFEDEF2D000-memory.dmp

Filesize
52KB

Download
memory/1792-1770-0x00007FFEDEF20000-0x00007FFEDEF2D000-memory.dmp

Filesize
52KB

Download
memory/1792-1771-0x00007FFEDEF20000-0x00007FFEDEF2D000-memory.dmp

Filesize
52KB

Download
memory/1792-1772-0x00007FFEDEE30000-0x00007FFEDEE40000-memory.dmp

Filesize
64KB

Download
memory/1792-1773-0x00007FFEDEE30000-0x00007FFEDEE40000-memory.dmp

Filesize
64KB

Download
memory/1792-1774-0x00007FFEDEE30000-0x00007FFEDEE40000-memory.dmp

Filesize
64KB

Download
memory/1792-1775-0x00007FFEDEE50000-0x00007FFEDEE59000-memory.dmp

Filesize
36KB

Download
memory/1792-1776-0x00007FFEDEE50000-0x00007FFEDEE59000-memory.dmp

Filesize
36KB

Download
memory/1792-1777-0x00007FFEDEE50000-0x00007FFEDEE59000-memory.dmp

Filesize
36KB

Download
memory/1792-1778-0x00007FFEDEE50000-0x00007FFEDEE59000-memory.dmp

Filesize
36KB

Download
memory/1792-1779-0x00007FFEDEE50000-0x00007FFEDEE59000-memory.dmp

Filesize
36KB

Download
memory/1792-1780-0x00007FFEDE870000-0x00007FFEDE880000-memory.dmp

Filesize
64KB

Download
memory/1792-1781-0x00007FFEDE870000-0x00007FFEDE880000-memory.dmp

Filesize
64KB

Download
memory/1792-1782-0x00007FFEDE980000-0x00007FFEDE990000-memory.dmp

Filesize
64KB

Download
memory/1792-1783-0x00007FFEDE980000-0x00007FFEDE990000-memory.dmp

Filesize
64KB

Download
memory/1792-1761-0x00007FFEDE600000-0x00007FFEDE610000-memory.dmp

Filesize
64KB

Download
memory/1792-1762-0x00007FFEDE600000-0x00007FFEDE610000-memory.dmp

Filesize
64KB

Download
memory/1792-1752-0x00007FFEE00A0000-0x00007FFEE00AC000-memory.dmp

Filesize
48KB

Download
memory/1792-1750-0x00007FFEDFFB0000-0x00007FFEDFFD0000-memory.dmp

Filesize
128KB

Download
memory/1792-1740-0x00007FFEE0E50000-0x00007FFEE0E80000-memory.dmp

Filesize
192KB

Download
memory/1792-1741-0x00007FFEE0E50000-0x00007FFEE0E80000-memory.dmp

Filesize
192KB

Download
memory/1792-1742-0x00007FFEE0EE0000-0x00007FFEE0EE9000-memory.dmp

Filesize
36KB

Download
memory/1792-1739-0x00007FFEE0E50000-0x00007FFEE0E80000-memory.dmp

Filesize
192KB

Download
memory/1792-1733-0x00007FFEE0CE0000-0x00007FFEE0CF0000-memory.dmp

Filesize
64KB

Download
memory/3132-1728-0x0000000000700000-0x0000000000735000-memory.dmp

Filesize
212KB

Download
memory/3132-1601-0x0000000073BF0000-0x0000000073E00000-memory.dmp

Filesize
2.1MB

Download
memory/3132-1519-0x0000000073BF0000-0x0000000073E00000-memory.dmp

Filesize
2.1MB

Download
memory/3132-1518-0x0000000000700000-0x0000000000735000-memory.dmp

Filesize
212KB

Download