564ca659417d57216722caecbfbad71cb4b781dbd19ffd4ec6722f806a9695d2

Analysis

max time kernel
894s
max time network
901s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
25/08/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

117KB
MD5

885125c068989b2285f4e35cf4fd20b4
SHA1

07284745056462db1e791745b2d8b0754eb6dd0b
SHA256

564ca659417d57216722caecbfbad71cb4b781dbd19ffd4ec6722f806a9695d2
SHA512

12a89046575499408d892b473b19fa0cffbeeebe28f95a4a3de3b6510cd21721bf6340ae29574b71e8b750d97a0b3d5b43c7d774a2e0ab3735d4c5f8e0f24037
SSDEEP

3072:bWptsFWBDJZrFR9+8KBPUenT7nIO866sgqm:bWDsFWBDJZrFR9+5PUenT7nIO8Df

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 31 IoCs

pid	Process
1952	RobloxPlayerInstaller.exe
4776	MicrosoftEdgeWebview2Setup.exe
4544	MicrosoftEdgeUpdate.exe
2888	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdateComRegisterShell64.exe
3040	MicrosoftEdgeUpdateComRegisterShell64.exe
4948	MicrosoftEdgeUpdateComRegisterShell64.exe
4148	MicrosoftEdgeUpdate.exe
724	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdate.exe
1156	MicrosoftEdge_X64_128.0.2739.42.exe
952	setup.exe
4472	setup.exe
624	MicrosoftEdgeUpdate.exe
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
404	MicrosoftEdgeUpdate.exe
1960	MicrosoftEdgeUpdate.exe
3144	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
340	MicrosoftEdgeUpdate.exe
2360	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
1616	MicrosoftEdgeUpdateComRegisterShell64.exe
7708	MicrosoftEdgeUpdateComRegisterShell64.exe
7788	MicrosoftEdgeUpdateComRegisterShell64.exe
7980	MicrosoftEdgeUpdate.exe

Loads dropped DLL 32 IoCs

pid	Process
4544	MicrosoftEdgeUpdate.exe
2888	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdateComRegisterShell64.exe
2712	MicrosoftEdgeUpdate.exe
3040	MicrosoftEdgeUpdateComRegisterShell64.exe
2712	MicrosoftEdgeUpdate.exe
4948	MicrosoftEdgeUpdateComRegisterShell64.exe
2712	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe
724	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdate.exe
724	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdate.exe
624	MicrosoftEdgeUpdate.exe
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
404	MicrosoftEdgeUpdate.exe
1960	MicrosoftEdgeUpdate.exe
1960	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdate.exe
340	MicrosoftEdgeUpdate.exe
2360	MicrosoftEdgeUpdate.exe
1616	MicrosoftEdgeUpdateComRegisterShell64.exe
3988	MicrosoftEdgeUpdate.exe
7708	MicrosoftEdgeUpdateComRegisterShell64.exe
3988	MicrosoftEdgeUpdate.exe
7788	MicrosoftEdgeUpdateComRegisterShell64.exe
3988	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
120	pastebin.com
121	pastebin.com
463	pastebin.com
464	pastebin.com

Checks system information in the registry 2 TTPs 18 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\CompositorDebugger\select.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\msvcp140.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\Controls\DesignSystem\DpadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\graphic\player.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\qu.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA374.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\RoactStudioWidgets\button_hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\msedge_elf.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AlignTool\Min.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\DeveloperInspector\ToolbarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TerrainTools\mtrl_water.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\SelfView\SelfView_icon_mic_disabled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Emotes\Editor\Small\OrangeHighlight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\sounds\action_falling.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\LockCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_16.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA374.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Lobby\Buttons\glow_nine_slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\places\MobileChatPlace.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\edge_game_assist\EdgeGameAssist_1.0.2729.0_x64.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\EdgeUpdate.dat	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\MicLight\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\graphic\Auth\CharacterShadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ca-Es-VALENCIA.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\PluginManagement\allowed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VR\Radial\Icons\2DUI.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\9SliceEditor\Dragger2OutlinedTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AnimationEditor\icon_delete.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\icon_premium-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\PlayStationController\DPadUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Settings\LeaveGame\gr-item selector-8px corner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\icons\ic-profile.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\sky\clouds-bc4.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\PublishPlaceAs\navigation_pushBack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\PlayerList\NewFollowing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\TopBar\emotesOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\graphic\ph-avatar-portrait.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\StudioUIEditor\icon_rotate5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TerrainTools\progress_bar.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\ne.pak	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4496	MicrosoftEdgeUpdate.exe
624	MicrosoftEdgeUpdate.exe
340	MicrosoftEdgeUpdate.exe
7980	MicrosoftEdgeUpdate.exe
4148	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
5076	chrome.exe
5076	chrome.exe
4556	Solara.exe
1952	RobloxPlayerInstaller.exe
1952	RobloxPlayerInstaller.exe
4544	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
472	Solara.exe
472	Solara.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe
404	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdate.exe
1960	MicrosoftEdgeUpdate.exe
1960	MicrosoftEdgeUpdate.exe
2360	MicrosoftEdgeUpdate.exe
2360	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeCreatePagefilePrivilege	804	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
3140	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
2160	RobloxPlayerBeta.exe
2536	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 784	804	chrome.exe	71
PID 804 wrote to memory of 784	804	chrome.exe	71
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 464	804	chrome.exe	73
PID 804 wrote to memory of 1920	804	chrome.exe	74
PID 804 wrote to memory of 1920	804	chrome.exe	74
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75
PID 804 wrote to memory of 4180	804	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff853bf9758,0x7ff853bf9768,0x7ff853bf9778
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:2
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4628 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3592 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3100 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2908 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4788 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1600 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3084 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3780 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2968 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6272 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=1464 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6868 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=852 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3864 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5752 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=2980 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7096 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:836
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- - C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4544
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2712
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3040
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODM0NTE2NEItQUE3OS00RTcyLThDMzctRTE0QUM2NjY3NDNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NDA1NDFBRi1COEIxLTQzRkItQUIzQy0yMTcyODk0QjhFNTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2Mjk0MDg1NjIiIGluc3RhbGxfdGltZV9tcz0iMzE5NyIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4148
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8345164B-AA79-4E72-8C37-E14AC666743F}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:724
- - C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5124 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6012 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=5896 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=4732 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5212 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=5596 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=6928 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=4696 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=5412 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:WmDoewvDpyIva02FLRmwXyR7nGPf3Y3UejOpEQ0w4okJFx7JvXmOTmjgkETUWWNwCAku-xp0MBvUGIoMHyVRoFv3IiiEa8dmaT3LVZotpYh79VEDstS3IQF_0qayYjhy3qvMsE9BaocXKEqKsX-syaZRfmPcVO1pUSK5LaBi6VldA0dAiSoGI7z81PElD671sMOhs7xmcqOmPkitpc4XdRs932LGZ3eWJ3xF9LfX-X0+launchtime:1724574025451+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1724573651725009%26placeId%3D6815472308%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D55909011-710c-4974-9c87-9ae4ce0698cb%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1724573651725009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=3712 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6756 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6780 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=5944 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=4468 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=4700 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=5140 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=2948 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=4560 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=6980 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=936 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=5812 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=6800 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=6388 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=5464 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=6376 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=4388 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=6012 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=7732 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=7212 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=8288 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=7612 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=7676 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=8492 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=8448 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=4452 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=8784 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=8644 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=9108 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=9428 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=9356 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=9308 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=9572 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=9916 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=8824 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=8528 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=10408 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=10560 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=10780 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=9940 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=10904 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=11120 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:7044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=4412 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:7136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=11472 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=5128 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=4548 --field-trial-handle=1868,i,17646338000603062442,18373564516520926991,131072 /prefetch:1
  2⤵
  PID:6804

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1560

C:\Users\Admin\Videos\Solara\Solara.exe
"C:\Users\Admin\Videos\Solara\Solara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384
1⤵
PID:3640

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4124
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODM0NTE2NEItQUE3OS00RTcyLThDMzctRTE0QUM2NjY3NDNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RkMzMTVERS04RjM0LTQwMkUtQjMwNC0wQjdGQzVCMTQyNTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NTAxNTkyODIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\MicrosoftEdge_X64_128.0.2739.42.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:1156
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\EDGEMITMP_B5E2E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\EDGEMITMP_B5E2E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:952
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\EDGEMITMP_B5E2E.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\EDGEMITMP_B5E2E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{31992EEA-99C1-4F4A-8D7A-F9A2E6539273}\EDGEMITMP_B5E2E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.42 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff6c83006d8,0x7ff6c83006e4,0x7ff6c83006f0
      4⤵
      Executes dropped EXE
      PID:4472
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODM0NTE2NEItQUE3OS00RTcyLThDMzctRTE0QUM2NjY3NDNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszMUMwNUIzNS04NjJDLTRGNEEtOTI5Mi1GQ0Q1RkQ2RjdFNEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI4LjAuMjczOS40MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY5ODE2NDk1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2OTgyNTUwNzMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDAyNjMxNzY5NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYjBmNzMxY2UtZjcwNi00YzgxLTkwNmUtYTA1YWEwMzQ3NTdkP1AxPTE3MjUxNzg2NjcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9WEt5ZDk5bHhUJTJmS1paRlFkUFdaJTJmcTRGeURkNjFFaWRLTWtHaEFYSmZPbVFYd3I0VjF2M084bDdEQWVrT2U1bmhSekZSNHdJRmdsOEVMNSUyZjR5NUFnTXclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3NTAzNDQiIHRvdGFsPSIxNzM3NTAzNDQiIGRvd25sb2FkX3RpbWVfbXM9IjIxOTU1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAwMjY3NTc0MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDA1NTg4NzI1MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA2OTMzNTcxNjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMDI5IiBkb3dubG9hZF90aW1lX21zPSIzMjgzMiIgZG93bmxvYWRlZD0iMTczNzUwMzQ0IiB0b3RhbD0iMTczNzUwMzQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MzczNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:624

C:\Users\Admin\Videos\Solara\Solara.exe
"C:\Users\Admin\Videos\Solara\Solara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:472

C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2160

C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2536

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:404

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1960
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{86371D3C-24E5-4B9A-BB55-C1B28E90382D}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{86371D3C-24E5-4B9A-BB55-C1B28E90382D}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe" /update /sessionid "{BA5E2391-D76F-4A03-82A1-47E065B4FC38}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3144
- - C:\Program Files (x86)\Microsoft\Temp\EUA374.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUA374.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{BA5E2391-D76F-4A03-82A1-47E065B4FC38}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2360
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1096
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3988
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1616
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:7708
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:7788
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkE1RTIzOTEtRDc2Ri00QTAzLTgyQTEtNDdFMDY1QjRGQzM4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MzJGRURDRTgtMkZDMS00RUYzLTkyNjgtQTc5QzcxQzYzQUI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjE1IiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0NDAiIGluc3RhbGxkYXRldGltZT0iMTcyNDU3Mzg1OSI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1NzY5NTcxNjEiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Modifies data under HKEY_USERS
      PID:7980
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkE1RTIzOTEtRDc2Ri00QTAzLTgyQTEtNDdFMDY1QjRGQzM4fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntCOUJENkZCRi01QkNELTREMUMtOEEyNi05N0I2MTU3NkE2MUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMwNzEyNzA5MzYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMwNzE2MDA2MTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMzMDA2ODQ1NjQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMyM2ZhN2Y3LTQ0NDUtNDEzNy04MmVjLTcxNTI4OTQ5MTgyYT9QMT0xNzI1MTc5MDA1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW1ROUlTaG5RSkY0UDJzR2MzcVNCVTNTd2J4dElhcDVZV0lWakJZcmV5bjBUQ0YxYkJzT2t6dm1mZ3ZxRjdRNXdteUR2WktmR3N6MTNaaWxObHJ6UyUyZmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjQ1MTEyIiB0b3RhbD0iMTY0NTExMiIgZG93bmxvYWRfdGltZV9tcz0iMTk4MjgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMzMDA3NDQ1MjkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMzMDYzNDgyNzAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyOC4wLjI3MzkuNDIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0NDAiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins4QzJDNUY5MS1ERjMzLTQ3MTAtOEIwNi04N0UxN0U3NDQ2MTh9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Installer\setup.exe

Filesize
6.6MB

MD5
11a19165aa72e46ad47200ca46760c87

SHA1
2fe4616eadaf543846571564ca325e772ea5375c

SHA256
eaac114b05373d005f91c2824c3b907d01842056468018b95a688e82ffcc95b1

SHA512
5b4074ba1598c7441fd3dffed54cf0cea540a8e58ace339254b9a29bd6709a8e64458c10e9797a75ba8e0e84566e8c5935bf4891b0115dc02017396d70f47b27

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe

Filesize
1.6MB

MD5
90decc230b529e4fd7e5fa709e575e76

SHA1
aa48b58cf2293dad5854431448385e583b53652c

SHA256
91f0deec7d7319e57477b74a7a5f4d17c15eb2924b53e05a5998d67ecc8201f2

SHA512
15c0c5ef077d5aca08c067afbc8865ad267abd7b82049655276724bce7f09c16f52d13d69d1449888d8075e13125ff8f880a0d92adc9b65a5171740a7c72df03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
0a4e6d7286b389e2fd93317e27d46585

SHA1
dcf0d769a94555ce60f1b367b2851477286366be

SHA256
5853f8b5333a0c7a4fa318e2da1400eb1bbd0a52dc22b5521002066f242a2ac9

SHA512
b859cac971f414b24ca53832cab53cc4a424b776923d7f7c2c167f2d60c5aefdd4d5aba255af2e1e3673396101b575bc77dedea3ea06060c962863d635b218c9

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
edcf51639e781a4935ab3c32a351b910

SHA1
2c75d42992f50254e05692a0d2fa58621668431d

SHA256
3ff4a6a3880481a8a36a244b58f7218df9eb3b8df45ed47269ff51f071716a7c

SHA512
4c5c8b59213902252c81daf2d8c50030ac7084c36826f09ccfe4682cbdead163c5bc6993e874d00c12ed5a7972d70c793b9c95f08409f1187ec10233aa3731c7

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
15KB

MD5
8aacf1af4f453eda44290905a328a467

SHA1
518208512106b4afd17618db60db3b1aa8732538

SHA256
59dd401da42f906bda246f3af42322614d2accf703ba7848b4a2fc1548c88b4e

SHA512
0c2bbacf0855bebe9257f9920758ec81383b5fe7e80d2cf457b912326974efe66ca7d205902aeaaf1acb418f44f0bfda16bb8bfbd4a4ff1e3a7f55f95bbd5503

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

Filesize
69KB

MD5
1a0fbcbbf3181ffb739b70d15464ee4e

SHA1
6ef477d66bbed35eb2d02cc3b9c66a155c39d6ab

SHA256
8de893f0b6277dadf76bebe3ddd3f730b34cd7e27d1019412fb720383a7ea18e

SHA512
3adf38c393940fb9d99e769743d375d77f6975590ddca296ba64176bd5b5f26c65d6e9eea5a8282aac9335903ceda8c756315149e27804cf9ce94973c806aba2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
413KB

MD5
9754a3ea25926a43fcd746322d8d8c36

SHA1
451ea39ad243fbe5c6e8be4925a33c45f8f37105

SHA256
49bf71adb4660059262242166860d1beb49b2230803f63cfd4b561aa02e36ae6

SHA512
23b42db4e91ce92340a045d8ae6a56b64d5de467f5e0341489ff4db9476ae70ffb7fc496134f92e398e7154b86ca497ee52c7acd377c3c5c737a80cfeab90348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000071

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000135

Filesize
50KB

MD5
5ac3acbf4eeadf40944c137b21048ef1

SHA1
268dd62645fdda67b0fc76dcccdfc2e80aa36734

SHA256
782f67df829a5ab4c800cf1719e46ebd22e5e6c40f3a0d41aaa1871c4a5c7a47

SHA512
31fd64057c6db87daeb2de2df8576a9d50dc97c2086c1dd826a2bafc1159916fd6e208d34cd3f4e25a7edb445b227a2abeb23a305af01eb1b607f1c9fdd7f128

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000137

Filesize
30KB

MD5
0dfc0267f19235ed2ac7b378dc240a16

SHA1
bffa74216563bb277914572e7601fad70a49025a

SHA256
53fce46aa5a64403321fe4a0a6305b843a14dd6696e066b5ca7742183a085b77

SHA512
5777339ff4b1478978adf8e676b63fb505a31f08bae2e1f00755fb5a27523ec4ee37e2d27f5217052dc8787e17018126276637da6ede6d0ab12216690c3e7afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000138

Filesize
143KB

MD5
4910502c4b0b1384addcaeef55b19946

SHA1
fdce53ad5072c969bbfde9871d7f7da8d5b020bd

SHA256
a37465cf0dcba106a2c495d47b4196c5b0191230bb40026c06c5152c21e147b9

SHA512
13d6d07f0cfaf537061b3f739dd67ae756051a250d936abb52c18f9dcb3f16d81696d9155a7d172572e0b255269956c8c12a3707068041449dd5b19df802f408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00013d

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000143

Filesize
20KB

MD5
a1afe33ce7442502a96deee597945384

SHA1
fe34cd78635f5617cf238de6dc746058d6f88899

SHA256
f7eeb570c60aff1435db1daf3767c0672634269789870ef91c69b2b90a47edaa

SHA512
f8bca21c3fd79d63c8265f5dfcba95419eac697b42efb600e7c33d15dc5d9c3e0d0d360da39e14004facaea4cff4dcfc00d7437979283ce0a2b06916b69b8c80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000145

Filesize
16KB

MD5
a2edb5c7eb3c7ef98d0eb329c6fb268f

SHA1
5f3037dc517afd44b644c712c5966bfe3289354c

SHA256
ba191bf3b5c39a50676e4ecae47adff7f404f9481890530cdbf64252fbb1a57e

SHA512
cc5644caf32302521ca5d6fd3c8cc81a6bbf0c44a56c00f0a19996610d65cf40d5bae6446610f05a601f63dea343a9000e76f93a0680cfbf1e4cf15a3563a62c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000147

Filesize
63KB

MD5
e4cc1ece2f2425b10ae2ccc212c1dafc

SHA1
92609e6d0093693110baa23758382889bcb30da6

SHA256
92e9415d8bc8529e2a3f335258ef7ff159cce2965ce3b2b7c15f73720efee809

SHA512
2848dee3a6da891b7044518bc97aeafd340705cebe846350b9a7f314b52450f1eb977b8b492638965ce4674ebaa341e4f832438199c3cad2fb0a0793ef83a619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00017d

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00018a

Filesize
252KB

MD5
deb04fe2a35d2981313f891baaa32654

SHA1
69e5aaef4a2f447878824d905832a08a9c596d83

SHA256
93dedb17602e315ba495c99be747f3d5717b4f49306c55326f4570b43c9bc1c8

SHA512
8c32d572a8f108079263b9ab5230467b454518b60932db7a2cc855a350130d93db5b8f2cc5c82a9b3011e572d80d67e23c777145fd45e6467b0b2caafe92378a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0288e21932dd21e1_0

Filesize
20KB

MD5
de3b8c1c00c0479ea4c5acc073cd0baf

SHA1
b9add4152c8b9ca552e677e231b438971c7b56bd

SHA256
b6463d928518b26977849efd67256371c21e8ab09e0bc249aaa7e5a549723086

SHA512
9443353734ce9e442887ce5b05bd707e2989b4fd945d4899e6ae0a8f91a04504a8dff95c7deb62fd47c14a16d351e2be4067ed8ec87049d9524a8df137501fef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\baaa5ee08c82189d_0

Filesize
297B

MD5
2ffc0db69abe4b078a31483ec98b53d1

SHA1
0c78bcd53fd3f1f3bda798d97a3bacf48f865372

SHA256
81cf284ab2562c100334a7f967d5826a04b9fab84d34e8a0b624a10bf59ccd7a

SHA512
011f49232bd69468cac29404d291abb147faae685271026fa12557bf6b60475e54c8360f556d3af0d1bf264c94a26144cab346ae85ffd91236638482be98a496

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
8KB

MD5
722e16bcb606669d22cc43201e6f702f

SHA1
3fccc06be2543f27124930dcc2f2e6b8bda29eb0

SHA256
3dc65b821bc63fba8535a5ded608a1a273abbe149f7954004f45cdaa63b81ee6

SHA512
40fca1f87d5f3a26a828a1a42a07fe5b8efd8be3cd30d6423dd0226d1b0a3155573cd4f56fec54669e46f0eeb580b11902e170031efbbb4998d0c9e941a4a389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
52b97e171b017a60e10a42d9e1586fce

SHA1
d238a852e041723bfe6e78cb0dbde60908d408ea

SHA256
d3694487bd4e6f6ae2d0bac358fad85fe9152b97832ffa3dbaa8a613a8ad1855

SHA512
6b41a6476b8235abb888b993be8192bc52b99a092a4ad5b162752093d6c181f889c4a003c5d21f9a92dfa3ec8b094cca5b6bd751294c4764fd6594a179a9df85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
5e481eef0b25d4387d9d0324f9ce9c09

SHA1
a14c77469e334ef1d93688afa92dc52bcdddf5bb

SHA256
8b013dd7cb518692249ac90f71395fe3a1dee52eb97bc6b8d5074048fbfd5399

SHA512
38c0060a8bfafcb569dbcb5e842fedadbd63f3a9671a4faed6252d3dd165a50152141d92249eee4781b7f62fb91c0803bcb65ffaa7d17f49fc0b5dc5f9140c3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
e007abf8c0b8818c0984fd2677bac5f2

SHA1
ce7d7ac18f15bd458a9501f60edd79723ead7157

SHA256
b0dc180ba17dd6f3fac99ab8be41004a1cb183019f8be49e60e50069a1f73767

SHA512
02b806f6724d942141468d663ef87d87cdbfd95ffcc6153d93f5510ec324ef1b44b2488f98a5b9d6ae00fe95fb3a077d249402eb6b61e9a73cf1acd2e715bd7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
baf1866d45df59672cb99043173cf545

SHA1
f7ae7b514e8deb66de834293c71e82822a2a7a3d

SHA256
339af0b3674bebd992a04cb060af9d416e687d375ceed7c7fbfcdaf8579229cd

SHA512
cdb3391f7e0634acec849d4d321a91416ba0e5583141e54a2e36c75f776b0a844b644d35fa9bacfb71896f50165385a1c2a089c0bd1d72a23bd160b1e2e5ffdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
59be08b90988e968a3816518271a23bc

SHA1
69eb31c22578bb312a85cc5b410a0f20911bf200

SHA256
efdbe38cadddc006b1916d9e4509937bf1cd313760dda795a9a78ab68a1c4e06

SHA512
f693aba2d9e7714d121694775b1e5cc44736c834706ea38d8db808437cc966ea609ae47e6ce3a8c784b407fd135ad89b21bed3cb3e653e825fb759db4f279e96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
e992ebb06d17097ddb58ade6d5abadc4

SHA1
0c92200328031ef206037f96b6b25b39cc9b69b7

SHA256
50cf2a854f6795b1a6744e6b7c3dc97687263d91b34a5758ed208c4fed7ef75e

SHA512
3748529ff1547f5061f975683b5a9b12157bd78e749a197432f8014ba3b5b4543c6f3ef119a4306d83400b5aab4dea8c5c568915c69f11ba7e98b79d74b8e166

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
16d0e249d32d62146f002929b94b55db

SHA1
4ebbf4e65e1a15f990695399d9f2e75caa8518b1

SHA256
e29c4ec57940eb08c77c72ad70849951e8d6a2d0533ddc3d8271af60229daffc

SHA512
12f72da936d970277f20132b216692b58a6a8cc990d4eb4f8fc7c4c37faaa90df268c75765115f89e0fdc25dff0c0853883eb3a315c313c63cc72351425d102a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
dba9bb4f3cb2586dbc49e64704f75e4f

SHA1
937cc4117e8959e6a92dadce93bfd3f174d01f4c

SHA256
418ec28b993220abca126d1ee9cc74340e82987bafd163fae84fa24a02e814bc

SHA512
2e18bb0be274ab8e62a5211eeb9f002e0781d8431b30e2389d89756c87d0444521709c8a1ed1763c48acc28917d1ba6c7eab79c88e3b04d642b5d3c06f46a0d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
11d1373ed3f6dcdedda8c95cd9e53720

SHA1
f591ae874d108d615b9053f91688637b5e07a377

SHA256
71e3b23637e5c5c45fc04f67087b6b43208051e3b97a5ed396e987d092242d26

SHA512
8c1ab2769885498dd520b0d5cf620dccf2a6aed82a43a079d5d37fe11a3e0aefad1a86a2b3a097899d764c05237e64e0b1c40d0c28f919ceedf208c280e73533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
4991cdecca468d512677cdf5839db9d5

SHA1
3ecdf359fdd2ec923e761247659483c7d3800ac6

SHA256
727384610b2da49487b826c2d7299e94d3d0886b9cc5a8da090492e1af7938b5

SHA512
0bf9983bdac6b9e6298be57933299120f0cdd0c7695232eba8794777ee82a479a944257bbc7fbc8a11dfe55754bd26172cdac3b23975239a248d3d13e935fc03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
9c38ea23886350ec2f58d5b42e447099

SHA1
ea43efb53c067f3f14b105a362994b5bf84d1dde

SHA256
23f7cdb9f53b39c4572840aace20893a2177f3134ebfa5e6e39f9c30ac0aaaff

SHA512
dda89a86e805b5c0cd819cf1a78c387a473b5a6511d2a61f6be8c495b4248b3bc46328126b20c7735d05d6d029532acd4b2c8fbbb2f6d97a7e0f4816f16a51b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
390B

MD5
f1ced2e6609a80bdb5c1abd5e532cb5c

SHA1
22d88a9709fbed835b3f317d73e76cf42e0f0466

SHA256
45a3ef3bfc28dfb22ec75d69bad5d862dd737943ad0655f53ee94aff4088d726

SHA512
64ac6a8d8912bc46196d618b572e47ab911ba68c1d35cb28860deeb688c13c6c29cc7fe55a5dbbee6c3305f9e216823111eae67b0e8327235dbaa47ef57a6027

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5de830.TMP

Filesize
671B

MD5
bf40e9b8bf34e881a5f83d16c3a9d6d5

SHA1
e3d014331c39bea9c9cf6da665cfbcbc50eff119

SHA256
96df1b8e2d18b37568ab46c8dc0ff7fc5b886894a9110fc8c015df917e3d4fdd

SHA512
a5aced423c8d9d3e0ed1ac2aacaba3cbdc582491f28649684ef1dc60b74e8a98eef2aef9aa5d7ab71b3e35d38ae6cb1d2b36538e261ffe8a1637009cc3318e95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
1c6e76b719a3e9e31d3b7b54c1798c0c

SHA1
76c799a3c29df676d1ea07a196cbc9095de0ae84

SHA256
c3a30ca20bc45710f210a0bf8f5a63507909aa208df90e35eb9edebf696887c8

SHA512
39c71dbbc6cfb9edea6b6a787e0aa78bf2412eef01ab22578765116521537bfce5cea26bb034188d1381a6923bfa6c4307a9ff9e62706ad2e9190f0ed4c0ee9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\83ede7c9-4737-4b69-9705-ddf21c1e67f3.tmp

Filesize
5KB

MD5
36b5db9f134672ca5c38e126c79b1396

SHA1
6ab85cb142a9dc93a3eb9ec4e63d52370f84b7b5

SHA256
600724b9e7e022d9ab4ae3cd774aeedb5a7f159d46b90254b9c1f588ca05c865

SHA512
06587f16c2c33bad6e37d6356bd86cf8254aedcfaf7d992e9e41aac10ab68954ebde63d71f22a4f293dc0114cee62fe7b429e70deedc6a2740a0bda66ebb9373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
6cabeb6126f16e995bd56266852dfd00

SHA1
7cd6fd788d813866671d00a2d834cb8925b2f139

SHA256
102fb8d36461d9ecd23aed02f0bc92c0e959f7902413610079e11360b6b1e0e7

SHA512
f4d77781ef835dc61ce528678b59d2df1c9c48ad8b6b04eb71a6886bd1c6c8e06b7da9a5c338331312a06dcf293a0c51d64db728b51e5db1cb0298cb37e02329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
03a4a9de1e7d4ecd415c897629014b96

SHA1
cd8e791e981800fbdd1044336bc459f3392ab8ea

SHA256
88030a0a88ab35e1f118e4104f323d5ea88a55204f6aa87d74892b62a2ce0b97

SHA512
20f3d1efd107ece38ef93fe9f84e860cfc6c9ba4905a94589b64c5aa33f212b478a940217292550416f13f372105b46c6d5fd98f78b31bee062ceafe8d884f63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
c5227d0a3a566bc9d559ef51ddb2e235

SHA1
bcfbedd67b7c2da101d5a833618a1a698fd5bbe1

SHA256
a3e2098ae545b91a3884b5a7575bcf2c8721d54b353d40d91aeac69c6fa0943c

SHA512
83a0cf9e4b409fa20b5bd0957e6c1686f3a9f92e32dfc3ee137ef1c1983d7f11220398af18ffa08cac7b049799df650c10b23e851b7d92f007d5b077bdbb9bb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
3e61a0db5725152540c51132d892d28e

SHA1
09745aed4d1fbc647471a0c5cd2481098ce53231

SHA256
85ad8b300d08b3de8d610ae7b34ea2a6fa228ed1915ca64ad878ab54025d7102

SHA512
f27d6c7a9a395993e2dc3233194baa88350005ef5b0de2c42e4070e34ff3af021a19942445761c82c1472ec32a0a32dc804f80a022e1a4d6664a16d30c621517

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
b119d16ddbe337afb0c080a1d169b866

SHA1
135678bfb8d69f33b272e4cf25ff0fa321edd5e4

SHA256
286f789722b388fdba49576a3c1880fec784bffbc88751b1f90b9a9f77c119e1

SHA512
1b1990c0d3132e2cd5762201d0fdcfe784f539b229fcd1c02ba67ed88069fb23ea69dbe6c0b306a48fea5e092267e9dd74d8e725056b14521e16f926092d3fd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
83295a20c2cbdf70efdbe33c2fbadb15

SHA1
9e67a5e3fabfe9234f477dd8d601548dfb3805fc

SHA256
d73c412a5d356dba6603f100d547699a60b04d4b7ee5a8e8286463637ee96c5e

SHA512
cfb9596b5c67e5774259a0ec1d68b57026b1f9aefcb65c1b6becbb42f932da4175cad2ff1a22b283865bdd07e3b028e252015db593bc0e2b91d5c5ac433e327e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
d214170441edc730c0a2ab722fa00703

SHA1
11878bb97d38e1d8bb2fef2f64d4fd842cf0348b

SHA256
81e71708f52db5d00123c7229eb3f49aaf346c477e53d7dcb5fc327c36f3def0

SHA512
e33858202e00c7fe6abcbf77e103f00bc0a0ca529dd0015208c0b545a1f58d62a8bc0e4f1e36a80ad0a01bb2b1f65d99c066acf7aa66a28c71b70e61dacb0e10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
22267437b13a07683bba2f2a16fc3cd2

SHA1
8319c32b10cfdb34018f2889776fd7062d630bf3

SHA256
17258850bbce717af4b120fbb59652937454528f02c773f32d7cd27ed3df0d3a

SHA512
59e84edcfb74e29d86ba8b544e3dd4d2873c3e914b3e14fd43eb84fb09c97f3303082f79b84c4043b4690c8f0da21c30cd13815f2630524a7fc1459e92858935

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
0e66f417f0908f10bd3e939c689e3df2

SHA1
833548d855fdbaec0733994d3b0490273bd0f045

SHA256
a9de006c72ebed23040fdeb6f635b88fa45f4904f17d1f38cb037c050fe94e24

SHA512
4953f1d6836b4b5a03dcebdffe5b5a608d3c463dd775471d42ed259666ad4f6521b5c7acb5d47ecc87705d0ab1a0cdc8930081098da48886eccdf936a5189121

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
6e1a012cb4d933682dbd7b03900316d4

SHA1
6f414e5d5fb4e1d906a881ab26f95853e2ef0300

SHA256
55b5ae916b48f203bddb5e0ba251b578613ab9731d0ad68f0c377fe983153fa4

SHA512
a8e0d9b9432f1e5cb415441a0c2932747e6fab0bc83f56f77c5459dec13a12b7f3a3a51608b0e3a13b6c66aaae96b012ad1a0d9b78d49e71b3692dbf518bdaac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
f7fd6fe944e2e53c4c680ffd8b4bf98e

SHA1
255cdbed920c957e300ddf9fee6dc2e482753008

SHA256
b1d2b1ec6c321398a8a1acc0c81496dc80025e3c65ae52de14d432dfe9d9781c

SHA512
edf0235eaf7969210a7ac5cf1af5e97e082cfa975d4adb5ffa5a0af7132bea329954c99ec9072236b6607fd354b0f00b0239c3c20a26e117a6b875da2f850c98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
d84763bbcdf8bdc1538cfe65f074cc42

SHA1
467fef1c189f5b80e740f0c2aaeda725d88937cc

SHA256
5566bcb289d18a1b369339d3d588d40b2c32e2c45a065b5257e90c560871feb8

SHA512
e31c2a52aec3e8249ea00719b50e2f9984189e2898d2c75ec858d5e243319e2c2d9d5828d7271fa4881dfd8fe3b779ec415204ade09dbf000d4bac9ef8bfae2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f4e6b806c7f266e5a0004f4a12d7e21f

SHA1
f9f4ba86144453d9a4b233b47c6212b568c42554

SHA256
91184783bbed8f92c25b0b319ab0309756a476ac1515ff01cab703527577e24a

SHA512
2f70fcfec2d3741385d961870c4c36106dbb6474d3c6a0c422902e37086f6ef2ce116481610f29ca646a8663206df99d349c65d549a77a30606354a83e583308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
3d693743f42574d3962986e2d2b6a3e4

SHA1
2e658aa4681f6d210e29ac73d71a8db327f2ab82

SHA256
65fbf9ef10cbbd9001c175fa68cd3777c4578b383e458680c3453634472f51fe

SHA512
eb55616cb4811cc5bcb59309076c9aa96d854eb84097c6cad33fe744ce36fb90e8929c0f5fd2f513a1813249670c6602bf5faa233e6f118165f9045499a11b7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
c4b1798849b85c42b0785dfe2a3f9484

SHA1
1c4b647ab687840ab79107010405e18bdc07cd53

SHA256
e100931f31ef3c1efebabaf3fadd12087d7262c7f4eb996b733983f372c5e56a

SHA512
3ab3c3cc9ed6a099647d86822cf404ff8e6de81963dd5f80de5d473c70265909a6c3b10ee3e7d731f6d83b0345dfb68660fbd57aa10bf8aebab20793cdaa7db2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
dfaed5752f530b8a49ae5719331da0fa

SHA1
f3e7a3e769ed4aeae4ce474f12b4e541c35c392e

SHA256
f9b6cc09234217a90cc796cd56047ee79ee8570f2c82f676853ef6d0ab5890e1

SHA512
24a4044e54fd7e3ca73ed7a8ec834eaacb2955a533ddfeaaa600fe6d1a3d3e540e1a59a229eca8ad9850ed72043a3a60e6d98d02045e649ca9167e4c93448ebd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
cbca9f8551fdfe7924d3dcd96584d210

SHA1
79f6c614d8df4bcc6f92e8eec167d1cac5d625fc

SHA256
f1cc0d9e61e0636ad9f6ad368d51a67ef10e2b05aae6c3102b9c6d5a21d9b5ea

SHA512
46c593fecf5d046f41ae67bbf8afc8c0c51365beb33701ebbece1c0d30c5c9bb6febde829a16e34e9d8f81308480e726864dfc789d4843a842cda1575886005c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
76f5e36c246d40e4c7002b462465f1e6

SHA1
284bc2a7795826d539134ca45a2c21fe1173602b

SHA256
e8a8b0acd2a2f6dcde0d8f79987de76d14bf8047f265b643496547bce2f02521

SHA512
258110b83702ea7b110df4fc9d42a0923248c6ca5319a5ec724b306734c60441b1a9ae9ebd28cecf877cf9ec23266b60ba43b726ac2191a90e7374c6569872a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
b9b483f86d4d605c68538167d2ea36ce

SHA1
7cc681b0d2a00816d4e5d15a7d36d66cb431e7e0

SHA256
2d103e73f7a2ef331c6658686924e459860328346e4f4f4a6c64d69e0f8c4841

SHA512
913cac90040aa1a7354559c58e9273b87fbca97184aa15ade3daa0b958e0ef3014129e2cd94b108e019183182f23f4ced0c8a8ce7f13d34131ffc9abb9efcd94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
b4c5c9d258bf1f7b7093042b2fe79ac9

SHA1
e5e1d22ee994c71c7eafbbc834ea78f6e64bd3c8

SHA256
be67c611dae2412f6fea6024159c83aaabd904512057bcbd0f3f20d23e8d2ec8

SHA512
8719ff81466faa4ddf3dbbe08923a73aa71a41e59d59488ec7acd07c86d826f4f727b103992df7c39c790d10517452eb166713950d927d102981b8ce54d088a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
faa378c77f0ff5cd3685e64dca275bc3

SHA1
c9d753562018b3b274c4f1a6faa0818e4c39e060

SHA256
543836e48cbeeee0480f1346da7f5f642803efc2df583540eba728c65867367e

SHA512
bc555fa4517fce4b19e3c0788593dcb492ec69b9d06126b661675c808a63230d3f6343df8b3950f7314f8e2ec5e0d40e30f1a0869f1f1ee84b6116fc1e037ccf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
e42850cae939a1f75562513731d2f151

SHA1
b426fd3fb41a51ea75a9e39b94cda5db8947a2c7

SHA256
997b97295a3de03629b4522ef4f52987107c16049fb1b6f4fb93e9c2c1e4d89f

SHA512
10eb5ccb067da107c79fab9fcad5e20c8de697ffc996b452847152da33b8612b4e7afdba59acd7565995c9a8a79f17c73cb8c9815a14f3c46e0f3dd17c16dfc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
690bc729d0da519c6d0040e1cf5ec804

SHA1
208543ec888824eddf1bc82dc249943f96a1795d

SHA256
e09e02c8d5a359b2f6c415bfd31606c69269b1c61dbecf729e3defceda645969

SHA512
fd89cc5c5368e819045a3d28acf9bf9e839249f463b92b28afec7d39d9f2cb63a466eab3c9ee691d9c623de47560da0f3a24e7ab7d197af43c388fb2046d4815

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
8fe7eaa7a7f6409ec5beb03cffb0673b

SHA1
a32afaaa2879069e5443c56f2e7a33db3ccca0b2

SHA256
d841080c171087d29a4457f9b537689881720bd955b190cb129827b39ee8ab30

SHA512
6e4579eebd353a1f89de8bb0ddaf3a7930ff9a1b8321c4df057647b8689517f69d1ac88d6796d88044c2843098455f0f1e05592b7336ca9752a2fea0d5083885

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
c2e65866c3ceccbb101c0230d934ea75

SHA1
c26ce5b2558ba88d228eada7e407f7302cfd2ec6

SHA256
81b3028b7606e49a1368a24f688a9f6987de265b822eab4a3849b82ffd683bd3

SHA512
e4edf69cc31a12e1500c56a46f46ec9c8c208c2d6560119adfcd8fcff7354df95c3e08cfd1b8c3193376a0be7195c281142bdc8d7826a2c519a216b899032418

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
dfcc4af1ee7096638943edde1381afb9

SHA1
791a2ff69d5e2bd2edb942cbfd1976557a82c49a

SHA256
1f00c999da15c0a651286b68b4b5ce4122f9de621cf97690e76117c696529084

SHA512
5c4f852994e3ee271c82533abd0558fb66d991d1f4702bb9cf3fb52c8f0befdbd2bbc196e69677ff3dc61d4d7e7a16cc4fa459daa091e25c5a5974b8201984a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
914ad662a4d99dfced5614229904adc3

SHA1
a14bfc3e962fa11575c9e48b573776a401df3723

SHA256
7f162665fd3ad3d05add015a0696a85ebc0c3f5fbb15b5dc51ef9af9f1feff4a

SHA512
59845ecc13d17acb791618ea12de9baacc563199345f885f785aba6897a83f24195f3e7223a3c61d2828f0bc1872fafd71c31277be3102ad4ce5f6f42f2e6ad6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
dcb796e6aef46b18370145345789ea44

SHA1
ee91c9afdf640277152997b20456ce9e8f2db9be

SHA256
fd28546c3b6502212d17636244f2500374b3cf2d3a9fdde5054fbb39415611bb

SHA512
783ca0094089c4b820d741ea4e93627f6e9914e05939cbdf492a917aa5229c9a20d7e89f91e8c1be8431cf92546cfc08c5dc102aa21e00b057068444ad2021d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
27fdc125a36b74be1387721c3d9ac52e

SHA1
b9b3817531cc4f418be7e982ea70196e4ca4ee83

SHA256
5deaa6848e9ec0268e2a7b025bcfe470abbe023ad2bbfdcd5560d4a159f350af

SHA512
2539a20ef343b850f97f97265b1acc0627cfe21015b2a3c4ba9f132622312b8a042be79a6fe18ab3e58ebfdebbc63d47e46710e8693cb053d7918a9e8167b433

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
ba21acc783c0e2cecf205001d2297e0c

SHA1
a914f46e8b864f13616bf1dd87746fd8a980353c

SHA256
dc4c345c35a8ce89852269a46d1d882bee1c76bcedb40c944743a3327a6d45cb

SHA512
e9fdcdb66632469cd817ff723ecc45e3fa856159523fc5eae8bcf8b619aeecf179d79b6086041e86fa381587ae585caf35db88a7ee24f3ee64a4341ec4007983

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
89345f049a356167e479982b7e808628

SHA1
572d36ceabc34bfd643438e76e2bc473641fcbd2

SHA256
75c35f47d9e7bd203e7fe67bd36311980570ef4850a9b6548e0568f202329b18

SHA512
8bc2b54b338cb40018dedcf5b907b31c97e77399007ca1a1a95df043c6b180886004951641b029f137be9159c8b4e3a3cf16b807af3d6cec5ea03f2dadafeca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
891d3c3d23e8a65d6620db388096a486

SHA1
a17ceadea5ba9703fa1163a920dcd1bba10e04a3

SHA256
3ed752012173684f48cc1875cb6f95316d73f426a1a45ba8f0160406e308abc1

SHA512
0c11ff481e66f19e74f8914f09f7b7b4494bede958c861b2e06bc96d3f4cfa044868576e4caa049327138d61e09e7ac2eee7dd1066c3ff0e2d98b373022edba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e64cdf4cae6000120423bedf6cd8614e

SHA1
8c7a0e1521146f4e2102c56bd7681a408ef9c7f7

SHA256
b7ad94ac67fa83b47d038ae2c3640b78617f5dde902fd51634980b75c584db8e

SHA512
4d2f5612ac99a3c7e4f1749eb30597fd0c37401777c7e7d5c4ba1541c5a5ad60d276c4379f22368c40f24b99c788204adc3b6c8e37ff591e58fa1f02308b2d9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
c4b2971314cf6fbba123b79a55e7d49c

SHA1
2f9b40fa291eaf23f612962f0f5357691f9d9557

SHA256
d6539e6de87c7366f678bee40bafd05e085d958baeccb5adb44bf9275360e90a

SHA512
f3ad5fb74be21961124c194928320e17bc5672124cd96cacbe5696202bc2907936889443cd846fb0a249bdebced4e0f1fbcf7c9d0682f0a60de7e737f5f083b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0a1fa81dd26e0428b186e0d6e3000039

SHA1
d248f40886726eabfadc84cfad8fb2de77ef7a10

SHA256
9d409aea65f6a06a1b0e14cc86f0af833346d8345442933d313579b30746e6b1

SHA512
90705e329d66279433c690501de49cf6c01d469f46f991f3bf1765d932826d36100ba16779d961acaf8ad00409383cdd0a1b81e75b8fe25810472907a083c8df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
55bcf930134c57b663466497a47743ed

SHA1
c4416ac326b1099bcf253c1afa1d25db63bfb523

SHA256
7ef9ceb8c727eefc4508ad93eae15aae9fabbe636777ea45e81100eb92f60ab0

SHA512
a1808e875580935f2958df48ece9aa10f30c0eb86f44833253b511ba2ac5775905dfc841a1fb4c6e017503766dce55924fcc634253729e6b7fb414c3a088ab26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
cc5614b3526f16ef806acd7d5940d509

SHA1
56dabaf76803a4862a8825e01426cd4b5e433103

SHA256
59c43913a9fa3a220756402a5e3dbda824c77e9e47c938c4bd920ccd0d56554c

SHA512
0e57ec2e21b7b45d2a93c12f558e3cda09a7d391d25c77d1f1ea7a5fc87a8d80181052b36e1253429ec49a9ea9373efa7faf6781fec9df8fcfd6c40a45f553a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
689478ecb80fb2ad6242a69cbd1fc8c8

SHA1
eeb85d9a6e0275807369fb08266361f93c3649ca

SHA256
1258ae98b7c7bc61fb7af12bf529293f1d4d3dd58cb0b26bbad87268efeb382c

SHA512
d1a1ee07be9c347181a2e110717d56a6675283dc6d61976ae8c9f2efa994fe19a91f71be0be69cd676301aa713a5a5dfdeccc3b9e2df6670222915957a500def

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
48b5db873eb731365376f79141c0389e

SHA1
3c9b48ca891b76fa40ec70a472a9ab2d29b37976

SHA256
0803755934240f49cc5ffc9400baf2944b922822c27266c4be4d77c3c54f60e1

SHA512
b3b469fbc2b255ef8ee29d7fd63cc3b5245e5badf333ba7ad14a076e3a00aa64310c74ee154467e5ed1b1caa740fcb41d21d4830ad6773658c8d98673707f6ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
5298088311d8b2455d56eb4b12a2d65b

SHA1
50cb664533613c2d32dd85dbd3f44d03fcc65152

SHA256
05e7dd2ef2ce857cb86d9b62229e9e6c7991ff84e26ab945c232129339a687e9

SHA512
24bf3baf967fce656fafca11538499ddd9a66975b63fedc0a126c24946d32a934426b0c58024f10cbfe91acbb7cd7ad3624711745bb2606702d262da87129d28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
971ed2b9ae14012971c58818a88c5bfc

SHA1
e9aab29c1cd52265ef30e953a88a2f17d3da30da

SHA256
04ed8a9e8a661b5b506b4d51b2375d763a1114f432c8160044820035300d0419

SHA512
1206d0a49e735d6d5558e4f3b74c80d131203a091d5f9f4dc28c788c135bd36b3141fd0bd0fa15acdd5ccd81b90bfcda9d653505ccecba2f2a4494a1d25162a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
372B

MD5
5c92bd1ca8e7c34136757742d256142d

SHA1
b4bc32d0ae804cae561fd1dd7603ad6746a6325a

SHA256
9accf10ad4ab5307f608049a8b8e92e36bec09899e0aa03fd08bb4b11521c71f

SHA512
bf2023c0ccc327efcc6f77dd8134af88a6bc9d71b906023a802992d0a595aad165a3e66c427ca1bf817b6381367b05f0c0d142cabb4ef1a61c61e210eeeff9a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
db41e9e9b0786662f603b253b0d3c5b3

SHA1
a457dc0104ca008e6f5bc4552478732b9f9b974c

SHA256
40d810fbd80258fa29c4284313b331237c5672efcd50e13864a5d66abf5d9c0e

SHA512
2eefc85e58b5f83bcee59653e42f49fe8cfa2a41a30e7bc64f4d58e2914ae05c64f3877035f67b070bf763ad25d6bc4b23646c14cc803316b682ae4e183d58cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
11e6ddc7c1daa8012c4cea17d3d554af

SHA1
764fbbe9c4683da40350224acaf29282597dfa0d

SHA256
09b2a428ac6327c0f3db9dc2cb7dc5773b2b7e097263d34b88b3212afc886577

SHA512
307eb3171696ddaf3b4eac9c4290742cd03b6d6416c21d1ece040619a653973fa15dfad481e0ec6d69e207a2158c1280ea00a9663d37763e952fae71a45f6afc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
93acd1904561ac7cc5cbb8b1d3bf1cb0

SHA1
9a94c44e7d96d3c86cfa787872fee057d2908b98

SHA256
dae077519d608a4bcc63132e5e8306d16e51321c6ee5ae946b2c44448233c46f

SHA512
c13ccea6e8a57c7eef7114478db51c8444c0a98b40e84e0f62fe0860fe8248fcc96cf4afbd21fad6f35682ae44d1a2ae6eb9de06409e59af7459a3fda8b05537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
2d324e9b1fad64d7bfea6433a5436170

SHA1
5b494b8a5c1f778a18db5aad2d4edf19a59df164

SHA256
98693229d8c8aa3ed5481fac945d8de87fb4b61ddc2e14e79ec93c5b97b8285c

SHA512
d5b85b21a05655e99999725f087492bd31c82f5d01da7a0196fee64b65969df241b2a5b72bc6d3eca49f184b7394a79b3d3c994748ce0e64e83bafed04718281

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
aa759f66aeb83bf696a7a615c0ff7684

SHA1
caf36148c6dd8a712433b70ee793e215ce1b28ba

SHA256
28095b9fe64c1b39e0f71587fdf940289350432be5b1aa3ad2c87dbca39a459f

SHA512
ae7a6d52757abadf3cbd4a4bf2aab119a22d70c5eefe62812846dcc542f0cc5862303d3b7445c449a8f042212aac4b77c795c41a8bebf7a71bea3a7d22c6626e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3cad6565236b077a8bda675e0a5af3c7

SHA1
6c734dee0937f0376b094be8531744b44943bad4

SHA256
b6e293688f0876fcfdd5f17f42f066409caf5a16970b4628cd95ab206a2299d3

SHA512
ec812b77b33589c8727734d8b5a95443a5f5a3a82417ce7f428a2744dae27360e7e96ea6a85ffdaf9b36029497d235ec5c66a3090dda5f694d48458fbaef6d22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1ae49f38125997fe10609e31dbc01396

SHA1
3df42d7fb2b0113a4501f6e656f743fdf2f54e75

SHA256
d525d4382f040ded3fb838fdd3b2463a5b2afe70c3e2b2c29878398921ed18bd

SHA512
366d383fe42ce69cd7a2944752f50af6009f4c338eb4767dac247161b05d98b81c1d405951b3fed32fa6764cbbbda13a38372817cf3f0d93972194cd949caf72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
35529463de777e617517fc04b5a7a383

SHA1
d1fe2fe41311b3ccdb2b193df8dfbdb47cad2f0c

SHA256
0873de828b7c52d0269325b8b6a18d7c9f9837132ed2ceb7d9885b3cdf8c505f

SHA512
134be4f0fa7d79379abd0d543994fa94fd7e8ad4b47915dd2425aa9397b49d2ca2b07ad3a3b47403314a9ea898e6322a126a532d3bc88d3ec76cd35e90ee490f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
6d6aec14655b5354b9bb1a5b1b9183f4

SHA1
cbe67f287fad4116eba1f49787ac223b77e89e4c

SHA256
d5809cd4f966a9b2bb112a055a995a8eeda6d7021d34a36e3e6131178e12d5c5

SHA512
2673c0649ffb5a3a7e6867f4bdd99da539f481d671db15bf1262271cf607c53875872acacff2e06cb29701b5ab843f17f7556ba201b7c02c0b4afcf050d3550b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
3972b96f555381e5a86aef6c3737b2b0

SHA1
0a7fbc75ee7ea52bada86dac1bada7e2a8f5440d

SHA256
3cd4396002b00ed1f16c85d21fd24f7d9de29ea5ca33e9eaa0215c2e1dd61d21

SHA512
b294be90dc8ef581f41a514e0069c505bbc0765d45de5bba90e21cae942fb626465c4a0737f6da949fb3eb5a0227c30b9aa8bcce4259b69ba7a5050ec277d513

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
557c0c9f59bd75b1e4a7ceb40b748384

SHA1
3744122bf05855d3f10e0d4d8e65f44a98dc8c2e

SHA256
108845d93e7ac08b7cfac2c0191af5a7ee9b52d5888807775ed4bdd088ee486e

SHA512
54b843c1d014a7480e6816fd5e31d21b66c1edb9fcb90903b4d00b008fdbc48c2d2763010621ea60612f1349c181333409b2c9fbd6e206cc8369d8043af8f05e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
99d3e0133b1e2842e1134b77f325c902

SHA1
6903d93c85e3b2cc3d239f502e6cbc14a71c60e0

SHA256
601647e448451348245dd8135fd860715b631a8f34aab1d84d51756411b496f9

SHA512
09f856f14490cf24a794d4c42ef5b213ec90a821cbc5a9500e2d0ef6381f602ae6524de93ac0b5f520609e4e995fe99e9b9faa732f63135cecb7e66452603b44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
82e51bd9a3f65ff82d3b4b6201315922

SHA1
7e26f62d79817417e65f8b437b3b1c0386cbc1a4

SHA256
1d9a72cd29fe15036d0c11899c213a89ee4f08e00aab94df5caaa89101c9c2af

SHA512
2b76949c949b3990ecbdc98c03ca0ba323e588654e9c77c063b227a4a1bc2d69adfcdbe0625da28b39cf96320fcae2d364c681fdbfdb3bfceb9cf8536c571e8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
abf8719f96ba7501702097c2d30d593d

SHA1
500c34a8e3c951d68c0f57c7f180b06a1943e2e7

SHA256
b2f954e9221c8d14dcb2fd35d62ab6af6ac80ffc33c166b603e4889bc62ad526

SHA512
174e25bacd98fbe99473d019bd35ce07be479e832bfd253349588de6ac0b9226d8880b5f0a96cc9335b9f3c36b2f5ba4062446af5782a897cdd7ba9e19f3473c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
2c95f2971cca0414a9c01fd0e4c891e8

SHA1
ff3f36574adb2156858a00423e7448949838e234

SHA256
2aed7f34ce1487f7d7044dfa83dcbb80c310c5fc04da180297334144f5b5b24b

SHA512
e13e7f1aa2c458b71953ff95089757579d1c15f42269f86c2c1bcdc7c1437c86815d7f45b7b664b392439f82e5483c284138a9540b1a8712b6936f7c0c140481

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
e71e177395478ce2b7672dc6c134c8d5

SHA1
e4758c21aaacdf5d29dace737d435d1eeefb86fe

SHA256
492c7930b533118e2e0ec6e3e08e41d0b5cf83a285abc78b25752102c62eec01

SHA512
6ae5b584b5306d4507c99108e9a38f86868102a738fa1ba5cecb98a3bf0797445b07fa9ea5f602c6606c608def26c59c8e026516f15c46594c0dec50e77351fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
2fea52369e6d1124d9ffc800e5a3be84

SHA1
722c17eab0af8e6bfcfa7a372fb8defcc3dde638

SHA256
7439e413ffc8234b0740fa0bdf833bc126d7443257ac2689fa90a23a278a710d

SHA512
37723dad3a9a8d47e9c681faff67afb076fe528b3774861d8a18a95a88918681fc0785e18a8994eeba1530efb4a069283d0b0fd63c380aea1dcb692c12a8503b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
497192d43858105d1e7647fce97cc97c

SHA1
1f68067eb27d0e62f32055a6d4b24c32366dbfc4

SHA256
fbfdbe90413512e8ea6c047376a6f06e3a8169749cc37a865280ad9d1b409426

SHA512
07bdf009b9b1584ebb2772e4978195bf8fce9f7cb49ca65edd5284d5112893e7167a4243d0fdfe78af9a5d8b14a89cee6af63587fb5950e835a3de195c296feb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
6dfcd6e8dd13bbb754177d73d32b3c8d

SHA1
87f2097c1afd5d06302338d8b8e88987647d3183

SHA256
ddb7a3e11a780f862d14dcfbbeab80de723b08e1e67d20424e6c8d0fbe81fe48

SHA512
efb7b436c469bb965b640704654982644483d5932f02ccb120aafe43476fc1d5a7e3400af42205e9172ff11c2a80bd15ce45df2228f9f3ee85c05962606fbba4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
fb84bfb22e404eb382c88d217e1104c3

SHA1
f5af98bc51797cf07b2025ea309b0fc0069c4e64

SHA256
11dcad7df5bd361496d0bb68d123d9ebabeeeda721b851e92c932352e959d0ba

SHA512
f6f8b5fc932a6acec9ca388ab6f2b840c6083a79828395096aa5918e33af9c08d08abaf22f40f0a27904d148e3b00ab0e2934e5aab276f883bd6dcc803d966ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
cef2017b5c6d7c7c9d3b0fc594cd17b1

SHA1
c122c44904e0494048e18612bfc492fe97997f4e

SHA256
e0b64bd044396f68122c33feb805b194b9964adff5bd146e00682b278dd91ea9

SHA512
5e7f6dadbee24576855a23b09b224dd36f210604102dc7cc7d6e0427e2a7a774afa6ba1ccaa4f4364cdb408ed2f6bd55601d406abf0cbc7d92add8c36fab3711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
549817bbf8897069f5eb8796d2111552

SHA1
c47297cb94736beec77cc8f17ebf6ae4b4ad5935

SHA256
d27d85d21868bcdee7effabbf2177ad5f932e901c6aafe0c96c43c6731b89266

SHA512
3786b52529a7883ac95cfe5ef48d0d3c627d4833911e5f0872d7555067efd034736e651ceb1c4c6643d5b41de47a700610bb70e5c43791ebd73b041a4bb4f469

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
70f9c675f04bc234b9b83161f04d9c4d

SHA1
94780777b8c6539b96ed67cba8935f9ebdc00289

SHA256
0fbc5ed4f3bd2508ad06a52d703fbde1613373fbd02d59f372607fbae367aedb

SHA512
35068104f0964e46b8cb2bf8a6f921a1b4be9d39a596821bb95ee33fc046c03aafaa55a403487d68ca757137ede897b322eed89a8f0c0d48155bc1238ff5c4fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d5ab4f6a5d862502acdd0d69377c961b

SHA1
33a25652e5e327c3e5d586881875d0aeb19229ce

SHA256
c0eb19732a77c46a5febab88198bae1e78606c1b426345649607e21d1aa52a81

SHA512
a7d71e672c90ed959b277179e382444ca63324f649be430d1b6e71c4e3737b34fb11a523c2d9137f000b241a9206545ec49dc0322da2f02fc6b3f972a5c872f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
986c2f654c21c2ff9a352ca3ec7b020a

SHA1
be3131437963ad06d35e8875b07046469b655fe6

SHA256
f1f0faf3de02bce8d436118d5658322365adfee31fc428ce271b3b2daf6dd5ca

SHA512
c070e277e7ee2571067678bd1f3b382ef535106463e7b1342876e1ddbda5c05a22c356c0c3a21c67f4a21ecfbb127eaaa09f74b34d7ccd192957f1ec5f06d244

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3bffd453c9956216554c7f6d68064538

SHA1
3de77d22e1475f1e1db5ea348edc3aa666d911c8

SHA256
66f7439b4a30173d2164fae0dfa29a602964b4fd0fe0de53428973f18280b892

SHA512
7488ab92cc11b634f858175d30889719d7026ca99cd6951d2546c1872810850adafa987062c609e5b6a9f308e10bd5b42732067654e5b460ba03bd810c30d4a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a728cd8e8d0da35f7e5ad977aea4b135

SHA1
354a3125c8943c71df6904309b85f09ba6194411

SHA256
e837157b2ba7edf2c6abe70299530c3f7bfbbb696c097cce4c3a4f8887a3b8ea

SHA512
8b0c9799ddf1227beaeaa20c792ab85451721146635315b4d729fee2991fe042bad792aa46810a69af50b334f14dbf173c54711445c8ce5f063d7bb2825b48f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5225d8ecf40df556a904a4474533e39f

SHA1
259189e28d76128b1e0d3c49c706c4474172e11c

SHA256
808c8436467e2b6b5819e766f083c8ad823df0c8ed04fff6f6b11b2e378528e7

SHA512
4099f72fd7d4e077252ae17c833d60668af938ff613a94ad20b04dce1be58691b2b78c3fe90c1c6f1174b6d41535e2ec7fafb66ba3456107c9aa34e0637e6e21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c907a6b7e25496b9e5e6e68db0ed9a49

SHA1
2c059d28e9ccbdfa149271030c2b75e35d1f20fe

SHA256
26cc8fe6a86a5cf003ae4db5b94e953b4cd38f845d243f70718eb2881fc75b11

SHA512
475c13aa87d82d7603fdbce309f78cf9bd177af8c145b9589b4ce160b9906449b52fd2337851ffd5ee3f282cbc6c7b996951f39f98bfc06019dd4d19dc6a1488

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
40b1213d51d937494e6e8b9ee96f006c

SHA1
3435706936915d6b191890a4a713f2057177a4d7

SHA256
23e09c1c2c710fc90ca77a629e756916317bddf3ccb5152d7b35d1db11b9d32e

SHA512
e9599a3f73f2e267be9dab4c99ca810e5ae78294ca401e1cd3bbcda46500169b3739f9c5335602256cd46c56353799127aeb1d008ea1b4ce9a5412987950cea5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
571b1cae7350b9f6174ae2a8307b9078

SHA1
1ae27b207f0d3476e9aafc7c3e71d19a3e3bc678

SHA256
3262316f0e6fbbd90b088a0b0d08e5aec9f8ec1c80542b210f0b69ccaf9745df

SHA512
acc9232c4dca8cf5df3956bacecd60a17c647d9e9bc3e45ab844489ce498acacfa83ec0bc5a8aa23531cefd3caf8c7c7254e06d6afe1d4de81e6c7fbad070a1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c68ad42f94d15aef6d24591d44252a25

SHA1
fcb342c78417d5d19805e411643f3280b1da1abd

SHA256
ccd86442fd17e8735097ef57647894d49328fc67423261b6a7fc2f9216fb89bb

SHA512
f74e4910546ab2f8ccc8378a11a617b16b69cc6595a39269a96fcb468f02ea0bb6b63eb8d3b09a7cdb27b598580afc891c0a6dede4d6835f80b60691b67b1ac1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
865a9c51f08a752e5d1bf00cdebf7d76

SHA1
ecdc3722ab9f3a5aa85a9a9ff7a76df1bc412392

SHA256
c19a8cf2dc1ddea7dfcc359e4cfb59924cc1c9ccaf2a15de0e70d6f97a156fa3

SHA512
c996d01ed746ffd72a1aeb40f4eb668fd7d5b8be9d57c6b029c8c39b677d20933cfbb9083177d214cb4e9abf79bc816f9b4d6cf4c880f7737d948242e9a0e170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b030b6b82e839d0bd5c419b4803d61e2

SHA1
d6c1a160b465f07dfcca956373b2dbabbc54642d

SHA256
aca3d8c2211b95abce7ac97bfeb41a4f1ff827d80b7dd0f8bbfb8d864330fffe

SHA512
887d9da5b8f04564903851a8fb6489bb9b978558425d70bf979f517aa5e10a10fe2a9c42d6d78ac7e40d0b11b6ef9f6916074ac08813a950c3904ab1f9bd9790

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
482d60939360f05a585589cf75ebcadd

SHA1
7142fd05347128c5eb1b9bd31f5359960161a5e1

SHA256
1553f93010eeca64251722d2ac94f551ea6915f1a99661f42a460cf8ecbd86c6

SHA512
870fca2e9d709a7c50ad42c3dcd51394314f10f5061288e0f3e6ee48516ea3ef91869e40509d33142497e58d1a868ffe3b1f025e23c5a000dda7ac271e93dcb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b3de3270ef90703ec7cb675b7db2114b

SHA1
52d07c11e5a2c2e2b978ea4cfbd65f6c87b4674c

SHA256
9b5ea89e97079960b2df94fef7ae72622ceb0ffe36dc56591d90c753a04496a5

SHA512
04c5178ec4b366ff883bf71a68b098eebe6e13adee1b29dbb1448f330eea10bfb23a3b7053602ab63c9f4ef9d64969bc377e3f363b335c61edfd7a178c7a3590

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
746d07caf91aaadc57597f8a205a29d0

SHA1
e5e0322c6c94f76f0f555f330482310b1a1bd95b

SHA256
7e2bafe6f446a948732b3be3b411b0ab1f82c830501df91d8344d1fe38b97ddd

SHA512
78ce8f99ffa5a33dad39d46a6bd90d7892421cf509ec430876fd9df072cc98e57626f9ba4fae98d4c2116a17254d1ff940edfd924c179952ccf50a71569d90a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
026ede01ee0a36a8b0e57696aea67ab6

SHA1
dbd455660371f7de73171a974d4058d59441e5a7

SHA256
fb10e8da9cedd809c2eb6767462387146d124f0ba44105b3d2babee741eeb4d7

SHA512
6d4e18a205132367d098a31775b11314454b9ea1e24444cc20ffe19467727d5ee0e3ca70a258769aea417ce77c974ff3e4847cde111ada47288316471eb0ba79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
cdfce93e22462c9c1564edcd18d81330

SHA1
b95858bf4ea7b41d0557fc46712f989fef00697c

SHA256
912377f29ec3f46d8cd9f842b94823cfff0dcb075e1b0784ae0c1cbba0b983ee

SHA512
dba0726e294739a7940de3e8d732562c5be5a04e6b2581e8033fee8afe3642d51cad133b46aa48a1ab5a75c91e7bcdc3cbbe43209cfba9cec519abb23da124cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0b368896315680b4641764a92b9faba2

SHA1
a9ae9b1c7d95a82933f864de679db7815cb74372

SHA256
55caeeb52fe494fdd608c79fb139aa4230fd3dc5df11c92723d4ed6df38cf576

SHA512
e13decaa3e4b25e0d2d7d8c732ecd5d760c13cc392e5218765a1b7899bd9b52c9334d0d4d44d3afdcffb47f17a5512039be4e9745fb7d089734dd12d9bdfdc1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
09bc94bbee79736d22b2c67eabc83cd6

SHA1
b9f2e2031e2f69f922648e780c9a2d67182dc2e7

SHA256
92ab2a7cc398f0dd4b74674f9090924f261c24e2d4b01d4ee10d350da2bcd71e

SHA512
039b8fc93a066c118eef2bd523c0d5a7c056fb52eb725a87c623059ec01d347ca38e659a102a94ff37d3e0e9dccb0498009dd3ba0d2855a78625dd10cb32d4bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\061702d1-9fc1-43c5-8e76-026b13b3ad49\index-dir\the-real-index

Filesize
2KB

MD5
0a7de1ba70b6f93584ac94991f0f6bb5

SHA1
d50e1baa44ddd742cfed65f93a97407098bd3161

SHA256
d248a0cab9452b05fdb81f4db236ea8f343ec117ead9fb88486c0a1aa10ab9a7

SHA512
389e1009edee2b979bcb95b3e11fd41cb9bfc8c9f8b66917448fde9c8254c547b05c8eb41b8ebb5fb1be5b6a2a20cf77faf5a55ee3827d85644498698786833f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\061702d1-9fc1-43c5-8e76-026b13b3ad49\index-dir\the-real-index~RFe5f5146.TMP

Filesize
48B

MD5
61e27556d84dbf7df1db25bfe8e5c0de

SHA1
d11b5a0af7862eda4d2f5f47dd5b8fafeef62180

SHA256
8fd96d88215fdfeb1efbf41eb508310fe0752c52c78a4287e9463c0ca0aba77f

SHA512
e0f495f4617667dcb3ba3044da4e41ae21cdd7eed50c8e39edd1f999d313346e27061ebea6be3eec4622744cd53a5d444eb5700acb4bdf72dc8c8fab7125a4b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d58960c2-4a58-472a-aea7-52fa212a11b8\index-dir\the-real-index

Filesize
624B

MD5
9f2d0639ffcd02197c4ed45708519837

SHA1
6b98d4aacc7b78c0f781427854af6cd0a40250ce

SHA256
e02e687e3d8d015dab63a2bdccdddb324bb50c0a1edbbe8945ad4744c51b3f89

SHA512
1373a1de78f53bbd682123b0bb22f902c3e5ba4a474bad6b82238337cbd03fad257d4a011ee3d355e5c1cba831d245f1134db7e8cb9a6bff0b5ea3f98a6a69b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d58960c2-4a58-472a-aea7-52fa212a11b8\index-dir\the-real-index~RFe5f7642.TMP

Filesize
48B

MD5
75640355508122151d8f10db54a746cc

SHA1
6e4a7a6bf0a7550b8a29032191738c04a51e1f2d

SHA256
266d83283febc03a6eeee8a44801fb1e1de4796273cb5e3234d55fd8c3945eee

SHA512
4ec91e8839c3fad509b907ac59f3949dd70a96205731621c73c6149264bb7ea2e84637e91e7b5eb8381edae5b928a440ffa6a44dd28980d16d6eaa0da5094218

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
771c29311815b1ae4be24f9dd64b7de5

SHA1
8222835c51db899672734973e1e0af4c21451c5a

SHA256
7449ae60b31a8b659a32aaccc82b19995cb7fe3955479c92c6c04f8e6ae74079

SHA512
a42c0f5533de3cfff4c416b02bb09b792017e6ebc7dcb15a1ebf37c4f82fe9a1b4b425888415686a3a4981f35f9b4617dc83df5efed0702c861fc3cd97fc71c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
ff37cab85ccfe66b1ac856a58e6f2415

SHA1
5f0ad0d7a27ffeb2bd27e1f2e17b8d07e3f0a454

SHA256
008c795e39544877a5b793c3c2b994cbed92bdc09fbe207d8772f4983290276c

SHA512
8bf85247e66a93651acbb9e38009e973cb4057afa952842c88179feef2a246be99bf28007a61652f09e39541297b2eba9cfbfb411143ba24f4d761e099dd3c29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
185B

MD5
aaac3d521d7645bf6753a56c2e56d6cd

SHA1
a90c626a6cebe00bb8d522630cba5b17fba16bfb

SHA256
6339e147501878866944d2b5b7f192e688e2ddd15524ac83c3df70e61827f92e

SHA512
486fc48876c86d24bcd0dc6f5e7b4294cfbfdbd93ecded7282c2b04ddf6cbc08529e83669ae1a7b77e6f5fdf9e7fc5d0ba2bd4e62137d4638d1e6804b68353b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
183B

MD5
2602405548d5f37e8a070aeb2d0f5736

SHA1
a5e224e4c1cef9796fc648193849a46e005628b9

SHA256
9d2dc170d3636665a1b03c6d8699649d4e7af8430dd6e315abfc455752729585

SHA512
a73070af91e3e5acbcef2352ef44c629e6ad4a12b78bf134ea33ff79edf4f98023d668f1a8064684a86a0ea7f321e193841e6f97f561f818855cbacf23a54cf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5ef3f3.TMP

Filesize
119B

MD5
217fc2d7d590af31f8a1dea632daec0d

SHA1
318d59ba659e1710378983b47691119e14f7eecd

SHA256
8555686b8091ef6c8f1c0218fdd4d84c20d91f0b29b567997e7658a7d98b3c02

SHA512
f253c2433267dc61fc857a312d122c273994e6c9a0bbc839c9d4492cd1082e7325b7000dc68848684461d95be896ee6792fc37d7be379828d5b8d138703f1ba8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
de28b63e8a706172b9aeecd05ded36d6

SHA1
9bf848391dbb9abf472e13f00cbf7a229138c8f5

SHA256
80076021fd5969de8e768ef8330f771c618a54d6388191386ce1c7a5f804ae25

SHA512
2e3948cd31e7e1d23342e613b3a1b115507c1b35a11ab0e046031f229229eaef565b19fb5413b4e6f990d4a2027e95f1495332cb3e9b2c73a85e013c32134de8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f44c2.TMP

Filesize
48B

MD5
6e54485b6cbd8bd69b3f7baeb9b5610d

SHA1
a51b2da7d15d09d0a37e6ae354a70d784d35a50d

SHA256
8c2ab3384f7056d07170c4ac50904cbeca42d87465ac32ad354915503379e06c

SHA512
67fc1637559da83f5ab3639babcc5effa46b883ebf7c84617d2aef5368963dca53e867870fb4afa56198b83e70fb1cd4151c605ed41ef9f59c44dda4eeba1b76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir804_480417825\Icons Monochrome\16.png

Filesize
216B

MD5
a4fd4f5953721f7f3a5b4bfd58922efe

SHA1
f3abed41d764efbd26bacf84c42bd8098a14c5cb

SHA256
c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3

SHA512
7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
168KB

MD5
50536828758c430d8f0a27b077dbb88a

SHA1
17af6e68c575608c2f53daffbb7870a98d0565df

SHA256
3bab9d88dafc4f62abb5ae5569aab3ec45a162f2b9aa64314524ee6910ab981a

SHA512
5494a91f126a65249a710ad91cf049dffb9395d6480396571519918381797d24cf84244affc1885a420b5b8dcd18ac84fe1bdc0c5e8b0f33a74bd643526edd02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
5615510ce538ffb4bab3d5b6043c80f7

SHA1
8fb444c03b0f2824ca405fb09cbf014e4286cac8

SHA256
8a698dbc15097d3125e56e6f7ca4aba3f4fe9760b815c2f696a12c0e0c659b25

SHA512
3902244f1120b020b297ac45382a87a9992dbc614d134d38b6b5c1eeec15b48d3f3617f80ad1a596493fb0b364959426f591cf3a2cb5cafbfcc1099fd8ec409b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
44cd80a8463265a326431f4b1df9a2bf

SHA1
04536184e9b1d2d01f91e05d38f0f09dc0206ed3

SHA256
003b4abdbef6a47c56299ce410d8d1d116278ba4a015d3a609d49d5ee8431d26

SHA512
ab011ced6c60d6edef488cb7a1faf6c1b57cec3f672c21c3e9f4be3d607dd50d8d813d18dbc0a3bd51d14a3399e8041ffc1fc17f551cbc0b8404537db6ca30eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
90a2843f4f54de26cd2d153d4b4d3ef1

SHA1
8dd007a754bf88ded71f52495dd9e71d51c9a9dc

SHA256
86f126f030efab9f4c8805f3f6669b38b9fac016fbd72dcb9dc49106673de298

SHA512
62817a12dc37ec8306df14601958576bdbe5cd3d52559ca58e621b31c9571b9cb2f2516e7f20591edf774a1084cee47d1715f754e1079332ddb325f3c7aea527

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
19f99ac79085ea7a62bd60984724cb56

SHA1
6ad007030f38a859c4aec83cf7f63317840a5e86

SHA256
7ed258c5f467603e70c928e80ecf935f1adcc1f6c5c66386122773b43ac6ec9f

SHA512
b9288fc37355af12c3a9e4a11ee687c0654052cb23d0e1037147589d6cbe972dfe03cfad5c18b06efa31480e3fc76ba651e05c210693eea6a9db6702a2c888c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
167KB

MD5
6b1add7b755659c76a4465e819544e19

SHA1
5548e62a8b0e3c22333c5773057e0e638e93cad9

SHA256
3a0fa3cae1ffaa60b538c56aaf7d34aaf9753c21976dcdd590f6beeed5775c16

SHA512
7b762ae6efa4274256dd1c393351b6ed56497b10c7efb27c8e873fc09dbcecaef6e9bb0237bcd6d1bf6dbe3fa37d98aebe15063244803b3cce1d66d9cc2d2ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
088dac77a2958f31aad8866a16ce5d61

SHA1
4ab25fdbe3c2707792a4a88957dbe4b1e79f23a0

SHA256
2d57397054d46d179d9784be93a704210781f1278fa5eb3ad03d252670140215

SHA512
8addc8a0ac88803a591cc3ae45b792b24d1d15e01e5e5ffb45ad17d37dd786f62d6cf2bf68e15ef35103d85dc06fc59eb3987f4b2b4ce618aae4a16c0e8ac54b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
31a6d521a152bb6b1dd3e30e0b71f09d

SHA1
4aee89d25f83de5be4896e898aa87e0ee47f148e

SHA256
94bdabf7a297eb33b56e6b5f9cd97bf9982394209acf539caf142d7d35770853

SHA512
857454976de7cb1a4643717a721c8c10124e09c5bef74f570c45c60d08eab100d8f49de4a1b392ca373abf32ae21b368a5a671c90781c8170f35d8a3f8c4d23f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
86cb930a8bb32a993bf6a0e85de21c1a

SHA1
ef26522f30eae62994c58da115bf752db77becd4

SHA256
27e46e35f16bb62918f8f59eebfa983f9db0107e035f26d2a49959e966d395a8

SHA512
7a306b5bf4ce775a85f92592f694dd5af2e4c86b20109a7d2c16dbd554435042b4cbb566ee11c46b91d6c34b5a6363e83b7d97f6e90e8621d9f040e421ebc949

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
f7958976863517709b88747a8e6e304d

SHA1
bdfa25ea35f9ac8a392e9d89ee9e3dff77f483f8

SHA256
943cae6ca20cc3a1c1fdc75d51eb56eefe028e03fe92adb6487b5e76548f1326

SHA512
3c880d53b6412d9db35890feb709de590c9fdbb47d1affd20a926c636486ca6b5ae0e0a9783a4e8854c03d5b8de7bb270b3debe18b93da0b43e160ee76fad550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
2ad85e56b152cca76d99a042fdd74dee

SHA1
34aa5cd1dfa298ba2b72f818b9dade567ff83fab

SHA256
ad5a01495716951af95b5df5c498374c32985470790020ca1392ae4722fe976f

SHA512
c1f8013bdfb32cc3d1f4f8622049b99522ef2b30f5a69a6b1e3e12be5b9a5296af14dce451c87a6061ba62780c345b61679fa69e4dcf289fab549c32b313956d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
119KB

MD5
b439b498e4087fd3cc20e06c1648d834

SHA1
7a55a1e693cd8f5c31a420a585d780955c237cfd

SHA256
4297e1860287de4e7a72e22a4d7aef968f1cc59273cde64770cefb83c27f12d9

SHA512
87a84299a257f0791b2fe135dab441dfe2d6d1c83b5f8b04a812e16e528195f058fad4a5a433f447732af4b313003994e957c2b2369ac3760474ceddf4eb146c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
07274392ce69f387625c31cd4481f5c5

SHA1
88ffa4452b497a8d00a8569a925cb380cf3c1fdb

SHA256
d3c6f4b3ef3b87e015200d280beb652113f605064c4f38b4d2f053dfec425c59

SHA512
8e8ccd40e97bcaa07b03a274b303f219a1e065424a62db035d495cfebaa309a4941de3c71cdefaab652e70a56fc599358dea62a63a5807b0174b0c828f57077c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
4dd53c0a1e0a433416ba2cb7edde11b9

SHA1
d52bd29dd6f2b0c7b729b3c3c2b3b3b05d77787a

SHA256
aca42167aae6d4bd6f5b40e9066470d152ebfd7524e0b7f2ae5dbe185a1718c5

SHA512
6264faae666945472916fa3c930b9f91304fe410e982d63f8ed971fb8c4ac67be5f14428702feb427b6e9ebcf01df8c48a1cf202364d047c9e6a633754eda465

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58e4ae.TMP

Filesize
95KB

MD5
8a851a4bde1579dba29b0b7f291242f7

SHA1
354910fe60586384c8b0d13b9f599d05525c66dd

SHA256
4d140f915e389f51e15b81918d59b280e279a2e629c386d0358aaa0e89e66f8c

SHA512
10b3b718569718055287b41fe94cc93474d6eb81304c515fc96bef9fa440593251ae730bf29a8dd1595bff29728371a4eb9e5340d53c782a738174ac2abc215c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\2eaaec627d05c9a36db0a75f68c21272

Filesize
5.9MB

MD5
2eaaec627d05c9a36db0a75f68c21272

SHA1
9c123e54b8fed65b0c768c1e248a3ae78964f625

SHA256
18eaeff48f24edc79f4b81a3d5d74644ba8e57653c3ce0a30bc15df917964452

SHA512
cddd4bf4c19dfaf39e97b65ffb20094210e53aee9d48a6785e104d8d71de39ee8d9faac247100f5c867edc65294df546082de692ae7fb00a89c711e63cd36d5a

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
5.5MB

MD5
5b6171c8dbb01d6bff4fbe433ef7134e

SHA1
402261ab9ede4118da88e15a977e48b06138f9f8

SHA256
b693b5678a7ea4620b1a3959ecf9c4864fad30ce9e2b195433fef28c296aff72

SHA512
ab108c6890bc4ce5956bb019f339c07d0bca7a998ffe09015a177bc3575ff847f36fd2e1123c713d99131d60a4b27323db911a2bc9fba8b7339f98a2c340ee30

Download Submit
C:\Users\Admin\Downloads\Solara.Dir.zip.crdownload

Filesize
9.8MB

MD5
904180f536e3c47bbd61e451bb9631f7

SHA1
20c0e0294ec39850545b6c1844864b0339141825

SHA256
5a072e88942b37c1afbe54875bec5d7c830868cd9af514ea88764af9a2a10fb8

SHA512
806d0aa5d2e9c759f3ee6b9a3a7e7308c16a7172d9e76a8463fe696c3a941e1386ea61ce428414f9114c55a29f95d395068205c25f7591771ddad2dbec5f344c

Download Submit
\Program Files (x86)\Microsoft\Temp\EUEBA6.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
memory/1952-1757-0x0000000006B00000-0x0000000006B40000-memory.dmp

Filesize
256KB

Download
memory/3140-2819-0x00007FF85FFC0000-0x00007FF85FFD0000-memory.dmp

Filesize
64KB

Download
memory/3140-2847-0x00007FF85E170000-0x00007FF85E177000-memory.dmp

Filesize
28KB

Download
memory/3140-2840-0x00007FF860250000-0x00007FF86025E000-memory.dmp

Filesize
56KB

Download
memory/3140-2839-0x00007FF860250000-0x00007FF86025E000-memory.dmp

Filesize
56KB

Download
memory/3140-2837-0x00007FF860220000-0x00007FF860230000-memory.dmp

Filesize
64KB

Download
memory/3140-2836-0x00007FF860220000-0x00007FF860230000-memory.dmp

Filesize
64KB

Download
memory/3140-2835-0x00007FF8601B0000-0x00007FF8601C0000-memory.dmp

Filesize
64KB

Download
memory/3140-2834-0x00007FF8601B0000-0x00007FF8601C0000-memory.dmp

Filesize
64KB

Download
memory/3140-2808-0x00007FF860270000-0x00007FF860280000-memory.dmp

Filesize
64KB

Download
memory/3140-2809-0x00007FF860270000-0x00007FF860280000-memory.dmp

Filesize
64KB

Download
memory/3140-2842-0x00007FF85E150000-0x00007FF85E160000-memory.dmp

Filesize
64KB

Download
memory/3140-2810-0x00007FF8603C0000-0x00007FF8603E0000-memory.dmp

Filesize
128KB

Download
memory/3140-2811-0x00007FF8603C0000-0x00007FF8603E0000-memory.dmp

Filesize
128KB

Download
memory/3140-2813-0x00007FF8603C0000-0x00007FF8603E0000-memory.dmp

Filesize
128KB

Download
memory/3140-2814-0x00007FF8603C0000-0x00007FF8603E0000-memory.dmp

Filesize
128KB

Download
memory/3140-2815-0x00007FF860440000-0x00007FF86044B000-memory.dmp

Filesize
44KB

Download
memory/3140-2816-0x00007FF85FF40000-0x00007FF85FF50000-memory.dmp

Filesize
64KB

Download
memory/3140-2843-0x00007FF85E150000-0x00007FF85E160000-memory.dmp

Filesize
64KB

Download
memory/3140-2817-0x00007FF85FF40000-0x00007FF85FF50000-memory.dmp

Filesize
64KB

Download
memory/3140-2812-0x00007FF8603C0000-0x00007FF8603E0000-memory.dmp

Filesize
128KB

Download
memory/3140-2845-0x00007FF85E170000-0x00007FF85E177000-memory.dmp

Filesize
28KB

Download
memory/3140-2818-0x00007FF85FFC0000-0x00007FF85FFD0000-memory.dmp

Filesize
64KB

Download
memory/3140-2838-0x00007FF860250000-0x00007FF86025E000-memory.dmp

Filesize
56KB

Download
memory/3140-2820-0x00007FF85FFE0000-0x00007FF85FFF0000-memory.dmp

Filesize
64KB

Download
memory/3140-2821-0x00007FF85FFE0000-0x00007FF85FFF0000-memory.dmp

Filesize
64KB

Download
memory/3140-2822-0x00007FF85FFE0000-0x00007FF85FFF0000-memory.dmp

Filesize
64KB

Download
memory/3140-2825-0x00007FF85CA20000-0x00007FF85CA30000-memory.dmp

Filesize
64KB

Download
memory/3140-2826-0x00007FF85CA20000-0x00007FF85CA30000-memory.dmp

Filesize
64KB

Download
memory/3140-2828-0x00007FF85CB00000-0x00007FF85CB10000-memory.dmp

Filesize
64KB

Download
memory/3140-2829-0x00007FF85CC30000-0x00007FF85CC50000-memory.dmp

Filesize
128KB

Download
memory/3140-2846-0x00007FF85E170000-0x00007FF85E177000-memory.dmp

Filesize
28KB

Download
memory/3140-2841-0x00007FF85E150000-0x00007FF85E160000-memory.dmp

Filesize
64KB

Download
memory/3140-2852-0x00007FF85D630000-0x00007FF85D640000-memory.dmp

Filesize
64KB

Download
memory/3140-2830-0x00007FF85CC30000-0x00007FF85CC50000-memory.dmp

Filesize
128KB

Download
memory/3140-2831-0x00007FF85CC30000-0x00007FF85CC50000-memory.dmp

Filesize
128KB

Download
memory/3140-2832-0x00007FF85CC30000-0x00007FF85CC50000-memory.dmp

Filesize
128KB

Download
memory/3140-2833-0x00007FF85CC30000-0x00007FF85CC50000-memory.dmp

Filesize
128KB

Download
memory/3140-2827-0x00007FF85CB00000-0x00007FF85CB10000-memory.dmp

Filesize
64KB

Download
memory/3140-2848-0x00007FF85E170000-0x00007FF85E177000-memory.dmp

Filesize
28KB

Download
memory/3140-2824-0x00007FF860080000-0x00007FF86008A000-memory.dmp

Filesize
40KB

Download
memory/3140-2823-0x00007FF85FFE0000-0x00007FF85FFF0000-memory.dmp

Filesize
64KB

Download
memory/3140-2844-0x00007FF85E170000-0x00007FF85E177000-memory.dmp

Filesize
28KB

Download
memory/3140-2849-0x00007FF85D540000-0x00007FF85D550000-memory.dmp

Filesize
64KB

Download
memory/3140-2851-0x00007FF85D630000-0x00007FF85D640000-memory.dmp

Filesize
64KB

Download
memory/3140-2858-0x00007FF85D700000-0x00007FF85D709000-memory.dmp

Filesize
36KB

Download
memory/3140-2859-0x00007FF85D710000-0x00007FF85D72E000-memory.dmp

Filesize
120KB

Download
memory/3140-2850-0x00007FF85D540000-0x00007FF85D550000-memory.dmp

Filesize
64KB

Download
memory/3140-2857-0x00007FF85D660000-0x00007FF85D690000-memory.dmp

Filesize
192KB

Download
memory/3140-2853-0x00007FF85D660000-0x00007FF85D690000-memory.dmp

Filesize
192KB

Download
memory/3140-2856-0x00007FF85D660000-0x00007FF85D690000-memory.dmp

Filesize
192KB

Download
memory/3140-2855-0x00007FF85D660000-0x00007FF85D690000-memory.dmp

Filesize
192KB

Download
memory/3140-2854-0x00007FF85D660000-0x00007FF85D690000-memory.dmp

Filesize
192KB

Download
memory/4544-2462-0x0000000000D50000-0x0000000000D85000-memory.dmp

Filesize
212KB

Download
memory/4544-2801-0x0000000000D50000-0x0000000000D85000-memory.dmp

Filesize
212KB

Download
memory/4556-359-0x000001E8690E0000-0x000001E869102000-memory.dmp

Filesize
136KB

Download
memory/4556-358-0x000001E869260000-0x000001E869312000-memory.dmp

Filesize
712KB

Download
memory/4556-360-0x00007FF83FF33000-0x00007FF83FF34000-memory.dmp

Filesize
4KB

Download
memory/4556-361-0x00007FF83FF30000-0x00007FF84091C000-memory.dmp

Filesize
9.9MB

Download
memory/4556-357-0x000001E8691A0000-0x000001E869258000-memory.dmp

Filesize
736KB

Download
memory/4556-356-0x000001E8696E0000-0x000001E869C1C000-memory.dmp

Filesize
5.2MB

Download
memory/4556-355-0x00007FF83FF30000-0x00007FF84091C000-memory.dmp

Filesize
9.9MB

Download
memory/4556-354-0x000001E866A20000-0x000001E866A44000-memory.dmp

Filesize
144KB

Download
memory/4556-353-0x00007FF83FF33000-0x00007FF83FF34000-memory.dmp

Filesize
4KB

Download