hxxp://solaraexecutor[.]com

Analysis

max time kernel
719s
max time network
720s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://solaraexecutor.com

Score

9^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	node.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 53 IoCs

pid	Process
5468	RobloxPlayerInstaller.exe
6040	RobloxPlayerInstaller.exe
5164	RobloxPlayerInstaller.exe
5712	MicrosoftEdgeWebview2Setup.exe
4164	MicrosoftEdgeUpdate.exe
5976	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
5764	MicrosoftEdgeUpdateComRegisterShell64.exe
4936	MicrosoftEdgeUpdateComRegisterShell64.exe
5600	MicrosoftEdgeUpdateComRegisterShell64.exe
3740	MicrosoftEdgeUpdate.exe
5628	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
5476	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdge_X64_128.0.2739.42.exe
5464	setup.exe
5500	setup.exe
4532	MicrosoftEdgeUpdate.exe
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
2980	RobloxPlayerInstaller.exe
6088	RobloxPlayerBeta.exe
6020	MicrosoftEdgeUpdate.exe
5340	Bootstrapper.exe
5880	MicrosoftEdgeUpdate.exe
4416	RobloxPlayerBeta.exe
5680	node.exe
1032	msedgewebview2.exe
4352	msedgewebview2.exe
792	msedgewebview2.exe
3992	msedgewebview2.exe
3312	msedgewebview2.exe
4392	msedgewebview2.exe
6724	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
6748	MicrosoftEdgeUpdate.exe
4344	MicrosoftEdgeUpdate.exe
6188	MicrosoftEdgeUpdate.exe
6396	MicrosoftEdgeUpdate.exe
6320	MicrosoftEdgeUpdateComRegisterShell64.exe
6428	MicrosoftEdgeUpdateComRegisterShell64.exe
6492	MicrosoftEdgeUpdateComRegisterShell64.exe
6528	MicrosoftEdgeUpdate.exe
6864	RobloxPlayerBeta.exe
6288	msedgewebview2.exe
1680	msedgewebview2.exe
224	msedgewebview2.exe
6272	msedgewebview2.exe
7128	msedgewebview2.exe
1520	msedgewebview2.exe
3148	msedgewebview2.exe
7144	msedgewebview2.exe
1688	msedgewebview2.exe

Loads dropped DLL 64 IoCs

pid	Process
4164	MicrosoftEdgeUpdate.exe
5976	MicrosoftEdgeUpdate.exe
2408	MicrosoftEdgeUpdate.exe
5764	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
4936	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
5600	MicrosoftEdgeUpdateComRegisterShell64.exe
2408	MicrosoftEdgeUpdate.exe
3740	MicrosoftEdgeUpdate.exe
5628	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
5628	MicrosoftEdgeUpdate.exe
5476	MicrosoftEdgeUpdate.exe
4532	MicrosoftEdgeUpdate.exe
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6020	MicrosoftEdgeUpdate.exe
1584	MsiExec.exe
1584	MsiExec.exe
4424	MsiExec.exe
5880	MicrosoftEdgeUpdate.exe
5880	MicrosoftEdgeUpdate.exe
6020	MicrosoftEdgeUpdate.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4416	RobloxPlayerBeta.exe
5132	MsiExec.exe
5132	MsiExec.exe
5132	MsiExec.exe
1584	MsiExec.exe
4628	Solara.exe
1032	msedgewebview2.exe
4352	msedgewebview2.exe
1032	msedgewebview2.exe
1032	msedgewebview2.exe
1032	msedgewebview2.exe
792	msedgewebview2.exe
3992	msedgewebview2.exe
3992	msedgewebview2.exe
3992	msedgewebview2.exe
3992	msedgewebview2.exe
3992	msedgewebview2.exe
792	msedgewebview2.exe
3992	msedgewebview2.exe
3312	msedgewebview2.exe
4392	msedgewebview2.exe
3312	msedgewebview2.exe
4392	msedgewebview2.exe
4392	msedgewebview2.exe
6748	MicrosoftEdgeUpdate.exe
1032	msedgewebview2.exe
4344	MicrosoftEdgeUpdate.exe
6188	MicrosoftEdgeUpdate.exe
6396	MicrosoftEdgeUpdate.exe
6320	MicrosoftEdgeUpdateComRegisterShell64.exe
6396	MicrosoftEdgeUpdate.exe
6428	MicrosoftEdgeUpdateComRegisterShell64.exe
6396	MicrosoftEdgeUpdate.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
499	3320	msiexec.exe
501	3320	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
487	pastebin.com
488	pastebin.com
514	pastebin.com
522	pastebin.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 22 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtCreateThreadExHideFromDebugger 6 IoCs

pid	Process
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
4416	RobloxPlayerBeta.exe
6864	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\fonts\Guru-Regular.otf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\models\Thumbnails\Mannequins\R6.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install-ci-test.1	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\StartPage\Plus_DEPRECATED.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Lobby\Buttons\glow_nine_slice.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_4.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\set-max-listeners-side-effects.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\implementation.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\icon_localization-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\Blank.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\mjs\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\index.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\MenuBar\icon__backpack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_1.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\btn_newGreyGlow.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read-cmd-shim\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-prune.1	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TerrainEditor\mesa.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\LayeredClothingEditor\WorkspaceIcons\Inner Cage.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\LegacyRbxGui\LogSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ms\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Lobby\Icons\back_icon.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TerrainTools\icon_tick_grey.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TerrainTools\mtrl_woodplanks_2022.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\Settings\Radial\Leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\ninja_test.py	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\RecordDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\center.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\identity_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AnimationEditor\TangentHandle_SelfDefined_9x9.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AvatarToolsShared\RoundedBorderRight.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\PathEditor\Tangent_Handle_Selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\icons\ic-more-help.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1032_428005070\crl-set	msedgewebview2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\icons\ic-friends.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\fonts\Sarpanch-Bold.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\DeveloperFramework\Votes\rating_up_yellow_darker.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\TagEditor\VisibilityOnDarkTheme.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\internal\streams\from-browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\inflight\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AnimationEditor\button_control_firstframe.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\ViewSelector\face_arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\InGameMenu\TouchControls\jump_button.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\content\textures\AvatarCompatibilityPreviewer\img_triangle.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1032_893242263\manifest.fingerprint	msedgewebview2.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\e6acc4c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID094.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID015.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDBA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF1D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF2D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECBB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI238D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e6acc50.msi	msiexec.exe
File created	C:\Windows\Installer\e6acc4c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3199.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI232F.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID074.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3740	MicrosoftEdgeUpdate.exe
5476	MicrosoftEdgeUpdate.exe
4532	MicrosoftEdgeUpdate.exe
6748	MicrosoftEdgeUpdate.exe
6528	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133690666879322474"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
5468	RobloxPlayerInstaller.exe
5468	RobloxPlayerInstaller.exe
4164	MicrosoftEdgeUpdate.exe
4164	MicrosoftEdgeUpdate.exe
4164	MicrosoftEdgeUpdate.exe
4164	MicrosoftEdgeUpdate.exe
4164	MicrosoftEdgeUpdate.exe
4164	MicrosoftEdgeUpdate.exe
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
2980	RobloxPlayerInstaller.exe
2980	RobloxPlayerInstaller.exe
6088	RobloxPlayerBeta.exe
6020	MicrosoftEdgeUpdate.exe
6020	MicrosoftEdgeUpdate.exe
6020	MicrosoftEdgeUpdate.exe
6020	MicrosoftEdgeUpdate.exe
5340	Bootstrapper.exe
5340	Bootstrapper.exe
5340	Bootstrapper.exe
3320	msiexec.exe
3320	msiexec.exe
4416	RobloxPlayerBeta.exe
4628	Solara.exe
4628	Solara.exe
4628	Solara.exe
5880	MicrosoftEdgeUpdate.exe
5880	MicrosoftEdgeUpdate.exe
4344	MicrosoftEdgeUpdate.exe
4344	MicrosoftEdgeUpdate.exe
6864	RobloxPlayerBeta.exe
1520	msedgewebview2.exe
1520	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5472	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
1032	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe
5472	OpenWith.exe

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
5000	RobloxPlayerBeta.exe
5640	RobloxPlayerBeta.exe
3512	RobloxPlayerBeta.exe
6088	RobloxPlayerBeta.exe
4416	RobloxPlayerBeta.exe
6864	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2320	2312	chrome.exe	91
PID 2312 wrote to memory of 2320	2312	chrome.exe	91
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 984	2312	chrome.exe	92
PID 2312 wrote to memory of 1392	2312	chrome.exe	93
PID 2312 wrote to memory of 1392	2312	chrome.exe	93
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94
PID 2312 wrote to memory of 4680	2312	chrome.exe	94

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

cURL User-Agent 4 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	518	curl/8.4.0-DEV
HTTP User-Agent header	521	curl/8.4.0-DEV
HTTP User-Agent header	522	curl/8.4.0-DEV
HTTP User-Agent header	523	curl/8.4.0-DEV

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://solaraexecutor.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8418cc40,0x7ffc8418cc4c,0x7ffc8418cc58
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2008,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3024,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3028,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3736,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4600,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4696,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4012,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3332,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5112,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5216,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5340,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5304,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4960,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5264,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5084,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5708,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5568,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6064,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4372,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6120,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6052,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6132,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6252,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6236,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6504,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6660,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6820,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6228,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6348,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4708,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6280,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5972,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- - C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4164
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2408
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5764
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4936
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5600
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NzVDNTgtNjYzMy00MUYwLTg0NjEtMEQzMDY3QTM2NkRGfSIgdXNlcmlkPSJ7QTQ3QkQ0QjgtMzVGQS00ODQwLTlDMDQtODM2ODM2MDgxQzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QzMyMDFDNS0wM0M2LTQwREYtQTI1Qy03QjQyRkMxRTQxNDJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzODYwMDU5MDgwIiBpbnN0YWxsX3RpbWVfbXM9IjcyOCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3740
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{07475C58-6633-41F0-8461-0D3067A366DF}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5628
- - C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5604,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1780
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6324,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6312,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6888,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:PRTPqs65Igve5Voi07p1K28mXzaXwCv5QJunuqUjzggOlrsHWfae6FjjChY2B1n5l25Gc0QEhBMLilQEDcWo___FWwZDUWU0QKsBNJ0mU9SKQBVZVivzIKyH_xXV3_Yu4l-E7zhwrx_i-wjm6cnPl2N8TZqrGDSRMICnP1EeGlRy_47GHUmfJfyfvNclzuYsb7RhlLvY_Awx-gSqKxaWovo1pBNhfkZWMd5NdH5mZAw+launchtime:1724593152951+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1724593096585011%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dbd570c61-e70f-4d4d-8115-df03b6128e37%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1724593096585011+robloxLocale:en_us+gameLocale:en_us+channel:zgraphicsoptimizationmodescalesmidflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6724,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:d2NMIMPK0s89mJN9JtYQAQ5JxheG_Q3tVhmO2gNU1UlOj5vHOBbX5O6XYiBZwa2Y7bZFBG8dm5dqYdHyWB1nvKzlWK1r2KMlWxdMn9lqpPsIMtv0qhbN7hbUqaDgtMqD79TQQcxtM6uf4zx0WG_34mN3EUb0WXwZvfndTjBeF7AALwpMCu_J8BIwAvyzhHjWcQeinyTjh2yhS2s4STaKeF_lwif6skGyLAGXoIF27BY+launchtime:1724593507177+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1724593096585011%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Db3935535-dcc0-455e-a360-1e74ce4be933%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1724593096585011+robloxLocale:en_us+gameLocale:en_us+channel:zgraphicsoptimizationmodescalesmidflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6640,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6984,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6720,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6284,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7148,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=5860,i,6346491125974395821,145981121300961521,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:Qjm-_kbo8Ye01e56tWejwp45yk9FpG-DpA8VtXtQyGku4AC3omDNuiVWvhpQvGWAO4Ci9xArzjbdKwX_ldZq-sHsOjIYENoAWNNLgsx8Wh3aGeohzzimoA7NnO0mfGNH9D_BDglKTf26rxX-xT5YAm0gWHXt7NycIjBLC5XCNTBTvLT422LcGZN9xaA9oIIUAxE83Z1eIoJrrDwmRBkHMx9kg4QXVgIeUyYG7XAKF50+launchtime:1724593507177+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1724593096585011%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Db3935535-dcc0-455e-a360-1e74ce4be933%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1724593096585011+robloxLocale:en_us+gameLocale:en_us+channel:zgraphicsoptimizationmodescalesmidflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4416

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
1⤵
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:432

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5164

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5920
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NzVDNTgtNjYzMy00MUYwLTg0NjEtMEQzMDY3QTM2NkRGfSIgdXNlcmlkPSJ7QTQ3QkQ0QjgtMzVGQS00ODQwLTlDMDQtODM2ODM2MDgxQzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFMzNENUFGQi00MjIyLTQ5MzYtOUYwMi0yNzBGQjlERDM3QzV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzODY2NDA5MTkwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5476
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\MicrosoftEdge_X64_128.0.2739.42.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:2408
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\EDGEMITMP_3E227.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\EDGEMITMP_3E227.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5464
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\EDGEMITMP_3E227.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\EDGEMITMP_3E227.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8109A3D-4E9E-4186-833B-0DC86957CBB3}\EDGEMITMP_3E227.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.42 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff628e906d8,0x7ff628e906e4,0x7ff628e906f0
      4⤵
      Executes dropped EXE
      PID:5500
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NzVDNTgtNjYzMy00MUYwLTg0NjEtMEQzMDY3QTM2NkRGfSIgdXNlcmlkPSJ7QTQ3QkQ0QjgtMzVGQS00ODQwLTlDMDQtODM2ODM2MDgxQzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2NzQzQTYxRC03QUQxLTREOUQtQjlCOC0xRTVEMUQ0MUQ3QTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI4LjAuMjczOS40MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM4ODkyNDkzODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzg4OTMyOTI2OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1NDcxMTA4ODc4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iMGY3MzFjZS1mNzA2LTRjODEtOTA2ZS1hMDVhYTAzNDc1N2Q_UDE9MTcyNTE5ODA0OSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FaVB5a01PS1ZUUUslMmY2WTF0OTJKWDMwdDNZRzF0TCUyZnVFeTVYZTlRZlMwZTBMelclMmJJMGtha2xiSDBybFNhSEwlMmZqVm9DYmhYN05id0klMmZ1dlpqV2tCT2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3NTAzNDQiIHRvdGFsPSIxNzM3NTAzNDQiIGRvd25sb2FkX3RpbWVfbXM9IjE1MTc3MyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1NDcxMjU5MDcxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU0ODUyNTk1MjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1OTMyNDE5MDc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzQyIiBkb3dubG9hZF90aW1lX21zPSIxNTgxOTAiIGRvd25sb2FkZWQ9IjE3Mzc1MDM0NCIgdG90YWw9IjE3Mzc1MDM0NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQ3MTUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1732,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
1⤵
PID:3476

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2980
- C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:6088

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6020

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5340
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  PID:5460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DISCORD
  2⤵
  PID:5444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3320
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2EA66CB90BAFE89B19C7215CE71B6B32
  2⤵
  - Loads dropped DLL
  PID:1584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4D33ACB851C6F994374764E11D1C9786
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8EF1930B1368273E388A96A71ADCF4E2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5132
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1588
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:3992

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5880
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4A60573E-9C82-4076-B0BD-74529594BE80}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4A60573E-9C82-4076-B0BD-74529594BE80}\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe" /update /sessionid "{DE8944CA-1BB4-4103-BC76-F09CA83801CD}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6724
- - C:\Program Files (x86)\Microsoft\Temp\EU5D61.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU5D61.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{DE8944CA-1BB4-4103-BC76-F09CA83801CD}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6188
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6396
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6320
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6428
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6492
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REU4OTQ0Q0EtMUJCNC00MTAzLUJDNzYtRjA5Q0E4MzgwMUNEfSIgdXNlcmlkPSJ7QTQ3QkQ0QjgtMzVGQS00ODQwLTlDMDQtODM2ODM2MDgxQzU5fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7NTlGMzc5NzYtMDhFNC00NjhBLTg4QzItNzEyREQ5Rjc1OTgxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjE1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMjIiIGluc3RhbGxkYXRldGltZT0iMTcyMjYyNjg0NCIgY29ob3J0PSJycmZAMC41OCI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTc3MzA5NTYyNzMiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6528
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REU4OTQ0Q0EtMUJCNC00MTAzLUJDNzYtRjA5Q0E4MzgwMUNEfSIgdXNlcmlkPSJ7QTQ3QkQ0QjgtMzVGQS00ODQwLTlDMDQtODM2ODM2MDgxQzU5fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBOUMxRjkzOS0zNjU1LTQwMTctQUU1RS03QTE5NjcwOUM5NUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPSU1QiUyMi10YXJnZXRfZGV2JTIyJTVEIiBpbnN0YWxsYWdlPSIyMiIgY29ob3J0PSJycmZAMC41OCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTczNzYzMDkyMDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTczNzYzMDkyMDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE3NzA2NTg2Mjg5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMzIzZmE3ZjctNDQ0NS00MTM3LTgyZWMtNzE1Mjg5NDkxODJhP1AxPTE3MjUxOTgzOTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZTBEaUtoaDNuNURPMmtGY2tZT0R4UEMyelpqRGolMmJwZnclMmZKdG82MEEzUGdRJTJmbDc1WXptUnB0b0V0WFlSSEpwdTJnZFZNTXpGUGJVYzJ4blFDcCUyYmJVdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxNiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzcwNjU4NjI4OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMzIzZmE3ZjctNDQ0NS00MTM3LTgyZWMtNzE1Mjg5NDkxODJhP1AxPTE3MjUxOTgzOTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZTBEaUtoaDNuNURPMmtGY2tZT0R4UEMyelpqRGolMmJwZnclMmZKdG82MEEzUGdRJTJmbDc1WXptUnB0b0V0WFlSSEpwdTJnZFZNTXpGUGJVYzJ4blFDcCUyYmJVdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2NDUxMTIiIHRvdGFsPSIxNjQ1MTEyIiBkb3dubG9hZF90aW1lX21zPSIyODQ3MCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzcwNjc1MDc2NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzcxMjEzMjU1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjIzIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9Ins3MENCODA2RS1CMzlELTQ3OEYtQTFEMi00QjhFNTI0MTUxOUJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEyNy4wLjI2NTEuODYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMjIiIG9vYmVfaW5zdGFsbF90aW1lPSIxODQ0Njc0NDA3MzcwOTU1MTYwNiIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM2NzA3ODE4MDU3MjQxMTAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iMjMiIGFkPSItMSIgcmQ9IjY0MjMiIHBpbmdfZnJlc2huZXNzPSJ7MTNDM0FCODEtREE1RC00ODFGLUIyRjgtNjFFODY1RjIyMDBBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjguMC4yNzM5LjQyIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0NDAiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins4MUEyQTBFMy1ENjEyLTRGMTAtQjNFQi01NkNDREMyQTkyRkF9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6748

C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4628
- C:\Program Files\nodejs\node.exe
  "node" "C:\Users\Admin\Downloads\Solara.Dir\Solara\Monaco\fileaccess\index.js" add159f3669a49c5
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5680
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4628.5604.207454161285641877
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - System policy modification
  PID:1032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.42 --initial-client-data=0x178,0x17c,0x180,0x154,0x1ac,0x7ffc410a9fd8,0x7ffc410a9fe4,0x7ffc410a9ff0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1820,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2004,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2220,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3596,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2108,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:6288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4732,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:1680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4708,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=776,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:6272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4692,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4800,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4944,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:3148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4376,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4388,i,5635995889987077978,17561246293437220940,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:1688

C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e6acc4f.rbs

Filesize
1.0MB

MD5
2f5c27220316b60e4b56a7b2d72525b1

SHA1
f024bcc4e8ec1a570c341fb002cd5ae4823e543c

SHA256
691b3c104c40236b229a42871996ea96ee6f8504f744305944484568379a8191

SHA512
10e2d1acd0b3029fb4ad5a2e1ace0616404a3737946b3501613e5c3678f1987cc74688781bc15bebd5249e6fbbc8c109ba9ae90c8b6977d0099ed9f36b662a6e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Installer\setup.exe

Filesize
6.6MB

MD5
11a19165aa72e46ad47200ca46760c87

SHA1
2fe4616eadaf543846571564ca325e772ea5375c

SHA256
eaac114b05373d005f91c2824c3b907d01842056468018b95a688e82ffcc95b1

SHA512
5b4074ba1598c7441fd3dffed54cf0cea540a8e58ace339254b9a29bd6709a8e64458c10e9797a75ba8e0e84566e8c5935bf4891b0115dc02017396d70f47b27

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe

Filesize
1.6MB

MD5
90decc230b529e4fd7e5fa709e575e76

SHA1
aa48b58cf2293dad5854431448385e583b53652c

SHA256
91f0deec7d7319e57477b74a7a5f4d17c15eb2924b53e05a5998d67ecc8201f2

SHA512
15c0c5ef077d5aca08c067afbc8865ad267abd7b82049655276724bce7f09c16f52d13d69d1449888d8075e13125ff8f880a0d92adc9b65a5171740a7c72df03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7664.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.5MB

MD5
0a4e6d7286b389e2fd93317e27d46585

SHA1
dcf0d769a94555ce60f1b367b2851477286366be

SHA256
5853f8b5333a0c7a4fa318e2da1400eb1bbd0a52dc22b5521002066f242a2ac9

SHA512
b859cac971f414b24ca53832cab53cc4a424b776923d7f7c2c167f2d60c5aefdd4d5aba255af2e1e3673396101b575bc77dedea3ea06060c962863d635b218c9

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-86c3597a87f4495e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_1823100078\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_272461122\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_272461122\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_272461122\manifest.json

Filesize
179B

MD5
273755bb7d5cc315c91f47cab6d88db9

SHA1
c933c95cc07b91294c65016d76b5fa0fa25b323b

SHA256
0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902

SHA512
0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_428005070\manifest.json

Filesize
113B

MD5
b6911958067e8d96526537faed1bb9ef

SHA1
a47b5be4fe5bc13948f891d8f92917e3a11ebb6e

SHA256
341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648

SHA512
62802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1032_893242263\manifest.json

Filesize
102B

MD5
8062e1b9705b274fd46fcd2dd53efc81

SHA1
61912082d21780e22403555a43408c9a6cafc59a

SHA256
2f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35

SHA512
98609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
204KB

MD5
32a6000d2c4e052d06fdee1f7aa15d42

SHA1
d2f4fc2b99d4185e8d8f1f6d9bd94d5fae50eb34

SHA256
527ab2fee5f4b48c2ef9f1692149852dfa6f63c9247045915ac85ed1ffc15493

SHA512
5411a0c9f38a36fb5cfe19e90854bfeafe2ee721f972187a77fc353e75f9370a57fcdea0c92110ead400b77044b2c298eabd3a24d97a7c503eb53b58f0c01c5a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6bda2cf6-8d41-4922-8af1-7a185e4f81f7.tmp

Filesize
10KB

MD5
4d2f3c32c5090b7248c1edadeb412b2f

SHA1
dab09a2b59d6ff04499d8fa0c0e0174cbff8d58d

SHA256
7f77fac41161092e370ca0c3a5d2a5579b020f996a7407415dda01fa53452398

SHA512
795127bbb612d403c45dc35d0b14d6d36375ea141c37da99aa89f9088870d69559e6187e21e387c8ae46bc636a4657831b79c0e4143e11718c022938c5f030b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
73193bb8cc3669e855c9f4e818cf5078

SHA1
06a9aa501ab7e66c813371c52ca9fe5bb7280ebe

SHA256
24c76076ccb1ccb0d27959422b70ff252e786acd144d9a2754c78744507db2e1

SHA512
01afa0e10b4c70e10f28491fe6745028f13dde09edc27f91c96864f3432abd2f670d7446f723ed1d50c24f3b7fc738f9b1286c653398651edb9bfab0b782687d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
51KB

MD5
fe37c3b8886ff6d1aea8fbe26cb2b026

SHA1
c82d53ac3d4190735ada37274dc70014922881b9

SHA256
e1bbc7a99621c4825435479fe13b924a0f1de328b6de2beb6dd15da3a6f4f84e

SHA512
d247b1ee553b432b5f867b6609546f2b207bfb6c717bc2053642f0ec80b30640ab2afc7349303e1688514d25bc956502903b99d0c47a33bf2b433f0cca8fc275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
142KB

MD5
e9d65f13de3144d2a5033fafa588eb47

SHA1
4917d44154ef61e95964cf005c13a73f28140b42

SHA256
2145aefde14299996b9383804deddf2c4bcd893ef54468eeb07fac5283fae982

SHA512
9f3bd8d0af5579cb7254ae02afe005ed10f06f032cb8c7656276935a9942faa259e0284ece6999afa4018a84de0bfebb353a5ba127e857c911c462b109c94334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d7

Filesize
20KB

MD5
a1afe33ce7442502a96deee597945384

SHA1
fe34cd78635f5617cf238de6dc746058d6f88899

SHA256
f7eeb570c60aff1435db1daf3767c0672634269789870ef91c69b2b90a47edaa

SHA512
f8bca21c3fd79d63c8265f5dfcba95419eac697b42efb600e7c33d15dc5d9c3e0d0d360da39e14004facaea4cff4dcfc00d7437979283ce0a2b06916b69b8c80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000db

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f3

Filesize
63KB

MD5
e4cc1ece2f2425b10ae2ccc212c1dafc

SHA1
92609e6d0093693110baa23758382889bcb30da6

SHA256
92e9415d8bc8529e2a3f335258ef7ff159cce2965ce3b2b7c15f73720efee809

SHA512
2848dee3a6da891b7044518bc97aeafd340705cebe846350b9a7f314b52450f1eb977b8b492638965ce4674ebaa341e4f832438199c3cad2fb0a0793ef83a619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1224a3513b186381_0

Filesize
289B

MD5
ab32c28a2c6c7e1834bc5eb8e6ee00f8

SHA1
c089396383842af090756e0b001ac1d1cb420f40

SHA256
65ff2472d2c8b6b304c5bf11a0824ad6fdb1cf383528511cfb278758b3025715

SHA512
f4c1a9af30836e937b10610d58addbc40b43371dabe0f82259bd173b95a6f8af193de49e7dbbcca2d68cdd5bcc945c62b75dcc494bab5502a027505fd715c7a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\63cad5f4ee91cafe_0

Filesize
3KB

MD5
a1e777ac214515ea70c8db136638d502

SHA1
7db49cc23c2ec3928e155eca03dc481e5ed52493

SHA256
e6f602cb6412939c39b9dd39af737c89c884c575a8c9a3cf970b6ae9710d4633

SHA512
e6e0bf38f14e6ee271be7c07d62cfb123f93f0c1329a76f12ac628cb60b614fbc9c34499ba93af5da685e48506976ae7c04fba2f70f06c98d4cc160a6375de50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a0dbd3c717c7f711_0

Filesize
292B

MD5
2c352e6386f4b554d3fa45e7c550c941

SHA1
8de9b287d992dc4532ba1a294ce41ac043b9fee7

SHA256
e0a01b83966d555f1686e3e29b06b6eeab8bd3f05f40b59f85a9ec3be378dad9

SHA512
a9fc841136bdd596565b5385df7413e2d0d239120631b2840b601478e90f914d9b15a7cf05241129b496e276044bbee2f186852997fb20bdf68c2f7a55656cb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b1ed8bc833c24fef_0

Filesize
322B

MD5
57761585e3b1219d6ca60062679061aa

SHA1
a50bca78d39db4877e0c05c689d1ff230011c2d7

SHA256
476c55d0a6b46ba9e3959f2752c169bf54bfee48323ef58e6ce4fb497b361fdb

SHA512
6cdd65183854ec10b3613a03f29db0389a7acb00280a75d2b04f57d6fb5e3a683ac2a950b4ef414aa8587fc872371b9a9b93e1284c1a8238520ba4fa737b14cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c53b917ad0adf193_0

Filesize
297B

MD5
37629e9dab39004ed3ac68009a288e65

SHA1
7818de39cc901d1ff1d070934a9314da9ca1480d

SHA256
92f2d6c861a5bc51cd2f02588241db6b045a07a6eae8c43e7163d693c07b9b25

SHA512
db73b5373cef8d57925f398d9f92c9a9dc3c7f359b63da8c200ed6d6e252e633d159536fde1a543f196f59f10b80fa23496b0a77c11c83baab4e1966539f6e5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ddae3bee1837ea96_0

Filesize
365KB

MD5
776dc33aa2c4e72f2977aff75f0aee92

SHA1
8d2ed3c7a05fdb5972c5bc9c1e7ef4e961025ea6

SHA256
60b830399c771006a943e93e140ba889b38d77f9f1d3feb2843e455293ad4587

SHA512
9fd76cb2c4d315902e5ad89c471638bb2c9bb8231ec3ed5f72e478fd21f8bd235baf858b99927ccfdf80d0f7da6a48ac968f400b2304e1fc9218afed47d04a16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\df6ab3f2cf1f105d_0

Filesize
3KB

MD5
0df40a4417caff9f3e9b959667250e8c

SHA1
fb09efc37e673ba6d3a3fda8e38c07db252d376d

SHA256
bb05bf14dfae05e53621fd0fa09b409182eaa894ec694848093f8055be27a7b0

SHA512
120449a285c40ff5716cedc269f9577fe19a74f0d52bd3c52839228db4520d218883b5a6e6c3f86f1fb9547ffa49ae587c3b3ade994a82eae0c87cf490069f57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e6d35c4bd73e9b57_0

Filesize
34KB

MD5
adde0e1f270d3c967fac947e9298411a

SHA1
6278089ebe2f4d22937e618b1a73a54436443a57

SHA256
2daa5b48c62bddb8842ffe53e4244f59d8beeab8e5777b9679a1dad55795bcfb

SHA512
1b1926656071af6d088b2a4396f398bf87164183301f5e6b573129ca9a0a73902ebd1e634af3b98080b13906a58e4c4881c80f1bdfc0f247b157d09fad0ec7d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fa3fece7db310728_0

Filesize
58KB

MD5
98dd33342208bbb70c35238c455b3010

SHA1
a6da4a571aedccc9ce84d54791c57a1eb4d9327f

SHA256
810e97f99ff48350500ab5c229e26439f891aab69228ca7fe05fa584d0ad4858

SHA512
3b2e8fbb5a91ea247426c8a822cddfc96712665237dc90578b0fdac7fca6798e9e8168364599e167ca981c0dd052c106e4b28d74129a8642503d7f1d1c86b641

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
711fb6b2126af70d155e8545b527aeb2

SHA1
35111bfa7b2e6a7c3877ab8a5bd954e98b03f3b6

SHA256
23d0d077a2be5df1592e608c62c11c6aa78601476b4af53ee6964a8296b521ce

SHA512
312698443cec0319977d5c976ae35cdbca3756a773a831b0e0f60040444670949b99de70a0b03640293ab43f2d0c9c3b932d0a8a49168f21273a0eec4c5e9207

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c44a7c74fe1136a8961003eeb3222f67

SHA1
949559b3a5fa52e5bb6112d65cc64261e760a527

SHA256
170ce07b6db99a958b8fdc6ef66ebb93cc73e0d39c896f35c266393069a45ac1

SHA512
7115a73a4cbd9a44baecb2ec85d93c8d4ec42af8849903fd97b8d929e16a42a6988a803c6815eac0eccdf3c6d24d3dabc69b05943faaa67cb88dee9a413150c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8691e67d-ca2b-4fcc-b122-732e068af9e8.tmp

Filesize
4KB

MD5
fd1f478fcab748057b33065387bf0f11

SHA1
25ae64a192b01b1f744ad7959768ccfcf7c567f6

SHA256
fb585583e274da00ff4dc841be5abb9ccf8a79e6ebe9ab61777804982ff2ecb1

SHA512
ab9822f10e1d80bb02ad0918ebdac562e6472863e9652cdb78c6d2dba208594b8282ba2d19747e806144def27d196f2e169979684b2a2ed38c8e34747258f127

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
fbaa0a0e5f2b519a075678b266f317de

SHA1
e9d57583f6c83d215aa3b3904b091cc6e039aa06

SHA256
258cbdd691641ea9c986bd2788877caadb09020347120d0e664f40d69d950029

SHA512
7c829be7f22a181b7f06a6840c4bc67d12e70bc4705204ca425688f7dc8553840db389c3058ace1144dae1f210f2c06e7dc0fec4c5a51cd8e84b6be1866878d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
15KB

MD5
06428c5172c0983c68c130d7512607b6

SHA1
7eb5d6227ca090931b7d76e260481b0c08b4f6a4

SHA256
5c09ccf65c09295731c2991795ffc40079184219208b93f3c3b6dd6e4fa9e929

SHA512
e9148c217ac2e30f9881802fdb82816e615034ab4a8df07de48efef11f566baf3199318fdf9caa3fe2aba723f1662b24a3592a1076eb0e65f1d55e1295914bb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0564f772fb31cca4a9375bf480e79270

SHA1
26b0a8c7b96aa21ca3aa48682059a1ab207ed0d2

SHA256
a211de4117238a8afe49cc9679dd1a8ced93135fd9e4c65d15a2af09ccfc9b97

SHA512
3df20f5ae1aa63dcedf54a97b0562146e34c8b2a3475555ca7ae3784048281b314b8ab83388961e8088920f379bfde1da1924e6f336f01f8dcad6ea9e544683b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c48e91027c4914b43cd9f4caab76a6c0

SHA1
099ea4f154552341ef38495e5801fde69dcd5290

SHA256
350d277c3e826b127aa9a301dd349e0fbdfa982e0b1d0d924eb5245509eca146

SHA512
4e8e47d706545c51bfb59512d445afd6b0a7977690a2cbb99f9898ef8a8e95827b47c7307ee68cfcad898c8749bd13dc4fa1b96c5fd79d2ed61ea7ffea3144c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
312469d17ee72259892e7628dd4b3fcc

SHA1
39b5ac2081eadaa4e2079a14474f72f01aad7ed6

SHA256
d4851ebf36b196910fe617fe9aba8124d3ce80d7d9f19721748339b982ffef8b

SHA512
c45ce832f0b71aaa022886ad025a96e3615841953feeb2d7b032925cb18716398c5ccb285cbf4f8f868ecfb78b0a59526b1f4c39de1bf0a2be7cf8ebf35defde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
5c71bc56d666ec286ac3a688bb7b6142

SHA1
92051c0168d401bb1c0b1d9bcbc3ef3bbf3f98e2

SHA256
7627ec2b380e4302594f465d4fcdf30fbb7682ed060fd1cbf6fa9e2b1251a8a9

SHA512
7d6cab415baa76c7bc87b2ec84a71326f4fe12419dcd62ebe06c9a5d1f8c7ef3d9d61e924ebbbd4fd82888e3b1b41788997b669f6942d2b50d6f283a2fb06de5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
54df6a83064bf0db9e69622be1548dfe

SHA1
4c6dd119f9d091d64403f2355e866d3b3faedbde

SHA256
11b85ad59ad57a95324c70087a9fd597c7a64c26cb5f6fe595d1aac9299586bc

SHA512
5b6018d5fa690afbab1c832bc011298bc1447412a3c603fa82f34a1705a7a3bf5b8f6d7e81851beb5c45a828d2cc0fc0536785059c0acdc29248bd3c79a1e826

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
49d71a070b382e746d03d3061c37e683

SHA1
753b63329027a756b1240a986a51eb3cf4dcfc64

SHA256
c20c21c672788caf8750356916c37a07b8436aa45783ab599131b3c0b70900ea

SHA512
998e9f7a13ccf0b56cbe5cdd68a5a31d89c65ea9e04fb1d758185b3c071ad59de8983b724ec28d2cf7d8ece1177d02c83cd4bf75ab0059753731e8b69c3ed031

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
87c4f823b6d67a266008cc9300e5d7f8

SHA1
46ea0452571d62773f0c838ae45c17b6c956e14b

SHA256
b8497914cdd1b480603f577c4a7624a10c6ef309193bf19b1dfa0d402a93caf1

SHA512
470e2b902e1fe81cf04f08ee688895d75753ae78f9c82e8a3dceed9c20fec82a6d3238a43f684b2d368bdfd8d6391b54b697bdf1de6f9a5e8858c2a64abe3c1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
993a94610d925ed67b15f45abef5e909

SHA1
f294b9372c83524d058ba130cbe6ffec26ae15da

SHA256
aaecf9ea446b5f0e62f660b24f8a576600bff2cd737906d24963c921b043d094

SHA512
53a558e914376caea7b4d2e185ed5d6ce22755782e064f82e87b1543655b550ad30186598db787535db063d265496aa70bde23760bd566aafb5364df1f2b6590

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
34119ab5d409837bf260ee7820deddb5

SHA1
1b8e8f30a4d0cefded833cb588002280cee55ab1

SHA256
2143f9b1559111cf5f8f60f202cf3d02a28d0b2416e25ce95cd328746b01af0c

SHA512
2cf1e73f847bdfc74051612283b03e18f34edf49c0ba5b08d4ee939b6a2864b4c4e55d30d426093e73edc8ec0f4fed9b7c6a97c9bf4592fbaf9b880be5392aef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
8f3b43fc127da74a29e0e8e472f43e17

SHA1
c43500016b5745119c7303b40417b679aa808185

SHA256
7464b44a73d498e65c3ddbcd2f086d4732733e682743bac1b7170991fc7b2416

SHA512
9174fab0c62d7691de9727a5161aefe00a7a1b0cab9371afd9b46c707c438d6adab6efb871f6af9155c1006fce4528baee685632b1b42991258d1ec11273f9ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
381795d4b30dfbd797b40ce3d719c10c

SHA1
8fc9f6fbaadc740f8e78acba609430a64bb8ba3a

SHA256
1dbf4e89713592d40dc3ee5338ec06f81616ec5ae24ae94ccc6f935e97892e87

SHA512
8a0fad7d444752c8836c5ace274f99e932ec496cd6f8ab60bce68ba600a918e34a3272fded35e48c8abbff6387f0231e36a4fc8e3356aadb77b4edfbde05709d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
3f6103b6b86ab26c0fa8801de9a236d2

SHA1
a6002ddd9115238e843f9141329cba384385d489

SHA256
44cb1e409b9a1c98d3657e9e3546649420e3703c5aa2dfc4317165609a346b2b

SHA512
c891812aac50df4f4cf464ec429699efbbfe2797eb11bba93825df7a349e0eec5ee0dc45010c7f27a682e49e03ba35fe21d2a123ac66371f87cedc0cbaa14dc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
78f4c75a0c54662bb475e1e73c4592bc

SHA1
416b945b8a6c306c091a463b6c44a3da251c8c00

SHA256
af58302a34f6b8b172ebf569557a16ec7e3751dca48041eb947958b2dc9b56fe

SHA512
143c945116624ef4d21b0184a61ae9812672d6f1b61733f4540f5f5ce426e55c5bfaaae0a32f1e5b413b23be5b974e9d0aafb547022bc3bd5ee24929ce990f0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
aa4d922c2ad8b8724282265adc7f28bf

SHA1
cce5031370d152129aabe44e10a731b02e9e49b4

SHA256
9e607d9b2341752419e42f2b1b0051adfd5746c621857a596adc52c92672f3eb

SHA512
ed6cc5b42dfb65300225c6cd3be1a06cd626dd45a78d0cc1730bdf0f94ad4575a5c820bda80fdaa06a1efd2a1e88bde89fbc1596c2d56e24211b48b46d23f568

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
90cc65f7c21f0d827ee01a98eb5bf6b5

SHA1
b2304aa390fb296727f634c3baf7710ba8f53abf

SHA256
cb2d03fc85ecdc2ddba2b0b417e8fb92cca591f29d86c580638e35a29eaec63e

SHA512
69dfa6792921e5651380f38e2df35fec5047a8a0e36984532dd2f9f9ff1c3df3d2ba309dc3b5eab166c410cbadda89b3fdb282d092e2855bfe574d6dc43bfa7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
194b57382fcaa9ba680a5df8923091b2

SHA1
768e4ecd815aadbfe7e3362c89282925e6400a81

SHA256
c7610be3809eea27efe516c7048adbd2dc58176cd288eb5826e8a7ae670c254e

SHA512
b7480495e5f66195e95f8110a2dcb413ad53b7f09364c476c27942abab42ffde740cfa1ce8bee575e5aa70dafe23f85abc5d50ab740c0e837629b03bf2eeb1a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
979c84cad20192e42cb0adf5e40cf780

SHA1
c8145c048a2da9ec4c3351520526a109dc2e36d7

SHA256
16ecf454a4542240c5d70b46b9e4e035f15f7190fa68cee4594fb6c8280499e8

SHA512
e37c18cb6663b454c1b94a8b34942e3187003f4b29bcb2ea6a508a4dcb5947ff1ef092440be515f6e95d603d88df63478d62cd4df617dfca281c1f804f7f3819

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
a1cef40662ba47c12835b9e30ba288d3

SHA1
8c9b56b700533432b237100cf33870acf8b60a31

SHA256
ebce450042f11bcbd77205a963a4b97e4cb392484521ff258dcf98a3943e7970

SHA512
f6faff911e2610d9bc6df8725a45ab76dfc26a90d665b423201fff8e86e3795f46de98a686377f0f32663be2854327cfe49e4ce94640272429e229957ce719af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
010bc3e938576dec25c7cc528ef6c010

SHA1
8e4fdfee14383f31165447345830f77d48b0f998

SHA256
b065c48d3fd4566c5b7beffdf32b7922f9c48392492499acb6ab82a8065d99bc

SHA512
c4e139598616ebf93c88517d91c9983efba78b0e023420869369679a34430763236063a5b44373ad6cefaacf80b496579576fe753b01aa88731a155056994846

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
af0d4721ab0224aa58bb75ce92010822

SHA1
48345b7361c4dd386f5d21b31b9693d99b9566a1

SHA256
49da5998f4ddd8094de0208046958525b5c22abaec928101d0abdce2b1e23384

SHA512
9252b5bdba7bc52fd16425f28524c9826cb7d268826c59a47aaa6893c638b75222035a841a524de09400110486b68a595c795b5c46a6740c41106d9309a17e4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
8bbb1fdaa00eab2e21089c51408a43d9

SHA1
3f4c51e9d539d43957555aeb5c8086e52f6c8c92

SHA256
9d0c8903077933ba37ef017300e1b39ce052b0ef5fbe198fe1e27dd9b7ae8c10

SHA512
a945d166193da2380cf5891156398060921a9c40a3bc19a7ba34d7fdf954026a2817166131d047ecd078655acb5c348f31ad2dfef8271461fa74eb37581403ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
1c147d5899bdd87ea38fd412d44df972

SHA1
9a4d927f07b4ee835f8a79478056510f93f1d18a

SHA256
4ceb33326ddb7450eaf915209c64b18bf6f14beb8be0a7c40931e246e0a00428

SHA512
73eab5d1133f7e72efd54462daadd77531ce6ca870da2c228e191c947d3de92c492d4ba76b3f209fc0741118bc4d0e3d74482859318c616d5923cd5c3ab4a5f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
1fc3932a3b75b3d31a066d2ccbf763ed

SHA1
a44e5c9af0ae631b8967f25a3862488e6169c9d8

SHA256
a7039c0208647e0f948e28d41f22f4f2fc9006ff50fcf484d76fb9da3ef18c6f

SHA512
eebf7e4badbcafe1c17217756b93865502c3ded31a8bd37635b76eeead47c4184d542d561543b0a0e8c20160eb56dbe5601a4b6c4059e4566b4740b404dd2b99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0a982a68c7ebc459c6d0d697680b37b3

SHA1
55d502b6b86a39d9bb5663d45346c3fdc0f49ae9

SHA256
6911003e6baa46a3f623c8f12de71a43fe4e3bc51e4636de7d6c5442fb76629d

SHA512
b7c82d856382b17f4dd1c83e18d81b4e9c5f8c38e14b48de69f47f5cd836f51340ca533829d1d5e83d0547961bdda15928c263564a73917fbd4e7be5c2179353

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
9363237d3273c0bf277ccbd4eac5074b

SHA1
e1e8e4ae1976b1678fc768549df11e30fd4ab9e9

SHA256
909214b976819e2f9f720993495bc217a4c6a1159f6c95d6120d64d298ac1e3c

SHA512
f724b457b87f69a83ea9d71cb2afe4cd3d9d96521e06107193ff91837a8d9f735a4955ae386b9b55b9a3bd3c72cf230dd782b62064b3c892575d3bae004e0779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
2853bc89b50d2485f4ba239f1b0f2e63

SHA1
e5316890bda6435d83493fdad0a82bd3991a820a

SHA256
6519c3f78b1b7c5d4ac766a654e2c75d751809a052c643046fc77a0ec3048684

SHA512
355dd6785699ccd4d260c5d87db2008947a6f28104cfd14bc5c5fbb74bbd32df2cd94acecdcab613f19c97e2f1924252e5c629cf2eacb47b0a2831e7298db191

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
faedff249817702a11af822c3721af55

SHA1
86e5fb04d83b562d767152c8c53fb86dc3763de0

SHA256
9b0c3d5d100fd13cfc3e2572195563f32dc5ce485c9e9aa72ecb7b7dc0128a7e

SHA512
6c142d4cc23220ab1bf4c4f93f090f1a68b9bdd79d499f8f992aa75afd74ba1421885d9a7729f1af2a68205a2fa05ddd3e2f3b6faf996e4f9d4eac70125da4a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
05bb5bbd0e605d8ebb45436fb83a8d90

SHA1
a526be70701db3abd5aa47a42af35dd423321201

SHA256
ee98bf5c4eb92cb2058e54f5b63036711f21711b6b0fc0a3bb4d16421211a441

SHA512
143919880c8495fe05fc2f5674e2832b3fd3c8d27b8f5ab6c2992bedd9595e7442871719059940fd76ea0e76811617b1036492056e0ec7eed32934997d76daf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
a32ca0fae9a65fe313986f2ddd639689

SHA1
d06bc662e8efc35b6185186f0ae98d60c24b22ad

SHA256
b7003f8c1cd670b617d799627f8b0a50df5a59618071eddcfa95f9e5b17ec112

SHA512
e216e0adc3ab3f3818b6fc1c7b02de177349cd1dcca0e2474e970a0c27d42000da11482ef1e04204aff7b35de35422704c922129bb65111c784729e29bb39e6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
35e1e1892f2d87cf58297cbaa74479c3

SHA1
d556a64d11020212bde6cd95f9656ff65ed2c532

SHA256
50a5bba7374662198ac95121af495f0d5602e38125cbe40304fb85bdc4c4c98f

SHA512
f1410b510e5a6bce3c8d6d532a354f05952c48528758ac83800d70a2d2fd745c614b2345c11f1c110876fc4f0f611c5d03d18c254edd3f6878cd35e63613b89a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
76ff866c97b94622daaedd96571bdb9d

SHA1
4d6b33367ccec4e40bb97ce17044befbc4dd4095

SHA256
9a33d9013e46b92325e2ed88314b68e783a17336d74bc24e06a9b179dfe632ce

SHA512
f1d05e86c289c256e328cc921492394a424507b6e49cb7eaa63ef5eb9d54c830bb1932565c0424a4bcd240954c042719cd847d2eeef8d392cd69d161cc327b4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
748783c8f394e77e302ff088d620b3ca

SHA1
b770589c3297c434007c61bc72e0680dab4b674d

SHA256
ca56396c445f43dafb686b9d83fc74e3dcf5e476043c0d2f2441c3585c400262

SHA512
a608a26a751b9713ac7d12083baad1d857801cf1986a5376d3f25ca84eef2b98b42d1bcb576b152396d2c224862d086af1c4fc51c9dc2ddff8e879da812d4fca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
6c83f47149ed8594dd3a036a6a21e481

SHA1
e6576c49db7a8eae6dfcbe68553073a26081f886

SHA256
b2362e247fb35358f7308c2bf18ebbb0b9d6cc617f7ffb6fffa188fb4a8785a7

SHA512
9e8c2e6f93ede50aad7836919c6d645bf92c88e03066f44ec6b0f82115faab5c9a372836e37aa2092074afb4cce956ec3c6bbfd6900b3e961633e22e4767ce66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
95388b59f93280da673ff8ce0e7c9bc1

SHA1
2e4738a63b8c3f9d26099d9a064978c839048543

SHA256
5a4c2b247a4a8a71982df4dee98afd15e24a11804e1c988eb32ff3b30a9f0c42

SHA512
436b34d5c652c037a65488621940ff291c3052bcf00703dcf5555f927b5ab3b4b4b95d36312a785bffc8c24433af45bf6629ad04179f9357e7596dd6bcb67dea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
ce599a2fe10e6be8a4811883b2f9e0aa

SHA1
35cf08bf2f350f26762eadeedfc900eddb0c2981

SHA256
b575622d98adfff614df831683081e7fb49c18afa830da60b8ea84e19f381b8f

SHA512
b7616246e2da5ddab955624a49931ccbbc82002d766c7ab21854bd59db90aa29f1be2abf9bc22f035224ca4a44cf16a1942a499b15cf8c6a0119ad1c34e6c47d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
96adb1e98a87e13f0402204c3b7a1e62

SHA1
a39dd12fc63c88f5b65e83f2a6ed4d1aea367cb2

SHA256
f821cc21d88b6c80afd7ef5c89f1cbf0619d058cf9b0b6280fcc85deae9a896c

SHA512
217714e753849a57ed9adca3c6c2e5a00d6042b015da3cdebec3bfe30e57a86815bb9fc185c4edec92595e1953263c101d7573708cdefe36bb661c57dc5ed543

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
733df2f628b53e43f552d26c1b6ad553

SHA1
54b5eb0cdb27e5abd375e082fc7325b1c750b6b4

SHA256
f3ad1a2966cb2189df8b931a50435a4e5f12fc0258a8845e7719e231c62f40d6

SHA512
b2b35eaf8b20398202887e3744da8720b3196e4fe052810dcbe3f9e4aaedad641ff55e5f4be00e8053d4025cbd7cb7c9a9670572d7ca5ffd1872b7e312a070ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
c6154dc93805a9026b9b814569c402be

SHA1
653bc14ed0c58a25d4c560f2809682a5ce20ded8

SHA256
a2585d0db9d5615a34d245b36fd71af5311df6ebaf68fa7bfc16ec2e7278b623

SHA512
fe30aaa47aa055eae2142b737930f15b6b3b0632a0522367153db0376dd07a36a5aba76f19e372d74464145abfa895f02ecc0ae3c87e902e982ef9cfeee6910d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
b21860c2d2c8a03c301ec345e789718f

SHA1
361e8881667293e4aecade5891584394055c288d

SHA256
5edb202c6d25bdd2e215f20004eb2445d752677ae7216c52aa4dd50c83fbdbea

SHA512
82ca4ece57372108fc44b1fa15ded56320723478823b647507ba9b162fb7cb6be14176dd8f5362a7fdbdb27f61a1a3eb8dd432b3370bbf9dadbb31f1e3a253a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
716d7305cc35824c39f3ae708cff1a8c

SHA1
29cc387eac5e3d36667d850419a5a6a840a68cbb

SHA256
3ae570397c299e9453774088f53c2865702acbffd76ed64623a871e7344de0ed

SHA512
5e4eea038f5dec2ef9817158c70c9001e698c637deb9ec774fb958590c10231c6e648652faf096dc7dc9ef394c811209effd712bb7c5156c75c71c6eb576f5df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
63ccc4aed2490c96c4dc241be1e8ce0e

SHA1
747b6421c40e661db02a836a63f3974053b524b5

SHA256
5d78dcc4d37afccee45fa753f92262e669430b74d8dfaf0464fbb79a98b8c6a1

SHA512
30707e0bb6c9c0255a0b0c5216704375f568129dfb521a6dd43d452ac3fa50a04cab3ced46ed2d2911ea281f4d99ea6cd7cc63e67c6c59f1b91184241d061e2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0ef7955d4eb28038b0da0cec71f3e1f7

SHA1
1d301c4723eb635b6b1ef20b33d78dc4d56a2315

SHA256
61fc9913f48eb2d5fe26bcd1811ceea8995c112e8354d5ffeb46b9fd43097bbe

SHA512
4d13abaac34fe320db317c0ddcfd123ebdee8a87a445fcd1b27358cf98d3cca5b4d8fab7dda3f9487f0f895693100877eacd5d3a86d82438ae14689043db2c22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4ca92413442e00819b0e6bd0e3e52625

SHA1
e19f8d4952bd8ff365b3b9281b57628b783f8bdc

SHA256
cbf32cb841dcf09ad5aca9c4c30ca89df49a78069311db9f04578072c62be332

SHA512
0c68fe983db525060a4ce40f087d0e2b2ba0f4518243483b5649d661c3a64bcbf84ea517aeb92d646c89909022935fa49601f445516c9efdd6a71a102d9c8d74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
239111af270a05c5de394e307a8d901e

SHA1
f989a6c4e53166da85ce7ee33f0e906e6d73c240

SHA256
8d0486af9ac2c78a37d3dfa7f5e76da7807afd176edc71ce2a729c2cd5d402f3

SHA512
94619450aa9f6dd759ee29d6e1b959524fc909f1972634adc694824f84f33a7abf51ff3fae464b48879c79552859e180fe547486d2705f98f97233af7cbaf41d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
d05942453e23158bd90ffa1a04b2f333

SHA1
6949f69b839684db668b8111e13a0c0186a5ac52

SHA256
6636439bac591611c27db1e2c19673e49b085d1ac01459de3e0866eb94a78b50

SHA512
22aefc1f15cd7ad7eee7b5f226d11c7667bd8b016bc5f7b24b3359732a30447da017758d5ee15fefc55d183f0ce8f7280e8884c9169a607113bc618070e99fcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0385090d811b2e8607f6c7c31e31a297

SHA1
29b59a2fe47cd007067e29d08c3350e05b96230e

SHA256
f69f834367d0faf53e1f653fb09beb70e907dbfff3979dd1a95b8993a17ca110

SHA512
49cceab5f93a8c5b072eaa2e3ac23b2057e265c7724354d57cae4c3c7ad52c7d2f55dd3c6b46528425a1c7d2115ee33afb56a758f7c92d6335108ff4504e109f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
2bcc9ff0789052bde553bccf8e61cd35

SHA1
c6a46560efe95b31be88e6ad2fbaf9c34c4f30bc

SHA256
f41fb8ceed138fe3d1feb95de925f2044388fbcb640374c61456ae0b0d1e4cce

SHA512
76ccd9a9093c1ca4790755beace21dfd094297b11d56a580f2fc213c88b4abb34cfef9a6134d995dace53ee94297d13e9113181d6f03bf0937ef0ab1ca840314

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
6de5433d47e71869b80b817d20084b18

SHA1
058eb981146606f2e3108684824312371e7a6e3b

SHA256
546aa14feed622feac6ad362c32f48c6ca8fc3168271b8396fc9fd7d178ce9e7

SHA512
c5db27dd2dac05bfeb598e8a6e222f047415bfd0963880f164a16614e00362ec7c408c31aa4505716a9c73defdc90d4aa6e21a04e6a7e013584c6b8e8431bfdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
47aa5b58c9a3270ef3a7a85482440180

SHA1
805c11dde9cb4c566fe6e50e80dd8c4de18ee167

SHA256
a8f94e9e4ce5a5459305c1047e8f7f4b9fd9eebbe702607558054511f26168cf

SHA512
30696b59967ee788253f868fc53b88af0eadda07492e95caa7c49d23744a6aa0df79822cc4f0ef86c65b996e7f22576aaf6c3f75a0ba5a7a188c4af4151c5d4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
92a73e182617264285807f8a6e80ab05

SHA1
5eaf02461afdf7e8b9074055d7856af52c77d755

SHA256
ebb076ed2bf322dd184c43b480b946aae1dda9b431234b0c3e7e087897dfcf74

SHA512
459a2b2f4baad36b5869aeaeae70cd8302071e403f004349f258510db0ec50d475956362bf7246c6b88e065921a8a3ef9a73381b5f6c1fad5365f2951d65bc28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
94d403ef528295b4775edad75ea0f39f

SHA1
5108ca68f3f98690c66a3d9d16269595c9f5ed4b

SHA256
0422798700b23c3853d0e5991f826f1b24d57836b84fdc46a98a5647235ee59b

SHA512
0a29ad28355cd2a9f44b9beab9847b8aa985d3c45d1503cdb4355eee07c0bfc617923cd69a345d8860e1b1261dc83bb1a797eeec117b26ab417937ef709b4552

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
d30c93e4581a367c9823177a5c58402e

SHA1
d004211184d74ad1ad76fffdb7774f8213ccea88

SHA256
e2b5c60732d24eb5c8a74de057e83c9f89e35ff8bda0683316779c706a682e9c

SHA512
44d98d626ecbbfe348b066c64a3a1b3fba0358fe3098234ed392fca854bf654ee63a55bda78a27ee697c6acfceffd2342eaa10b09dd63a4931720fea4f4c6578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
b29f7a59c5f26cec58ebd07048fe3bea

SHA1
1da3d627edef23d324782d63325648f5aa272dd6

SHA256
b37a4f56735e7527a8adb2a3e0abdf7e102f2a0b108dae33c65b2a6ce09a7e4e

SHA512
134a0f59e39b4a60de7a0a2ebffd577070467b29088722498ff1c36953756b118345fa582a29587ffda16e7d3a696a3f3b48cb317bd4459ff7bdd4f5878f9051

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
20866d92e6d400f5430d552e9edea757

SHA1
9ac748523897db15ac1867d5f03d76fbcbf6f70a

SHA256
a9be8f2e67438bced5913b89054f50b7f1e2e695b7f1a2b259d0e69e62a33a38

SHA512
07c177fa72fb80e83e18051a57c67a5a880bde68502caaa8795518f9547e185fd452a915e4d02f6d3b4de81273ef0b74e24c928f96cbc7f68085f3e8e904c5f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e2018241-0c24-4e1a-adcc-f91aa356baa3.tmp

Filesize
5KB

MD5
dc7ca2289645fcf5a3bb1e4e39ec969f

SHA1
0a83b4dd9ee139e6c1404ddfb820b155904d40a1

SHA256
3ebdcabadae28e9054c08f0b3a88c7adea820bc9a747fe6bc61b90f169b464df

SHA512
e10cd80c19a24a0821e006dc92e3313c090c3e47114530f931941e64d1105e78779ca7a487cf6f8a37d3fe25c00993cffc6a07e82d7d7abb6dfba2a0b654b112

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c969c5f3f7ea6335c250c2833a3c63d5

SHA1
a145aeb86cd0fd0d59fe4b176f578b398e99bf9c

SHA256
431b0453bad5d0f888eba3c6e1538472f0858da08fbf2a6f4bc62b4afddcb21b

SHA512
cf999192df1ca2a61ab1f268acfa5229415876ef45e9a0248ea92b167e5584118b118c335bf5631d7dcebd2f9aba2647819c74f558d05d9db57e309acf24116f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9f6371746b497af78211d9a1b0f68677

SHA1
db91741a4a1316688dbf74ecc4ba28cca76caabb

SHA256
637646738c350b26df66fcee9d9d10a91c4ad7f84e23f921c977d61c45df16a4

SHA512
18ab446e3809432c93cbd9afe6bc476c6ce926a20bc4428871b4fde02fd1b58f0c45865ad198a676ff270e2a8c67fa18d81a26c4416d530d1523e817c44e4ca3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3562ece2bf0035a665f8764b5aca9b41

SHA1
dad9a10f5eee3e79120b5fe3486588cbf134479b

SHA256
423a5e2ffa5f1e92b995276c06b466d6bc3597c2c43d48e688b83c74c6c708ae

SHA512
9b9cfa5fbc0e77d64ab09c81bdb16d7ad838f0780bba2ce3b26e64e75a08b9d2c855b38e8a33eb36984618d60032bbc9a2b124cd55debaa5ab95561dbf194a67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0654a37292c5b62522aa84b31062180c

SHA1
042eae0c9a18eb387a66809bddf770a0fada0141

SHA256
16a678dea5cb5c2093e75dcad15dca6890e89bdc7cf586181dc440ba58711ae9

SHA512
808de376af48a3b70971c1c364639fac5729fcfa94ba6724ed1b59682210c2b7ebbdfbcc246130e75f6ddc963df3e645f618c356ac9b9ce1ed7ebb601e54c30b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
22bfaa230dee46f7c2d54ebd5b7535ec

SHA1
acc82e085623451ec00e00d9694ac94a4600728d

SHA256
8f914f916c9f88bd4f9d92454ae4ca7fb27eeeea802f8c85849afa34651fa2ed

SHA512
7217ba4041f46cdc9e0490c0e22d8cde138d5d49ae7cf4fc8a79835b8e60f8db2f48b7493f9c31b50e31c3c9fcc0140a6c83a8058299d3038055962e30f0f01f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
35b34ed17d7d5dcbe481b08d256b1a9f

SHA1
ffb4a8c2cb64b380b408cd6740250d53a535b860

SHA256
56e1caf13afff95a5a42a64ca20986cb0af3b2957838289100219704fc69309f

SHA512
7696c21c729957cf753b96feef97841e61bfb98861e2ee2db0bbe3d481a683c548a30d3f667dc8e697751492c13b14d6f03bf826f9fa328385a0e390963f4410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
964cbe14b4d82ac0758b14844bffbc08

SHA1
68a3a3c7e40374d3aa84b3bdc0d3907c08cfa4e6

SHA256
45c458f5dd1a765832fef7c97c47ca19eda2a75961948caed7fc8b16ecf4bb03

SHA512
fa426a9e50261f5fa528053d8bbeb191e7273bdd436024fa283986689175c57a74918108f4b03b3bfa74ad76beb0ccc5ecb91b92e4fab79aa3608275ed0ef796

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c1f2029776785e3ed3fad46dfd412570

SHA1
a984b0e56a1fd9f8a51b14a4f4b0790e934b024c

SHA256
f2b26f892569dc81ac32157ce7d484fcea911feab2540626a8652478320b1c00

SHA512
93da7266ac9140ecbed448954bdaa251ac6f07d11ad9042b4181c8e7c7e0407f3c5510ae254b015226045fb96a52ec7e900801c7e6a2543e878cc6813ab2d2d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
543e614af4877885cd32fadc07c5bac4

SHA1
09be10157598ced74ddf3efab6539434ea9f0e45

SHA256
94ea45d63bd3d5c4d7ad0f198de28db8934a47e82e26370ad0aedbfd3844dbf5

SHA512
d494b5e6ef21fdc78fc24ad626642e79a5b6ec9869dc482b245069629717afb35cb985b76bfc27c76aa6dcb94c1a53b40dd8109441827915f0ed172d88b39f7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d8e84960ee7e9219dc1fbd9c8f89a12b

SHA1
4dce20d757bd388e23087366ec462d010424fb85

SHA256
ebb46c9d1930fb4e487377982cd77ac2f02a8659c38228246606a6fad844d008

SHA512
45336a5e4eb177b6e42056d8bbc6525c6f5a6723628f42cadc731127f69547155bc7814e39de4d4b960edd60e7117eb2cf5f1b99e7e0847833d84b31126b1ed3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0fe09bc96bd3dadeef1710bd00a177f6

SHA1
8b9462cdfe294f00c974bb9d455068a5d05225fe

SHA256
4420a0e92bcd5e0a83c0acb13d17ab27e2f8a2759a6463702ed4a9c49c2068f9

SHA512
6a837b873dcdbd92778b256476e2a46c1a39e79985345e3efa98b7d25774978ca4c5e120cbbd05dc8fd94c3f71ff5e96d5fe6bba87d1bfecc070197dc250c797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4b0efe2e53cacc23536236792e4a02c4

SHA1
953a1758f8cc0307230bdcce31d6f53241ff47e9

SHA256
18810a412726e5bff6700d6aae4e21cd00d718802e24d4b0029207ef9bfff2d8

SHA512
fa25b6077d2a6b840c0f4d20cb70b928a85c127ccff4f605ba12b8faf971684f02898c846f04136737e1a9fc5a5ec7657861dea8191f65083f5b10242b0cc1ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3ba2c0aa5ac4b6dfc30d2411a5acde2b

SHA1
b5573f24d0a70e2e4f22aa7942695a75d8c4a3ef

SHA256
5ce6ae8ce7583a5c4c617e95530f909224c6b2581509a9f90b803eb31a15b8c7

SHA512
fa4fc331c57f99095b037ad5b9a49a8b1198432b48ee1633ae1255bc7469ed7ce38c2f98298a0d578ba3be6ae6a1c0caf536b9f712fe6c9ddf8bc9a64bf8a95d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cfed4c74f40e34dfedbd59abecdc1cf2

SHA1
419b3a13214cd17eacca01359b3e3597615e278b

SHA256
51a75654ebb2f71fc2242bc9314311807ce2da0d6fd1fdfc057bfbb521c831a7

SHA512
6330e95f37630d4c9e2dc292b04f2a21cfca5a919bf1d33f0809c8165ac1438f44b0f3c6638b1320261ee000d420a36d0e3aeb4d38af2fc45afea0bd39a65353

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
658dc8d28dd5eaa5ed32be0e45006d4a

SHA1
6f3e2c5d7e62f6b608fdde0167e09beee03d1766

SHA256
ab6532f6b820a38beb57cbf15c46471ca2e4fdce047a747c77ad9352745430ec

SHA512
ae3dfaac4f525274036e19477f083bf12f0499d48ea7d29d8b875a848950aa19bdff0bdc4fc251ab428dad9b63f417722bb50305c06a97a17c440952ff6be672

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
afeb7f18298f79ebee7b465ce2d2d67d

SHA1
4b7272121b630ac487641a3a9893ceb2b1241d08

SHA256
65b6d3316fa34ac9f2003310b0cd15ffcdbb04835c930b559bd750abcd873eca

SHA512
160abccb98fd432b7b0abcb00b9ad150e71e8f124413325dde7dd8601f2cca8520539f9ab020a01e28d8aed6c2ffd63b2c8e200bb5f5634f700a1d80d6afb059

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b5ee498243d9b848596ba2b9606dc923

SHA1
2c08262cabbc82694c6ca56049c97af7a4508826

SHA256
d5b0414eb3df394abff40b5dbac045fa80e6e0952d84cb4c8bd8ec8427af7ee9

SHA512
854d97db70ca9348a6ead6115729f376c5e9e128036a76e88c656e1822e5c16d380bb11d29d6f99b69846c0615b3898dea6919113e8d6e06891413bb6a5c5556

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
023c10b6bf65f2f88da765a29a1f4c24

SHA1
26dd02dae0e7faf135048ce14f84cf59e6f2febb

SHA256
1e99201125c34bfb5981039d3ed13e6f09fa50ec146f7ad22e2068b3cd065285

SHA512
8b6ad208ca53fb3f0711be9b1d2bf94f0e2088a502ac0b7a854e1a5a2b6996c18432e92f5a5de9f9ed0ecea03bb15a9b11ea36df909ebcf151211861611cb3e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
473008cc84dcf625e9e461d57c3890de

SHA1
a2cc7e96b3a0e967048ef11fb60f771dd418bb1f

SHA256
8f1e7c77d46163e16edb69aa3b6300db1fcb63fedf7d79b8d36ec12de8fe1599

SHA512
fd7606bd762c88b4deea0d6bc03c25298ac30b2344ea74563bc910c428883feeca4b21d83f7b72999d7bc5165ef7504cdd46d01a3e3413cd7433eb3b65f7824c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0bf7da7e40eecedb875ef286423b370e

SHA1
40444e6408db2cadc19971727557b303bfcc1f39

SHA256
f42944b870d17413c2ead4bbee7bf83f059eae13f92080e17de3db6e48d781f9

SHA512
022ecc38e540571083901ee01258241321e57770d64c23653ec476a314a606268fb2035ef5f879a2c18495e8597931c3fecebbfd715167a310347d3bc2000dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2a258e8f67c0e08e7e1f53a5c801e98f

SHA1
a081fbcee606c622edec27034d5260e79205980d

SHA256
3a549631d321d3b7c097e9c1e9ddb7d6a6f48cdd34d3a03a12921c12e2d205d3

SHA512
9faed1cfcd1d0f274e69742efe7dc58c71fe27b0e7ffbc8831927201f11ed401b4c6269d08801d5890a5aab9ea9d3feaac586a8db153eec5d83db991d170d64d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fef37f153420c34511aff74de921d3da

SHA1
9a77a729b650ec2b04f880b79a36e5c0e5e76c35

SHA256
b6d435c7a7f7e4c984fb114e932d34f0dffad9628025931cf0b268fc4656cf1f

SHA512
c1fbf4cae6eda9835b2b2623145ab27b9c4d116592caf55d08b309f68bfe402211aaccf487d0a8a4937105cf57b8fa8631d41b4dfe90731e59a5c22e058513fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0405dbff418fede0e5411dbb8d7d87f2

SHA1
abad6899bbd9f96edb72e98d95651e942bcdf123

SHA256
da6aa7cf6a2a8e6db2ded8ec996ae48f2acf90fb85f3f1a8d85186bf1332a8be

SHA512
71a31e9a51be2ebe0d01916a4a209d50dcbb9cf642f1d66f88f9369c3ff7e1765ac010aff9fcf9c6262f90f563b3259fb0a422d0d0b58b3f70e8fe81ca962e12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e8917ab9e684fa1a7af2d4f69c4d9f94

SHA1
3cdf6b460f57df41f06ecce454d3e013988cf13b

SHA256
068da4a5d0e14f634c3e3735d712c9e7ebf12f0a213524c88a4480d0f83747a0

SHA512
366e2355e612ac89cf290780bc1343244d21b1370df4c7e51115cce5324ac4e49aef66c8ca1e45fee82f6dd1c525e9a0aa5513c20210ef04176462bf8da675bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8d5f81e65a6612563d1490009d5734a5

SHA1
c3c3728d8200c76dec9a21c6d8bdced6abca0384

SHA256
3a8b3b0870c8ba033f5805d22119dd80eed433906a4eebd2820e446e60821953

SHA512
81eee2da3871ff94920fd691a82706932e9d82e77a5f64c114a514c45557e61fcc46cdfadae9a08dbc00faccf22d7b0c0fa3559e995390dcecfc7893c87b768f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
93c9c1330a5c03917bd32e8ad6088c21

SHA1
5f221a6e39b9fc0a958b74ba4a51e858eb07c511

SHA256
b6ec065bb579818519b35d636a15f3423904d3b2bbc9ace9a7f081be84544b96

SHA512
286c1a1bcd808f904077d5867d3ad6404356c5a442ce40e81880b5af4bbf30b5b9cde29b97ff4e3ebc7ed06759417c934f698f0ca0f0f5262e011fb880370bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
40b8e21687b8241717610978bf7913e8

SHA1
283c1005dde041fdb8f448b72e2a7ac4fdee0eff

SHA256
e254e0e4ffbb135ca33b70bb90c5dce348acea3c6a43ff59a089ed144a077ade

SHA512
e3c158daa5c2934e32d6948b9864be61204098b7f831b9ca074bc625cc2bc66c036193aba214abd1a0ff08775a25679d0a424ca7abd7e08c26f8185cbc1ba0f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e6f109b642ddd41ffe9eafb8e68bbb13

SHA1
55dffc8131f6137c955ce61a728bfd726c8ee883

SHA256
a384f0470f065f0478a5177c8cc990d2f8e7b019c99d4aa9fc40fdb8dc5f3b9b

SHA512
2a801bf0604630339bb635fdba7f4f80c0ad34185ee0987e7324537b924e94c160d4e3ad60f75f96131489bfcf1c9100290728683f6ad5238c9112c3f9d6592e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5ccd72bb28a670146bbf7f45ee1556b0

SHA1
44b6d6a57c145fd64a3ee64318016923878086a8

SHA256
16b3e7b78424c958f4fb6eebf09e3853d3d49a5cd08fbda80a1097ae326851d5

SHA512
db83377353a51f63ca678263158a577be97f2c897ce9979bcc25ce24b062bb1df34693dcab8dbaaa03a157db4c803f827df78d8e0c3b4735e10cf584fc5b6001

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72f2212743303563a2244b80b5f08d53

SHA1
c90ff91f58bca30fbcfed91e4fb70ca083e96083

SHA256
4390f6044d13a275eaac7df32387858ed1c22592282f315cad5575ad244ec593

SHA512
8697d04c39a44f744d9bb5247db339ca7c1f644f1c087c95ca5d0e12e7bc04457a575a599d3ba40a3aa4675ca78bea807d2d1543c51aa92df7dabb8ffc1aa98c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4f7a834f184a51036377865a12436373

SHA1
dd8f2d4d89daaf3f6504fea6d62b599910540de7

SHA256
e7c3883e677c09bd815e353ea5fa66c0a54e4fd59912c930283f7a1529488883

SHA512
ee7392a73c3d925c0458973a50bebe35a2b850726ba4ea2691259e61556b8f9a461e2b0609397f9bf8e200582b4bc52b2a49f1930939c06ac13d76b92a815cb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
da3a9d80db568eb1b6bde72fa6ae1e27

SHA1
362f75caa8298bdd9d507ba026e4ecc61ae4cb07

SHA256
15784ab857f9d71b429857b95287fd31a2f78483932e7b6f026a1ad4633d932d

SHA512
d05ed7b9e919cc13adabe39ddca064a3051cf29fd9783424ebac4b0d1a4e40419c1456bd1e0b91e4ff649a0974b74ab136a4deb5224084cf8369d3cb19f259f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b9137619fd3fc172d1c657517be1eb84

SHA1
c678c7cc98bfa0ece789fbd491b97f505324bdec

SHA256
10b9452787782253a6f2c2e451e107bbd28f67a45412af8e4b69006a6fea5f9a

SHA512
1d0fdbab8cddcf3782faf9e5e932a1f99a7886e7476d04b55b13a00fc12fa61b439e3e7aa76c24527d92f7d32cfc907059e28cb34c754973abcc4a938f08d168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
91d7b320fa48daf8aa0ac4e75d8c7bed

SHA1
056a62cf34ecd1666bb2dfaeb69e09f25a9a3bae

SHA256
eb3a2473aff2967c3049a67ca7526363194a409d49c8b2760c12ec23850b88a5

SHA512
26849d587726046df7a47f288d1419bdf7c1d0049125da5afa7571d669ee6e3e5ca7f48fd678277d75d4aacd6e5d48cb7c93bc3bbedb4f7651768228cb02d44e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0d283d46133e14327ee8431c377f2bfd

SHA1
fff30004853529a4d194db27850d5cda7b18d1c7

SHA256
98a49f9a5d8e56ae19e51f25ddc455b02756566f1b985bdc63656c3266b999eb

SHA512
8d694fead90a524682768b21bb9aa0c0edd6eee71c574fe496ed06a09e2224761357e1b66e367cfd469b1b2b9ad23ae13bf784520dd6e5c4d32dae05a748505b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0fd160335f2d709742a9b4800035a6f8

SHA1
639348256cfd69087c0159d2f7dc5db1f1877068

SHA256
fabc4ae3b76a2e22c31c87a2019c21c6a21f10fe83064fbb62e96564dbf22b86

SHA512
133ba8b469ffde2610b177bf2a8c08bdbe5db55f4d6b272689dda7ff8726d5d8d22ac9988a9bc6f29c61a4cc5a17ed8bacb2c20fff58ef6de7c6a45b11c386c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2d794ed7c09588841769360b7175666c

SHA1
7961d07eb4c4222b64c6876384810fa7ce29d12e

SHA256
3622eb6602f0ea074ad6f9b759b534a748c726a4c5fa4ad2f6703e3504b824fd

SHA512
c1dbe0911b3ceb96d4a959f9edff7c0bbbcccd9b26ff38556419edf25d3044c50368a221eb4b95e1e8d260fdd398102485b68d14efcd782b01a086dcaa20b61c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bef844ac07fae81cf038edab8fff9d61

SHA1
d9a75094c629589fddfe9f7078fcff9ab12b56f4

SHA256
27aab02dacd4168fa8bf5505f409b70a9242c0056569624e0bc427b9bc1b1cbc

SHA512
0f7a1079fc7f0bb045f36a189bfe383650415ea2f6660322a829c1937c352fce19f709832cf6db31190bf9462ccbc0234233f3676cecfdea62d094b6a2cfb4c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2b7969bdf2cf5da8241402040967aec4

SHA1
87c3f70ec94f94a53454970b46971df39b6b80dc

SHA256
f38a97f5a8d73360fffb288d5613ed8c9fca6e679d1c29216d9825378f7f0d6e

SHA512
7d1cb56bea1c761aafeb68251daac84f33d1cec0a9d48efd03f92f683d509d3c1f257667c631cffc2e106d1f5fe9744004792303b14241f24d059f5171e15cd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1c7339cd5be7552b9d6c8ae8346bd9cc

SHA1
da601084af01d691275e8829eecb655191b8f65f

SHA256
c7cd9390704443c9ef7c758c6a249a8b37647b74021e7a768801d00dfad1d8c5

SHA512
541d7b6df5769e1f93affae30229f21f5ad0901dbbb1ef9b38c8b14ba2f4e257674d1750cb4a4cb51073f321151dc449eb2c6569256d289322990e999f78e69c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
370247913c0ebefaddb71d29967e16e2

SHA1
71859931a8c2ce655a00f2f4f7f3039defae77ed

SHA256
ae5e51751f97101f989f25869086deb2f6491a72ccc802caa65dda546cdfff69

SHA512
f305cbd9967ef69b5397ad5c9570303a8d0bf5ed951eeba0cd00976500c292d69a8809bc2a1a60a251aa75dd7c2fd03dd423d5e4da764e83c2a9e6bea73d49d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9c0b1740b85a515ccc061f767212df6e

SHA1
32049d47f9a83866f97f1214b868bdea6b56c5ff

SHA256
41d12738de8c56f4fa4d05241c21b5c387f84b7a0cf0b11e33fa81b82d7ece83

SHA512
3a66681afe592c3d54f749065f01a9ba25c56bd72e3b51265145bcb6c6a6e5b83683fc97fff05d753315dfb210f0d0dcd1aa42b1619c0b1cb7d26ffbf8ad9796

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
160335afe20b85d9fabb3e8a7151f838

SHA1
a4dbd6e2f27d9416e684ba4df71f8a9685d60b47

SHA256
442a022271cc8b011cc9e7db15fdde9e91ac52695beb2e8ab9d66eebc058aafc

SHA512
af5bad85b0c6e11212fdb1acb69211a189a7fa92f5683ccc63df6aaba2f2c6d8c789174f33c6d536e5e9d9914d588953cf23184dc45776e4e503353afd4e4792

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3914ee8962d7daf94a5214eb0816164d

SHA1
4c4cae22af55b25bd4345a3d2ef123fad84a0484

SHA256
e98fccf6cb5781d61f0825af4777e220e9102cd9cf1a8f5bbf1c8c6df9b77af4

SHA512
be76d48067d04c8eea4f325e137a49e7a27b2a552de133f8aa9c84477232e2bd7771e6f3c376618e7ee7c0bd5d117a66114af9f786963fd7269354b43c557a52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ac0c809defd52b26dae396d5d02fdf56

SHA1
e806cdc3079a085bbe91f837b6c51dabd61b3c67

SHA256
2b632ca8c5158c528abcaa93cb4fc5fbd49efe34874b9fe2dbdd1ddb17544579

SHA512
d41c5ab0696baf7b6479f0184deb9545f2db20de83b7543169a96d4248845061cf5e181027bb928f1025ca8a328ec01d89641ef0c5bd9fa6c15c9d35bdaeae13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
62eb4f8400defab32d3fbae92cdc2b0f

SHA1
3a30d77bad5ab7c3d11a139f09360bbf0b530a16

SHA256
e16190b56ecf1e8d9dbfc6bf57416de472f7f29cb9a69b0bb9565ab265959a4a

SHA512
ca906f47c8de79e29f85ecbc73c1b8b942bf4baab2a181beeb9d8259ac59954db28d2119e0c9591ccf0eade0d6bb432155e85a6dbfb74de29fdcc2a03f97b9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2990a557ee8dfce09278dbe1990f0cb3

SHA1
4c5adca0e5d286427ae1ef134e5cb0450127642e

SHA256
5c2f5cd46581ac435275a874b8218d94f70efb756dd2939b83e667a4d427a31d

SHA512
76b8952411df30ea1889afd7a789c722d373d2eb4724c1554de9ef076d1962cc80d5e1be4ef6dfe2575f63884084b496531eeefb367ba14341da8620eeb813c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dec4236a-55ea-42d0-a7b2-0d5f1f6caa97.tmp

Filesize
10KB

MD5
80c323d16516699642703f8525b4d0e5

SHA1
bd41d9be62d3e833ec2faf78e69ae57af29ec635

SHA256
7fb458759f1eba20c86b896878cfa0b91c10e91df4e70c7e3e0fb99aa36eea14

SHA512
57fb529f2bcf713c5680c49e8aed3da4178cb1b2f227c678f43190c538154a5423917cb7ba9ff8898679dca804dfd67c877422c0ee1e97fe6a56df0b2bf1a696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
d52ce0fba336a2a430f0a9a703073ec0

SHA1
036f6d6ae694707984ec4e8f8713fd616f4351cf

SHA256
9a5ec952efc963cf4f8789c57c9250650f9c1e3a9ed5c592832ed14666a63394

SHA512
3cca992ff5b363e2cbaf5c21869cab888affea5d96840580db3a8f4978c26f7e5854a3ade26dc01cb7af2b09bdea0c9b363b18cc1943bb7802e066d32da60841

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
00abbbdaff760c055750968dd1255280

SHA1
4e579e5a14af4fda9811d8ce1e80eda0903339a7

SHA256
28d2bf5e8ba3acf3308845a8808c95dc1e048fa5a972da7b75a84c357853b2e7

SHA512
89faeb201a44c51dfb39e5c398af14e9235a355bac66b82f8bc3edaa2dfd99a74c4168593f8e5b6c4e89e30bd256faa6ae420e6e3fd8dfc73180552e20c63385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
225db6a85f2351d84f518337a18ddfac

SHA1
acd31831e15ccbc5f9222b5a61ba019b2c2eb059

SHA256
74735c54af209b61dee887475c3c0b98ed88152f69e34ab278058f9bc58bb950

SHA512
900ab0153885a83196e93e3d4856d35ea370f2962b22420dd5e8657672339f4c65b6de2738bffa188a8a489dba2e4b2a432808817943231b6ad937584685cfda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
eb8fe5969fa91d3d66a62d2973445298

SHA1
372968a2fe4df09735d5f90457bce6650470907a

SHA256
eec83f25fc39a15cb66eee55932fd4b0c8d2cbcf5579f94506946d9f69de6059

SHA512
a6039b062a69c0fe146cb8af48b993861e37ff5f88a58b83c3b68bdc1e490da9da7d5bdded64fab9219dee5ab09227666e3e8e926f3cb26dc947c1c02613c469

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\2eaaec627d05c9a36db0a75f68c21272

Filesize
5.9MB

MD5
2eaaec627d05c9a36db0a75f68c21272

SHA1
9c123e54b8fed65b0c768c1e248a3ae78964f625

SHA256
18eaeff48f24edc79f4b81a3d5d74644ba8e57653c3ce0a30bc15df917964452

SHA512
cddd4bf4c19dfaf39e97b65ffb20094210e53aee9d48a6785e104d8d71de39ee8d9faac247100f5c867edc65294df546082de692ae7fb00a89c711e63cd36d5a

Download Submit
C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem

Filesize
226KB

MD5
c656d325f5df1991584f0bb00a27902f

SHA1
80713b343427211dbe8932ca6f642452c20ce7a6

SHA256
98ecaf8da767ccb2870dd30a5e7334d2f45702a3a33ec8b4286e6ae88b720eb8

SHA512
f7fe201f971410a15b44577123f3c3ff7982371aae9adaf2c52778ab08ac663ac0306878a665be3242662cc873cb0917b1eee3f75e45ad789d4b84474187bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Bootstrapper.exe.crdownload

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Users\Admin\Downloads\Solara.Dir.zip.crdownload

Filesize
9.8MB

MD5
904180f536e3c47bbd61e451bb9631f7

SHA1
20c0e0294ec39850545b6c1844864b0339141825

SHA256
5a072e88942b37c1afbe54875bec5d7c830868cd9af514ea88764af9a2a10fb8

SHA512
806d0aa5d2e9c759f3ee6b9a3a7e7308c16a7172d9e76a8463fe696c3a941e1386ea61ce428414f9114c55a29f95d395068205c25f7591771ddad2dbec5f344c

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\CertificateRevocation\6498.2023.8.1\crl-set

Filesize
21KB

MD5
d246e8dc614619ad838c649e09969503

SHA1
70b7cf937136e17d8cf325b7212f58cba5975b53

SHA256
9dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1

SHA512
736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
2ab048377c2241cd8c5e25f393f99184

SHA1
ced815d9f1ae8ffe49ab10d9a9228d8df389c88e

SHA256
8b4ecf40bc67cc130a1d869004cef9f3ae51d72ce2a7c348e02c0c86b4ca9e4a

SHA512
521262f5fc016c7a20f420b072730e5241dbc386cf4118bad1a4500acfddef01b98b5e8b2b0e595dddd2c6d658a101a90069397f8d50caaa32ac1fb957ef9092

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
1KB

MD5
c2064044dad5024d670fa087812db006

SHA1
b7c1bc359c35d54530bbc81a39270060824dfad1

SHA256
62195c7cbfc315474a3899d7b76054439afe2b097141c53d083f6f5e2898dc31

SHA512
bc1fe08d3227e64490b3f83eafd63cd1f7f6219b5b7037427349b1e9ce20c68fbf0ce78d641fad2db90e66246ee65f8638e0436228364b77fdd3e2ef38260d1f

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe6c64fd.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

Filesize
6KB

MD5
b4ac8c8ff768de10f74cf108a332ad06

SHA1
88a11293d9f9f409eca805b8449199345e6337af

SHA256
47b7d551e8501213e376b0019baecad575f4acc4f82e78a686cfe2f2e96c0fb5

SHA512
ffed6e6bb0c947187859395cfd935b2b9c8f92ea45dcf79726623aef8cab7bf92f93fe5f78599a65bbddd69edd3b4a51fba26b307dfd1cc5a2ef3fde325dbf07

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Default\df0f4077-41da-4970-a7aa-bbe2e1b74c0d.tmp

Filesize
6KB

MD5
0be5e084fb41c8866d55038cbff33bec

SHA1
1bae49813721e9ccde990f00aaf7dd49e7968f68

SHA256
40711d7b44a831700b1df72ff069a26b643013a589ab3b24f871122e11a9d3ba

SHA512
8410ac7c7be5abd94d5640b521eae570cc2213e0ea0b4c438b763f58a7b3c70e9f20c638f3ea935e3b3b204bad814ca56129704f1c6d353b1338d76b6d6e4416

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
15KB

MD5
36f3dcc5ccfb5e1c59551aa0f1e9dcd4

SHA1
343c6125925f334a3e529247db623be4f7648076

SHA256
8a443953f50c5f0250b493d163c536a30a0a70acbd5eeeba065b414dba0e054e

SHA512
ac9c2103f5e85e94186715a505ed4e7aa6c2db20ecde16369476da80cc0da8157ff33079849faad3e0701184144042875f2a25353d7141573bf57c70bf8f55ba

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
17KB

MD5
01c207a0b594177719517bb920f8e0c4

SHA1
0462f410dc7e9daf57c970cc14f751b9b90742a9

SHA256
7ade0f5b32d9a0258710b9632f8600c28ed5caa583226075674f4b57e1313cd6

SHA512
9bace98e955bc0f4562748290f223d171e5bebd5377168fee9955b0264563d5c46729911eb237ad5a651dba042d7393a3759f5baf5cdeda7fcf03912c5d19f21

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
1KB

MD5
ba26396ef8ac43d43195337a866d44f7

SHA1
ae9589981f9ecb94baa51430a500a3f7bf04a887

SHA256
8cafaf08f6df703f270f844dc086c0eee123b0911f693d80536e01600a3d1976

SHA512
ac54af722080278a003d1aa46ef45ca671db1e93391a7dd9977819f2a95db1179db60c6dd6ef76923e50ff41d9277197a339f90a51c3941de555b0baff5f01ba

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
2KB

MD5
590e1424a384bd092f1d6bfffcc51064

SHA1
451f829e7cf130795cf98efc1b59b3bbc4ae4d3a

SHA256
6850b960230edcd50f6c62eccdd3cb25fa02b47e7fc799d89062eb7d477ded25

SHA512
ba2da542e1eaddbe2afa2f2a830bd84e2314c5c024c21e6ccf82513365299d2eb82d39987dfcd05f758a896747e1f0a3755e67fc261c629030148b6313e44c56

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
3KB

MD5
a2262c13252b453ec849f5941f2b6d9d

SHA1
6859dfe164a5f7d5c276239ff115625bfc5a6472

SHA256
522ce8beeb3b01499f4df43ddfbc765d49e91efd0d222aeaa952a7f0a2c331a2

SHA512
713a23a701e55ed2cbcc48a881c7e0c565f610583c8c5f13fe65d8465cca442691efa8da5628c513b2de5027bfb4e34e8be73e091f36d374db544f6706e7a9b9

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe6b50ed.TMP

Filesize
1KB

MD5
3ea420113cb7341b22d2436c84acaa92

SHA1
8705878258ac98d550422e4db055695cfe320a29

SHA256
1b4697b2f112cf0d45abf7ce4dbca62e998ef07121ad54768842712df06b60ff

SHA512
a31d92e534e46764310019d62adb944176944e77f88432c25ca37ccbdf77c6b6fda58b4e88178f5b73b6850cee36b490e6673a1227fb35ede4e775ec42fae971

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\crs.pb

Filesize
278KB

MD5
981a9155cad975103b6a26acef33a866

SHA1
1965290a94d172c4def1ac7199736c26dccca33e

SHA256
971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d

SHA512
2d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb

Filesize
7KB

MD5
df3d937079b894c891f9b0b741874928

SHA1
ed93fc386807b3a28fcc7988a88ae4741bfe1b15

SHA256
c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4

SHA512
5728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
d43d041e531dc757a69a90cb657ef437

SHA1
09138b427565bc276cfd3ba9f59b0c8bad78e91d

SHA256
9431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb

SHA512
476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6

Download Submit
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 774468.crdownload

Filesize
5.5MB

MD5
5b6171c8dbb01d6bff4fbe433ef7134e

SHA1
402261ab9ede4118da88e15a977e48b06138f9f8

SHA256
b693b5678a7ea4620b1a3959ecf9c4864fad30ce9e2b195433fef28c296aff72

SHA512
ab108c6890bc4ce5956bb019f339c07d0bca7a998ffe09015a177bc3575ff847f36fd2e1123c713d99131d60a4b27323db911a2bc9fba8b7339f98a2c340ee30

Download Submit
C:\Windows\Installer\MSI3199.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIECBB.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\e6acc50.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
memory/4164-1783-0x0000000000F30000-0x0000000000F65000-memory.dmp

Filesize
212KB

Download
memory/4164-1836-0x00000000730D0000-0x00000000732E0000-memory.dmp

Filesize
2.1MB

Download
memory/4164-1968-0x00000000730D0000-0x00000000732E0000-memory.dmp

Filesize
2.1MB

Download
memory/4164-2094-0x0000000000F30000-0x0000000000F65000-memory.dmp

Filesize
212KB

Download
memory/4164-1784-0x00000000730D0000-0x00000000732E0000-memory.dmp

Filesize
2.1MB

Download
memory/4628-5153-0x00000185706C0000-0x0000018570772000-memory.dmp

Filesize
712KB

Download
memory/4628-5150-0x0000018555E10000-0x0000018555E34000-memory.dmp

Filesize
144KB

Download
memory/4628-5570-0x0000018574440000-0x0000018574478000-memory.dmp

Filesize
224KB

Download
memory/4628-5567-0x0000018570970000-0x0000018570978000-memory.dmp

Filesize
32KB

Download
memory/4628-5566-0x00000185708C0000-0x0000018570950000-memory.dmp

Filesize
576KB

Download
memory/4628-5565-0x0000018570410000-0x0000018570420000-memory.dmp

Filesize
64KB

Download
memory/4628-5571-0x0000018574410000-0x000001857441E000-memory.dmp

Filesize
56KB

Download
memory/4628-5152-0x0000018570600000-0x00000185706BA000-memory.dmp

Filesize
744KB

Download
memory/4628-5151-0x0000018570990000-0x0000018570ECC000-memory.dmp

Filesize
5.2MB

Download
memory/5000-2114-0x00007FFC915E0000-0x00007FFC915F0000-memory.dmp

Filesize
64KB

Download
memory/5000-2122-0x00007FFC908A0000-0x00007FFC908B0000-memory.dmp

Filesize
64KB

Download
memory/5000-2101-0x00007FFC92E90000-0x00007FFC92EA0000-memory.dmp

Filesize
64KB

Download
memory/5000-2108-0x00007FFC92FF0000-0x00007FFC93020000-memory.dmp

Filesize
192KB

Download
memory/5000-2102-0x00007FFC92E90000-0x00007FFC92EA0000-memory.dmp

Filesize
64KB

Download
memory/5000-2111-0x00007FFC91550000-0x00007FFC91560000-memory.dmp

Filesize
64KB

Download
memory/5000-2112-0x00007FFC91550000-0x00007FFC91560000-memory.dmp

Filesize
64KB

Download
memory/5000-2113-0x00007FFC915E0000-0x00007FFC915F0000-memory.dmp

Filesize
64KB

Download
memory/5000-2110-0x00007FFC93080000-0x00007FFC93085000-memory.dmp

Filesize
20KB

Download
memory/5000-2115-0x00007FFC91600000-0x00007FFC91610000-memory.dmp

Filesize
64KB

Download
memory/5000-2116-0x00007FFC91600000-0x00007FFC91610000-memory.dmp

Filesize
64KB

Download
memory/5000-2120-0x00007FFC90790000-0x00007FFC907A0000-memory.dmp

Filesize
64KB

Download
memory/5000-2121-0x00007FFC90790000-0x00007FFC907A0000-memory.dmp

Filesize
64KB

Download
memory/5000-2109-0x00007FFC92FF0000-0x00007FFC93020000-memory.dmp

Filesize
192KB

Download
memory/5000-2123-0x00007FFC908A0000-0x00007FFC908B0000-memory.dmp

Filesize
64KB

Download
memory/5000-2117-0x00007FFC91600000-0x00007FFC91610000-memory.dmp

Filesize
64KB

Download
memory/5000-2118-0x00007FFC91600000-0x00007FFC91610000-memory.dmp

Filesize
64KB

Download
memory/5000-2119-0x00007FFC91600000-0x00007FFC91610000-memory.dmp

Filesize
64KB

Download
memory/5000-2103-0x00007FFC92FA0000-0x00007FFC92FB0000-memory.dmp

Filesize
64KB

Download
memory/5000-2104-0x00007FFC92FA0000-0x00007FFC92FB0000-memory.dmp

Filesize
64KB

Download
memory/5000-2105-0x00007FFC92FF0000-0x00007FFC93020000-memory.dmp

Filesize
192KB

Download
memory/5000-2106-0x00007FFC92FF0000-0x00007FFC93020000-memory.dmp

Filesize
192KB

Download
memory/5000-2107-0x00007FFC92FF0000-0x00007FFC93020000-memory.dmp

Filesize
192KB

Download
memory/5340-5149-0x0000028438780000-0x000002843878A000-memory.dmp

Filesize
40KB

Download
memory/5340-5155-0x00000284512A0000-0x00000284512B2000-memory.dmp

Filesize
72KB

Download
memory/5340-2655-0x0000028436AA0000-0x0000028436B6E000-memory.dmp

Filesize
824KB

Download
memory/5340-2666-0x00000284510B0000-0x00000284510D2000-memory.dmp

Filesize
136KB

Download