Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/09/2024, 20:04

240908-ytdntawame 10

08/09/2024, 19:15

240908-xx8gxstgkh 9

Analysis

  • max time kernel
    1030s
  • max time network
    1023s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 20:04

General

  • Target

    Bootstrapper.exe

  • Size

    796KB

  • MD5

    5f16b82a8b62d4cc9d6ce02f44e34109

  • SHA1

    be96254773cba2c6f0b88e51319802b1c6394beb

  • SHA256

    1621a516abb8ecf9459c9dec83f7fb9beb07af1f79511dfe0b3c622297ffa940

  • SHA512

    956d983c7f076b176bfd1952e691e2d363c332dba317645ce991c9bb2f4ddd89771f0d035cbb70ab420b9dd906b3a6d0aecc6c8243ba6a4ac70979cebb00986b

  • SSDEEP

    3072:nTaFZMwaCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAu80IZOA4:lhY7X2Kvh4hY7X2Kvhlh

Malware Config

Extracted

Family

lumma

C2

https://tenntysjuxmz.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 32 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 6 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Sola'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4276
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2952
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Sola\soles.exe
      "C:\Sola\soles.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Users\Admin\AppData\Local\Temp\is-B19E9.tmp\soles.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-B19E9.tmp\soles.tmp" /SL5="$9029E,10256339,804864,C:\Sola\soles.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Sola\soles.exe
          "C:\Sola\soles.exe" /VERYSILENT /NORESTART
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Users\Admin\AppData\Local\Temp\is-JKPJM.tmp\soles.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-JKPJM.tmp\soles.tmp" /SL5="$A029E,10256339,804864,C:\Sola\soles.exe" /VERYSILENT /NORESTART
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3508
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3696
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
                7⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:4504
              • C:\Windows\system32\find.exe
                find /I "wrsa.exe"
                7⤵
                  PID:1496
              • C:\Windows\system32\cmd.exe
                "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1972
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
                  7⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3860
                • C:\Windows\system32\find.exe
                  find /I "opssvc.exe"
                  7⤵
                    PID:208
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:732
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
                    7⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4724
                  • C:\Windows\system32\find.exe
                    find /I "avastui.exe"
                    7⤵
                      PID:3268
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3960
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
                      7⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3132
                    • C:\Windows\system32\find.exe
                      find /I "avgui.exe"
                      7⤵
                        PID:4380
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4360
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
                        7⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3520
                      • C:\Windows\system32\find.exe
                        find /I "nswscsvc.exe"
                        7⤵
                          PID:5088
                      • C:\Windows\system32\cmd.exe
                        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4452
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
                          7⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3948
                        • C:\Windows\system32\find.exe
                          find /I "sophoshealth.exe"
                          7⤵
                            PID:2288
                        • C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe
                          "C:\Users\Admin\AppData\Local\nuclear\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\nuclear\\braise.a3x"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4492
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\1t1TEdu2Z.a3x && del C:\ProgramData\\1t1TEdu2Z.a3x
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:528
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 5 127.0.0.1
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:1632
                            • C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe
                              AutoIt3.exe C:\ProgramData\\1t1TEdu2Z.a3x
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              PID:212
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:2564
              • C:\Users\Public\Desktop\BootstrapperV1.16.exe
                "C:\Users\Public\Desktop\BootstrapperV1.16.exe"
                1⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4384
                • C:\Users\Public\Desktop\BootstrapperV1.18.exe
                  "C:\Users\Public\Desktop\BootstrapperV1.18.exe" --oldBootstrapper "C:\Users\Public\Desktop\BootstrapperV1.16.exe" --isUpdate true
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2392
                  • C:\Windows\System32\msiexec.exe
                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3768
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Blocklisted process makes network request
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3568
                • C:\Windows\System32\MsiExec.exe
                  C:\Windows\System32\MsiExec.exe -Embedding BFC987113D748D89E808226C7A427FC9
                  2⤵
                  • Loads dropped DLL
                  PID:2452
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding C48B636882DAE677D763031DE0B36953
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4504
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 101D282E4FD0E4FC6C4C076033B14231 E Global\MSI0000
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4304
                  • C:\Windows\SysWOW64\wevtutil.exe
                    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2992
                    • C:\Windows\System32\wevtutil.exe
                      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                      4⤵
                        PID:4468
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  1⤵
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5044
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9079ecc40,0x7ff9079ecc4c,0x7ff9079ecc58
                    2⤵
                      PID:968
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1860 /prefetch:2
                      2⤵
                        PID:2156
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2080 /prefetch:3
                        2⤵
                          PID:3952
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2332,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1904 /prefetch:8
                          2⤵
                            PID:2012
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
                            2⤵
                              PID:4612
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3352 /prefetch:1
                              2⤵
                                PID:4068
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4580 /prefetch:1
                                2⤵
                                  PID:2688
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4832 /prefetch:8
                                  2⤵
                                    PID:1548
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4876,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4884 /prefetch:8
                                    2⤵
                                      PID:4860
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4804,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4424 /prefetch:1
                                      2⤵
                                        PID:548
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3708,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=864 /prefetch:1
                                        2⤵
                                          PID:392
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5332,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5352 /prefetch:8
                                          2⤵
                                            PID:2128
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5340,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5376 /prefetch:8
                                            2⤵
                                              PID:720
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3312,i,11767897453319148144,3309130710399386932,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5388 /prefetch:8
                                              2⤵
                                                PID:1052
                                              • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Drops file in Program Files directory
                                                • System Location Discovery: System Language Discovery
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5004
                                                • C:\Program Files (x86)\Roblox\Versions\version-a0ba2708f6fc499b\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                  MicrosoftEdgeWebview2Setup.exe /silent /install
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:916
                                                  • C:\Program Files (x86)\Microsoft\Temp\EUD9FF.tmp\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\Temp\EUD9FF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                    4⤵
                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Checks system information in the registry
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4400
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:4180
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:3000
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:448
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:1548
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:3444
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI3MEZCQzktNkFBRC00MEJCLTgyMzctRjY5NjJFMkJFNTEwfSIgdXNlcmlkPSJ7REI4OURENzgtOEMwQS00OTQ5LTg0QkUtMEFBM0VDMDBFMEYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszNzE1NjE2Qy01RUZELTREODctODNBMS1CMzRBMEY4RTJFMzR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMTUxMzY4NjQzIiBpbnN0YWxsX3RpbWVfbXM9IjU5MiIvPjwvYXBwPjwvcmVxdWVzdD4
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks system information in the registry
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      PID:3752
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6270FBC9-6AAD-40BB-8237-F6962E2BE510}" /silent
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4336
                                                • C:\Program Files (x86)\Roblox\Versions\version-a0ba2708f6fc499b\RobloxPlayerBeta.exe
                                                  "C:\Program Files (x86)\Roblox\Versions\version-a0ba2708f6fc499b\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 0
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of NtCreateThreadExHideFromDebugger
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of UnmapMainImage
                                                  PID:3200
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:1868
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:4524
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                  1⤵
                                                    PID:1876
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:4948
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff91c4a46f8,0x7ff91c4a4708,0x7ff91c4a4718
                                                      2⤵
                                                        PID:1180
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                                        2⤵
                                                          PID:3324
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3200
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
                                                          2⤵
                                                            PID:2392
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                            2⤵
                                                              PID:1976
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                                              2⤵
                                                                PID:1544
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                                                                2⤵
                                                                  PID:4180
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                                                                  2⤵
                                                                    PID:976
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
                                                                    2⤵
                                                                      PID:5028
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9524517644920914299,12982217138666589401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1512
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:2780
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:4316
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks system information in the registry
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:5020
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI3MEZCQzktNkFBRC00MEJCLTgyMzctRjY5NjJFMkJFNTEwfSIgdXNlcmlkPSJ7REI4OURENzgtOEMwQS00OTQ5LTg0QkUtMEFBM0VDMDBFMEYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3OTBEOUIzRC0xN0VGLTRBRjYtQjI4MS04QzU4QjYwNTRCN0R9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMTU2NDg4NDYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks system information in the registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:2312
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\MicrosoftEdge_X64_128.0.2739.67.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\MicrosoftEdge_X64_128.0.2739.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:4280
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\EDGEMITMP_9AE40.tmp\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\EDGEMITMP_9AE40.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\MicrosoftEdge_X64_128.0.2739.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            PID:3140
                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\EDGEMITMP_9AE40.tmp\setup.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\EDGEMITMP_9AE40.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D64E4BCB-6FC3-4E10-A308-123239275B74}\EDGEMITMP_9AE40.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.67 --initial-client-data=0x22c,0x230,0x234,0x210,0x238,0x7ff664aa16d8,0x7ff664aa16e4,0x7ff664aa16f0
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              PID:3436
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI3MEZCQzktNkFBRC00MEJCLTgyMzctRjY5NjJFMkJFNTEwfSIgdXNlcmlkPSJ7REI4OURENzgtOEMwQS00OTQ5LTg0QkUtMEFBM0VDMDBFMEYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QkI0RjYzQS1FODQxLTQ0MkYtOTg3Ni02MkJCRUUyNUE0OTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI4LjAuMjczOS42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIxNjg0OTg2MTciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjE2ODY4ODQzNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MTcxMTI4NDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9lY2IzNTFmOC01ZDM0LTRlYzgtYWZhYi04YTNlNTgwNzIyZDM_UDE9MTcyNjQzMjI4OSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1kZ0pIVHRJcmFTYkp5VWRCWVclMmJPRE1xakFrVnB1WHpPMzFpOWlqWlAlMmJaOGNKNHVKb2pLRmZsRzF4ZzZmbzJJNWxiNkxTcTJBdURkTTV3WmtxYjkyNVElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3NTY1MTIiIHRvdGFsPSIxNzM3NTY1MTIiIGRvd25sb2FkX3RpbWVfbXM9IjE5MzgyMiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MTcxMjE4NDU2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQxODQ5Mjg0NzEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0NjI3MDE4NTE2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzU0IiBkb3dubG9hZF90aW1lX21zPSIyMDAyNDYiIGRvd25sb2FkZWQ9IjE3Mzc1NjUxMiIgdG90YWw9IjE3Mzc1NjUxMiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQyMDciLz48L2FwcD48L3JlcXVlc3Q-
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks system information in the registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:1896
                                                                      • C:\Program Files (x86)\Roblox\Versions\version-a0ba2708f6fc499b\RobloxPlayerBeta.exe
                                                                        "C:\Program Files (x86)\Roblox\Versions\version-a0ba2708f6fc499b\RobloxPlayerBeta.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of UnmapMainImage
                                                                        PID:4700
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4764

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Config.Msi\e5e45e3.rbs

                                                                        Filesize

                                                                        1.0MB

                                                                        MD5

                                                                        62f723076e9f81292d13bc3c1d861955

                                                                        SHA1

                                                                        d5ad9ab96db912f2b1108d8fa69ece20d28126a5

                                                                        SHA256

                                                                        a9c6a22e5323ecbd179301877b95fcdaa933379e610f05f150e6a7b077e39055

                                                                        SHA512

                                                                        781bb4706e70ec12a9ba46b48e5639975a9a7e994d3599c17fa6b00eb0705c03583e3a233130b3b970b1ffe348dbba04c237cc0f649bdf266d48f489e46d4625

                                                                      • C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.67\Installer\setup.exe

                                                                        Filesize

                                                                        6.6MB

                                                                        MD5

                                                                        16dd69461337762007690317e733734d

                                                                        SHA1

                                                                        235528177001b7b413ae7f1af448d9867b4045ae

                                                                        SHA256

                                                                        e3a007015a353cea188804336cec71c961c7dbd3c89cd588818114ba66c806e3

                                                                        SHA512

                                                                        ed60676bdda50480d655cb1cb7edcf7d25355b9d40ec3b3906995d53a9860b259c77974d6f12e49e01e95997cc8d7ffdb4b441f4dab1992de11ee269f262f701

                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

                                                                        Filesize

                                                                        201KB

                                                                        MD5

                                                                        4dc57ab56e37cd05e81f0d8aaafc5179

                                                                        SHA1

                                                                        494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                        SHA256

                                                                        87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                        SHA512

                                                                        320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                      • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

                                                                        Filesize

                                                                        5.5MB

                                                                        MD5

                                                                        f9d1a553612f8203a5c246abffe99a18

                                                                        SHA1

                                                                        f82e4c089d3e702049eb354bdc935f6012394c26

                                                                        SHA256

                                                                        71f1dd2c68ec5d8e199004d99b807b079a257352987663d544c83b1dc34d0a28

                                                                        SHA512

                                                                        ba6d05d4da639a0b009d8146958c60b860ee043a8372a30796fb2169d2ceba13fbf0a4caf0a6120d3f28f58d7abbaa259591e85970a5a56940c8a01c2e313da8

                                                                      • C:\Program Files\MsEdgeCrashpad\settings.dat

                                                                        Filesize

                                                                        280B

                                                                        MD5

                                                                        9dbc2ca83cfaaa52540478601e9bc8d3

                                                                        SHA1

                                                                        6f179fd1a7949125a3703effe3067eceaa13d511

                                                                        SHA256

                                                                        e09f12b7ddfdadbf2857b3d9406040a380d71dcbf26530bd37fdd5c155c78032

                                                                        SHA512

                                                                        33e5a1c2580be1af788b485bccc947bf8c164b98afb498b7bfa0b1433a4df7bc9fe411eb5c4aa0030396f119d679b7dd4b8be20d73ce2f960d3a51c4a978e4f6

                                                                      • C:\Program Files\nodejs\node_etw_provider.man

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        1d51e18a7247f47245b0751f16119498

                                                                        SHA1

                                                                        78f5d95dd07c0fcee43c6d4feab12d802d194d95

                                                                        SHA256

                                                                        1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

                                                                        SHA512

                                                                        1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

                                                                      • C:\Program Files\nodejs\node_etw_provider.man

                                                                        Filesize

                                                                        8KB

                                                                        MD5

                                                                        d3bc164e23e694c644e0b1ce3e3f9910

                                                                        SHA1

                                                                        1849f8b1326111b5d4d93febc2bafb3856e601bb

                                                                        SHA256

                                                                        1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

                                                                        SHA512

                                                                        91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

                                                                        Filesize

                                                                        818B

                                                                        MD5

                                                                        2916d8b51a5cc0a350d64389bc07aef6

                                                                        SHA1

                                                                        c9d5ac416c1dd7945651bee712dbed4d158d09e1

                                                                        SHA256

                                                                        733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                                                                        SHA512

                                                                        508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        5ad87d95c13094fa67f25442ff521efd

                                                                        SHA1

                                                                        01f1438a98e1b796e05a74131e6bb9d66c9e8542

                                                                        SHA256

                                                                        67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                                                                        SHA512

                                                                        7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

                                                                        Filesize

                                                                        754B

                                                                        MD5

                                                                        d2cf52aa43e18fdc87562d4c1303f46a

                                                                        SHA1

                                                                        58fb4a65fffb438630351e7cafd322579817e5e1

                                                                        SHA256

                                                                        45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                                                                        SHA512

                                                                        54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

                                                                        Filesize

                                                                        771B

                                                                        MD5

                                                                        e9dc66f98e5f7ff720bf603fff36ebc5

                                                                        SHA1

                                                                        f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                                                                        SHA256

                                                                        b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                                                                        SHA512

                                                                        8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

                                                                        Filesize

                                                                        730B

                                                                        MD5

                                                                        072ac9ab0c4667f8f876becedfe10ee0

                                                                        SHA1

                                                                        0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                                                                        SHA256

                                                                        2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                                                                        SHA512

                                                                        f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        d116a360376e31950428ed26eae9ffd4

                                                                        SHA1

                                                                        192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                                                                        SHA256

                                                                        c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                                                                        SHA512

                                                                        5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

                                                                        Filesize

                                                                        802B

                                                                        MD5

                                                                        d7c8fab641cd22d2cd30d2999cc77040

                                                                        SHA1

                                                                        d293601583b1454ad5415260e4378217d569538e

                                                                        SHA256

                                                                        04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                                                                        SHA512

                                                                        278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

                                                                        Filesize

                                                                        16KB

                                                                        MD5

                                                                        bc0c0eeede037aa152345ab1f9774e92

                                                                        SHA1

                                                                        56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                                                                        SHA256

                                                                        7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                                                                        SHA512

                                                                        5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

                                                                        Filesize

                                                                        780B

                                                                        MD5

                                                                        b020de8f88eacc104c21d6e6cacc636d

                                                                        SHA1

                                                                        20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                                                                        SHA256

                                                                        3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                                                                        SHA512

                                                                        4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

                                                                        Filesize

                                                                        763B

                                                                        MD5

                                                                        7428aa9f83c500c4a434f8848ee23851

                                                                        SHA1

                                                                        166b3e1c1b7d7cb7b070108876492529f546219f

                                                                        SHA256

                                                                        1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                                                                        SHA512

                                                                        c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        f0bd53316e08991d94586331f9c11d97

                                                                        SHA1

                                                                        f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

                                                                        SHA256

                                                                        dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

                                                                        SHA512

                                                                        fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

                                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

                                                                        Filesize

                                                                        771B

                                                                        MD5

                                                                        1d7c74bcd1904d125f6aff37749dc069

                                                                        SHA1

                                                                        21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

                                                                        SHA256

                                                                        24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

                                                                        SHA512

                                                                        b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

                                                                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                                        Filesize

                                                                        59KB

                                                                        MD5

                                                                        dd026799d49ede89527aa8e49fd2c8c1

                                                                        SHA1

                                                                        f136773f52b592523646e138d42fd51dea48a013

                                                                        SHA256

                                                                        6986ee194eb936ac455b1c62ed6b80b6acf0fdf9521b9ada125a591df39b59e0

                                                                        SHA512

                                                                        86258f2fc5e9f8dbd7eb91efe1e6b04bd266e5a829628792cc4fe76f6dc44f6c02bfc2b1941cba3c35b3e55cc493cc51e46780be8a16650ce1e0b7a76ec1d7e3

                                                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

                                                                        Filesize

                                                                        168B

                                                                        MD5

                                                                        db7dbbc86e432573e54dedbcc02cb4a1

                                                                        SHA1

                                                                        cff9cfb98cff2d86b35dc680b405e8036bbbda47

                                                                        SHA256

                                                                        7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

                                                                        SHA512

                                                                        8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

                                                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

                                                                        Filesize

                                                                        133B

                                                                        MD5

                                                                        35b86e177ab52108bd9fed7425a9e34a

                                                                        SHA1

                                                                        76a1f47a10e3ab829f676838147875d75022c70c

                                                                        SHA256

                                                                        afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                                                                        SHA512

                                                                        3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                                                                      • C:\Sola\soles.exe

                                                                        Filesize

                                                                        10.7MB

                                                                        MD5

                                                                        6ae74315bdb5b5f757005d23967bcf73

                                                                        SHA1

                                                                        834c5b96f91e9349ae91ed4cd5cc8897f58a3fdb

                                                                        SHA256

                                                                        66397977e36190a9f7ca77e93bfceb8e731838e5ce824bcd22222339b007891d

                                                                        SHA512

                                                                        bf54808fd4ad33d0929868c90fc7b8cf0e9a9ab5c8507d9de676966143b8a9556dadd7ffd7365f3bbc7065ef98b0f75c78267558824df8bea4a358ef52973b77

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                        Filesize

                                                                        649B

                                                                        MD5

                                                                        8a0cb68f6bbea81489ebe3a68035be76

                                                                        SHA1

                                                                        a347c6db92c300f7bdf131343b846503f0d8dd17

                                                                        SHA256

                                                                        5d7f65b3d4c2eb14a29fb17d72ead9c45f828cfb0f65d33ffd5b3f18ab3ca433

                                                                        SHA512

                                                                        86c1ec170153a10a5133271bc0c6e21e4840e4a5ba03107e06826e01e0433c5a16e082de2054defc24f7a5d55a1c64ade8b7241547fc4beb6b01ddc85526815e

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                                        Filesize

                                                                        212KB

                                                                        MD5

                                                                        08ec57068db9971e917b9046f90d0e49

                                                                        SHA1

                                                                        28b80d73a861f88735d89e301fa98f2ae502e94b

                                                                        SHA256

                                                                        7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                                                                        SHA512

                                                                        b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        6c775d4a12ec33acbcdd77fae829666b

                                                                        SHA1

                                                                        efa02fe3f503d7c1dc16ce42d0fbcf54deb2240c

                                                                        SHA256

                                                                        1eef9e3ecb63857243d23abe7239f6ebc7bc23f71382f0fc047f1d6658b9daee

                                                                        SHA512

                                                                        9ffbe1f52403d596e650263016d1595bcd0a6f456a49851c98ce12e06042efb184f79fa6d2f12101b2e73fb4c510988b3b9f7c31a473afb139f4972a3bac76eb

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        216B

                                                                        MD5

                                                                        53b1e2e69d106166b7d0e65beb490511

                                                                        SHA1

                                                                        02b971eaa0166e7dcb430a81781e738ce2442b69

                                                                        SHA256

                                                                        76b20511b0dc20f3dd357e072a4ff0f0f8f1cd2a140067f8520371fc15eb4492

                                                                        SHA512

                                                                        caca2829e138435135835b2c27b210fc19915d21be5c51566314b495a516d16e404cf0bedf3e650425d4d5efefb7d598aadcb4be55b456f9d60a65a68bad72cb

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                        Filesize

                                                                        264KB

                                                                        MD5

                                                                        dac35b8b8cd2f72393bc29999e4bd406

                                                                        SHA1

                                                                        faf3bc89e37fee423bf0ab8df63ff1a9e78810b9

                                                                        SHA256

                                                                        97128eb9785118b532061b14dd28dd743464beb4dae31e67482dd2cc7918e4c3

                                                                        SHA512

                                                                        20335bd2645345bf642eab77b5fd36f4c75b65487b16a013b229d95bb135b6f0a34556c7947b86b26a5c00b8c761d1189ace02b2a3807fd9e68a22dc7a30da14

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        d5e233b2d30f4478e8a3cbd9e0617a0c

                                                                        SHA1

                                                                        5272d2584b8746a7cfa087c502b882a62a7c8877

                                                                        SHA256

                                                                        b386ff7163a110073f50195daa731d272a809b2fdf185fad8801914314623df2

                                                                        SHA512

                                                                        9001b9eae45ae6b921317619f1ad7dd50b2333f009cc7d32e49237e8914fb0562029b7a3468d0411a87aadc03c245ffebcc95d876fe1fb5637eb08925213abc7

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        829b273fb41dc02fdbaf77cbb96f0c2a

                                                                        SHA1

                                                                        c1d2a133e4d20a4c96fc0cac19f8ee188abada8c

                                                                        SHA256

                                                                        cc67c6a57b8c6041e11716feb50b98d4f8f0eb93bbd4e9c578e6dc89f8f3668d

                                                                        SHA512

                                                                        ab73c5266874a937539bd954a3c8722be897bffc9ed77ee67330f49e5340228fc6ef74c5503e912d83587222270df80084dc671008e6792cc8b536c01136cafc

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                        Filesize

                                                                        2B

                                                                        MD5

                                                                        d751713988987e9331980363e24189ce

                                                                        SHA1

                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                        SHA256

                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                        SHA512

                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                        Filesize

                                                                        692B

                                                                        MD5

                                                                        dfb66dc6d70b88cdb5b7ca440facbe74

                                                                        SHA1

                                                                        cf1bf03b2b1573c44ec3f88bbe491bb91594c7b4

                                                                        SHA256

                                                                        89f39f4f9f71084ce80a6010e0d7a1cc0de9a21839cf8db2035c7bb9932b5125

                                                                        SHA512

                                                                        57490f513b6ea35e78fc6069ec994aeda2863d4b1f1fe0814cb1ec0714e280d217c122e4d6a4e7fb82f80254a30d8047dd12ddb4adaf8cd10746d40890f422b7

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        8f0a9cdb381eac60272dae5f4f6e08f6

                                                                        SHA1

                                                                        d3e33e0e511a9ebac3e57a6d852cc3d9620db318

                                                                        SHA256

                                                                        793c30f7358f22e879247cf4f01c98801c8b5a22f4bdc7f6b827a3761a5bdbf7

                                                                        SHA512

                                                                        edffca8da0b7e368b822325d2873b3654aeab5a76a03d1465a33a11af4de1d46929c4f5e035b5a2e6a35478443d4c8749c162e04a083d980a714a01c3b73ddd4

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                        Filesize

                                                                        356B

                                                                        MD5

                                                                        7a07168e94e58fdce93ef293e508dc68

                                                                        SHA1

                                                                        176eb41365eaeb8d0c862bfa51fbe7a757c3fa5b

                                                                        SHA256

                                                                        a9d50b567027bb4706da5c0493ea7bcf6bf1b2cb1c2f9279b635393d576231cd

                                                                        SHA512

                                                                        7179f75861718f5e98b9b83e01b26dc03acba0f53555c1cdb4a7b9b43ffaffe3784296d9196b2f298897f332528e9cb9ceef832dd83c9cc62acd88bc213aac2a

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                        Filesize

                                                                        356B

                                                                        MD5

                                                                        a211ec2028aed819dee7bae688d6c8a1

                                                                        SHA1

                                                                        f45626f956ef2cd0693231bbd8b1fc5b5170d5cd

                                                                        SHA256

                                                                        f74e4b011f2ff59b8a184ad48f3a363dbcbd1f3c023c00ab5420f8336539001c

                                                                        SHA512

                                                                        1614296a7cb32e738fedeca0769f0f1dff4d9d5ba9e010aa3c2480c0c49849c85cac132cbd21ba646d6caad3ec75df2bf113b438dab76d2a064721437c0cade0

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        eef19f651d8e161459cbddea04795326

                                                                        SHA1

                                                                        6e2e2a993f0a528cd7feca67e932825710ef38bd

                                                                        SHA256

                                                                        d3d0fdc03de9feb35e702f6b53b7ff7e72a913a1e9ade67899a92734f829ee9b

                                                                        SHA512

                                                                        e27e988f8308c342d28161b7f5e4a15b4dfcf1b9b4d73891d7f32d98b0780b7170b1d3f28d878cbb6245200bb0f265dbf0a1cb643f7a569a45868e9a6f5e652c

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        3e3081f96c5417a31656b7de31ddcbd1

                                                                        SHA1

                                                                        4790147daba3a555c3998cf411f6515376fa5d9c

                                                                        SHA256

                                                                        c6a15d9f2ee93ba9b051b016fad41164cfeff8e81460e71071cbb43eaeb168b1

                                                                        SHA512

                                                                        d4733f6d39e0baf179e20daf097b322253a5be755672af685490b507da9fcb779ef9c81438ac76629e743862a231de8756c3171aa8a2a602965452f1b52ce2b4

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        7e5794e2c2b8c7edb629b7de47d529c3

                                                                        SHA1

                                                                        8311846f2589a7d69caa99b1448464d5094c2cae

                                                                        SHA256

                                                                        00f54353415035ab4b865da2344b957cd1e011434e788dd14aa552f293cc4495

                                                                        SHA512

                                                                        11040c3b49be5013d6b294f94b9f1c4b7c9c362655e28a621b4764483e0d80977f2359bb02212e31ecd9770bec51f2e056f68a90279626a7c62253c6af8da85a

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        2586389fb13d155d7f844134d6fae3d9

                                                                        SHA1

                                                                        6ecc09846b634bf0d7119936399275c572329aa0

                                                                        SHA256

                                                                        c9d3f96649e4faffa81a264de1b27ad5163d8572bdf0c50a24dd12030c3c17cf

                                                                        SHA512

                                                                        0688fd85a65c370e275e9394cf1186646dd71a881dad1c1356be0a174bf34f4ec6b5b1cc17a420ebe7e63b61c1bfd6861fee998d80b667cd0ba830236ad9a644

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        1f1010ce5df997a4f4e44b30ff9fa5f5

                                                                        SHA1

                                                                        ac638c0cee425678af2235c54ea9abab71e4d512

                                                                        SHA256

                                                                        33a4dcb9f5c3d9eedae98b2c6dec21f6458c204a47d477335e34a31421600064

                                                                        SHA512

                                                                        433862739351b0f555637e66cf9bae73243894f2bfe0ceec1516d678d4d0c570e7fb05d890fbb20ff8fcb5563398f4c24b383c0b870a668e74a4e0007964e9b1

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        1a4a7c5e143283f6a746363ef0b0aca9

                                                                        SHA1

                                                                        adc34459d1b76d0921eab5ed015fdf1be92d77ce

                                                                        SHA256

                                                                        97f917083d263457222252ac7fe7b27618f4e8d0745c418d8ea44f2fa41af67f

                                                                        SHA512

                                                                        d1617090c4139b9534f553009b4335573642b8283c52ce6e3639b6f2eca7e1ddeadbce15e417536a3862a2fc89c0ce4b1ca565a94e1e5608e9b09deed4bf415a

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        616affa66525ae1fcfa4753b4d92c543

                                                                        SHA1

                                                                        6de5e77006bfede2f5e8ce0feedd21ea556720ff

                                                                        SHA256

                                                                        d6680015265c7f95de704f4f96e857c6b18b4d03a992fc7da9c612bd389edec5

                                                                        SHA512

                                                                        eacb56e86cc6fe6be2778549a2b065ec02e4a3ad9a5cdc0683a071c11d8e34634f65dd3e1ceaf0ffad30e903dfd65a479e3242049a565728183dceef77e67706

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        86e81cb986289dcb4a8e0fd65d5ca374

                                                                        SHA1

                                                                        1c4f007c3913ecac7d730a8a312d331cda26a81e

                                                                        SHA256

                                                                        982cab2a357c8f08ee6e9b707ad47fecbb9d0a81c39e6c6c6999233f93b533a3

                                                                        SHA512

                                                                        fb0dcc391b63c2bfde5525bb19b9c36da8fd6e0b836ca04d591772ec49dde7f86d2fd79738d4ffc99d1773eef1c654f561b1f330bf4c7b419cc28a8a9c363c60

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        be9ec09356952f3fb3a565ff86b25e46

                                                                        SHA1

                                                                        b3254cfe8a0d5d0835a63586191ab9af31c56803

                                                                        SHA256

                                                                        068b006d8b8a25427871d2e764db4bf0646856cf0afdf33fab163520e4b19670

                                                                        SHA512

                                                                        1ab98c25c8794ec627e26901d4d7bf69736344115b767932cf4ebfc804d720889d812af81931aee99d091cafa64ce97bcd1ec52c0abf67d99018a1e45ae7395a

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                        Filesize

                                                                        205KB

                                                                        MD5

                                                                        4e48be555ba5f8d5693c70b98f244548

                                                                        SHA1

                                                                        dedadee4395a246a3a274017c75c4ab39a942617

                                                                        SHA256

                                                                        374f5f688d3dfd5d74cab7ed832c61fe391967ca75ec2e14681cb0fb0d9cfc79

                                                                        SHA512

                                                                        e8c8fe165285ff4995802080a98b81592c0f7a7c0325b8667d9787a704e77c3056233ad3dbed0618f45f26ad4f57af1dda6fe9b703f479b6c70374cd24aaa9bb

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                        Filesize

                                                                        205KB

                                                                        MD5

                                                                        4a26aeb44d044d93f1f7651a468b86c4

                                                                        SHA1

                                                                        c0ddc66cb8d210d100996a1ae763c62e6ff033a7

                                                                        SHA256

                                                                        87989f174e4a99a92685dc35c003d41dccdead6dcc49dda8ccbbd2c5ec638f32

                                                                        SHA512

                                                                        909a55c8d444db845ff0fb09596696f1ecbfbc1cda63574fa40776ab8cd39bc15654eadeeab5aa09ce104fa4a68dc862a558538b1e339f967b7f6c008925fa32

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                        Filesize

                                                                        205KB

                                                                        MD5

                                                                        55fb2651f645159c820ea4cedd1bca83

                                                                        SHA1

                                                                        a3f2e487437d31f6727d692b8e4bbc7eebe0e56d

                                                                        SHA256

                                                                        178e82b202c63e46af40bf922b5938e4a21e46fdc2b48f716ad0199773787468

                                                                        SHA512

                                                                        26143fc93f0de9316beacf2903bb46d87f88726c2bb975e651ec19daf1ab06ac1fbd4f7977f84b8cdda95cfb017622f29009ce4d37f9c6e343f76a103fb74eea

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        968cb9309758126772781b83adb8a28f

                                                                        SHA1

                                                                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                        SHA256

                                                                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                        SHA512

                                                                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        e765f3d75e6b0e4a7119c8b14d47d8da

                                                                        SHA1

                                                                        cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                                        SHA256

                                                                        986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                                        SHA512

                                                                        a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        53bc70ecb115bdbabe67620c416fe9b3

                                                                        SHA1

                                                                        af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                                        SHA256

                                                                        b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                                        SHA512

                                                                        cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        27bd31314fa096e19fd3d2707e349a1a

                                                                        SHA1

                                                                        c202e979d4c963af5ded947b1580f67690bf7ba6

                                                                        SHA256

                                                                        777fe50d44af56eebff06b2a31cc50e6f89e1ea90b04280438482158d4980af5

                                                                        SHA512

                                                                        b480c5c5f05254505c7b3388e0c201419a2077c18e3f35d49f159eada54a55dec1bd954431ff089dfd6c1bfbbf8b8f3975ddedad1d1fda8c27adf4efb6b9d240

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        67696616948acadffb819434eb1b55af

                                                                        SHA1

                                                                        d85684604ff04e55e8b507a405286ac82f3401a3

                                                                        SHA256

                                                                        fe17b9c1aad63b6759d150dc5a3dae018296985ec467e261e2672525a2353f01

                                                                        SHA512

                                                                        2a9ce849d13374c3158e30e8d0189d2653e1a05f07018f4665ae9bdc088316cbc6b027e8e4c668445e350f3bc67805559c4721e4836dd95a158e73eb57d55395

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        be97432e1dd76221e12bf15fb100b8b2

                                                                        SHA1

                                                                        3a25d7ba8389d1284b30bd3975fcfd23ea95173d

                                                                        SHA256

                                                                        2f9ae1834b0adfea709528a4ffd6e9fadfe25f0bd38b25efaeed8480ba621821

                                                                        SHA512

                                                                        d93b527fe8cadeedc7e6635820174a8faef6918fc184d2725d5aa73d928fe8d8f244596562fae9e6e3956a6029f36e0c96859556bd13c8eb7b8ce7d84dca682e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                        Filesize

                                                                        18KB

                                                                        MD5

                                                                        ab675c1e5b8e75c065ec4cc9c46e6201

                                                                        SHA1

                                                                        533fb0be43b859d90b7cfda60483d2e618781b76

                                                                        SHA256

                                                                        db4583b65a7f8e63c259585a767291d9f314bd5f3550a47fb745ba90bcaed629

                                                                        SHA512

                                                                        f84f50564efd601a34d147b8f640f79107d42da60e7bb889ae6c26aa99f02e11d7d36bf7bf77037f05e5e63b36f9896ec241ccc7d90122cd82141d716dd75250

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                        Filesize

                                                                        18KB

                                                                        MD5

                                                                        1748e2b59be90c807c57c2ad89362402

                                                                        SHA1

                                                                        80565604e2183b2693ccac7956ae7853dc6ee808

                                                                        SHA256

                                                                        78315199bd3f84c2c15c9ef09bb23728166717fd5aec17bd62883cc38bfc1ef4

                                                                        SHA512

                                                                        93f4a227ddf6e27cea4b0e0115b03eff78ebed01e5e53363239b781d90ec8ead0bd581afb500b8dfb441032d4822513deb29cabdad948f9d4101471679ca346d

                                                                      • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\cd5f771f931eb83fc97c1a25f75dda04

                                                                        Filesize

                                                                        5.9MB

                                                                        MD5

                                                                        cd5f771f931eb83fc97c1a25f75dda04

                                                                        SHA1

                                                                        b31969a060a7e46a05a1e72e25fb17f560994edc

                                                                        SHA256

                                                                        381a97012b0e35eacadf2db921a5934f3b33bdab2957780519f12f9039cd3d59

                                                                        SHA512

                                                                        5120ebb62eb18de91b0bb815f53514b7b1991184b1530e14a9e894366a4eaceb7e501698c53a1fbbc55f8e211e94bf3a565e48fb71cc6452795e47ba62c42a77

                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgcvfpp4.hue.ps1

                                                                        Filesize

                                                                        60B

                                                                        MD5

                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                        SHA1

                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                        SHA256

                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                        SHA512

                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                      • C:\Users\Admin\AppData\Local\Temp\is-1FV5J.tmp\_isetup\_iscrypt.dll

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        a69559718ab506675e907fe49deb71e9

                                                                        SHA1

                                                                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                        SHA256

                                                                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                        SHA512

                                                                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                      • C:\Users\Admin\AppData\Local\Temp\is-B19E9.tmp\soles.tmp

                                                                        Filesize

                                                                        3.1MB

                                                                        MD5

                                                                        92a8f182782b7676afc20be2333e7677

                                                                        SHA1

                                                                        82d7e177cb3e40add5d01b68f5ae13264afb2df8

                                                                        SHA256

                                                                        326db8668e61efa37036e9e7e6934b565e4d4af0454c9c3e6a9799191edabbbc

                                                                        SHA512

                                                                        afedb24077040b81ab761450d4bc1c680862c77291d5c5f9542e5c8cb52d3b0807d3bae02433c3362f88f8bcb5f84dd44d840546f24612e63f35204c2ae69716

                                                                      • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

                                                                        Filesize

                                                                        30.1MB

                                                                        MD5

                                                                        0e4e9aa41d24221b29b19ba96c1a64d0

                                                                        SHA1

                                                                        231ade3d5a586c0eb4441c8dbfe9007dc26b2872

                                                                        SHA256

                                                                        5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

                                                                        SHA512

                                                                        e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

                                                                      • C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe

                                                                        Filesize

                                                                        921KB

                                                                        MD5

                                                                        3f58a517f1f4796225137e7659ad2adb

                                                                        SHA1

                                                                        e264ba0e9987b0ad0812e5dd4dd3075531cfe269

                                                                        SHA256

                                                                        1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

                                                                        SHA512

                                                                        acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

                                                                      • C:\Users\Admin\AppData\Local\nuclear\braise.a3x

                                                                        Filesize

                                                                        60KB

                                                                        MD5

                                                                        8e1a70b54af4c2bcc655f944bb833453

                                                                        SHA1

                                                                        e3364c0bc8bc33dced566816061ce84ca06f0fb4

                                                                        SHA256

                                                                        8e7a44ea4294d797392441f86aa2090041040c83938ff585bec1f8ccb3b20b29

                                                                        SHA512

                                                                        f81c34bfd738d7d7ba04a35db243c24b2c980576a756d174ab916710ed06c3f2c09f1a92866d89a6985fd6c874fbb97091e4ab188452173e1e0ff60a1b2416e4

                                                                      • C:\Users\Admin\AppData\Local\nuclear\braise.adt

                                                                        Filesize

                                                                        476KB

                                                                        MD5

                                                                        10e368548939707ba299e05a5a285f7a

                                                                        SHA1

                                                                        0c190ced4b2746d72bed6240fc4414c4a0b22add

                                                                        SHA256

                                                                        14458c1c57a94145e00116826e6c60e0646a9b62799ecd966b81d957b25dfc90

                                                                        SHA512

                                                                        1cd819c5a83c7965a8998678ab6675673f881df5cfbe7b10b24b0963954d5e85da42e7507e6fdc1d6b68175063ba600a803a56e50e6aca4a949ede4059fdbcb8

                                                                      • C:\Users\Admin\Desktop\DISCORD

                                                                        Filesize

                                                                        103B

                                                                        MD5

                                                                        5aa26de003aeebae624a08de919c52b5

                                                                        SHA1

                                                                        ff1a4dd7673a6b604324e1363738658cc4d565c0

                                                                        SHA256

                                                                        335052f362ac50a1d52e8268ebc4323f59644ef7988cb29ea485d57745667bd2

                                                                        SHA512

                                                                        43220140c68668fd309ce343c06e22910dbe6b74818a9a0f07da052cd8d6020524311c6c00201fc3bceb6f18743ba07ae65e2d4900dd79fab7218bef5caf192c

                                                                      • C:\Users\Admin\Downloads\Unconfirmed 481420.crdownload

                                                                        Filesize

                                                                        5.6MB

                                                                        MD5

                                                                        58de8886e5f8771990ddfc3d09eeec16

                                                                        SHA1

                                                                        daf4387bab065c8a6dbff50a0c9f7beec6f40747

                                                                        SHA256

                                                                        b6a2553a504032002396ffd960725d5514e3aa1e81185620cd03e1481e9b6ce1

                                                                        SHA512

                                                                        e90c661051b2c8298abeae2d6a070a1547912d6cf3bb4892e30a583e5f906b043768934a85c76c45482c3326d93bc1090df3d4616824a7173fd2f061d81a2be3

                                                                      • C:\Users\Public\Desktop\BootstrapperV1.16.exe

                                                                        Filesize

                                                                        796KB

                                                                        MD5

                                                                        76639ab92661f5c384302899934051ab

                                                                        SHA1

                                                                        9b33828f8ad3a686ff02b1a4569b8ae38128caed

                                                                        SHA256

                                                                        6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178

                                                                        SHA512

                                                                        928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee

                                                                      • C:\Users\Public\Desktop\BootstrapperV1.18.exe

                                                                        Filesize

                                                                        971KB

                                                                        MD5

                                                                        2458f330cda521460cc077238ab01b25

                                                                        SHA1

                                                                        13312b4dffbdda09da2f1848cc713bbe781c5543

                                                                        SHA256

                                                                        dc67b264b90e29cf5cffed4453de4567398faa7f3bf18e69e84033c5b33ab05c

                                                                        SHA512

                                                                        8f027ebd96901f5a22aad34191244b1786dfb66843cbe05a8470d930415d85d86430267da09e7f1a69b8011b170d229e7fb25ecf0bf7d9209d7b910b2cbab48b

                                                                      • C:\Windows\Installer\MSI47E4.tmp

                                                                        Filesize

                                                                        122KB

                                                                        MD5

                                                                        9fe9b0ecaea0324ad99036a91db03ebb

                                                                        SHA1

                                                                        144068c64ec06fc08eadfcca0a014a44b95bb908

                                                                        SHA256

                                                                        e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

                                                                        SHA512

                                                                        906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

                                                                      • C:\Windows\Installer\MSI4825.tmp

                                                                        Filesize

                                                                        211KB

                                                                        MD5

                                                                        a3ae5d86ecf38db9427359ea37a5f646

                                                                        SHA1

                                                                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                        SHA256

                                                                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                        SHA512

                                                                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                      • C:\Windows\Installer\MSI5229.tmp

                                                                        Filesize

                                                                        297KB

                                                                        MD5

                                                                        7a86ce1a899262dd3c1df656bff3fb2c

                                                                        SHA1

                                                                        33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

                                                                        SHA256

                                                                        b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

                                                                        SHA512

                                                                        421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

                                                                      • memory/904-113-0x0000000000930000-0x0000000000A02000-memory.dmp

                                                                        Filesize

                                                                        840KB

                                                                      • memory/904-130-0x0000000000930000-0x0000000000A02000-memory.dmp

                                                                        Filesize

                                                                        840KB

                                                                      • memory/2128-128-0x0000000000670000-0x00000000009A2000-memory.dmp

                                                                        Filesize

                                                                        3.2MB

                                                                      • memory/2392-2745-0x0000026BAC6D0000-0x0000026BAC6E2000-memory.dmp

                                                                        Filesize

                                                                        72KB

                                                                      • memory/2392-318-0x0000026B91AA0000-0x0000026B91B9A000-memory.dmp

                                                                        Filesize

                                                                        1000KB

                                                                      • memory/2392-2738-0x0000026BABF80000-0x0000026BABF8A000-memory.dmp

                                                                        Filesize

                                                                        40KB

                                                                      • memory/2564-297-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                        Filesize

                                                                        352KB

                                                                      • memory/2564-296-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                        Filesize

                                                                        352KB

                                                                      • memory/2828-16-0x0000000005E00000-0x0000000006154000-memory.dmp

                                                                        Filesize

                                                                        3.3MB

                                                                      • memory/2828-85-0x00000000079D0000-0x0000000007A66000-memory.dmp

                                                                        Filesize

                                                                        600KB

                                                                      • memory/2828-48-0x00000000064B0000-0x00000000064FC000-memory.dmp

                                                                        Filesize

                                                                        304KB

                                                                      • memory/2828-5-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2828-11-0x0000000005500000-0x0000000005566000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                      • memory/2828-7-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2828-12-0x0000000005570000-0x00000000055D6000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                      • memory/2828-15-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2828-3-0x0000000004E60000-0x0000000004E96000-memory.dmp

                                                                        Filesize

                                                                        216KB

                                                                      • memory/2828-97-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2828-53-0x000000006BA90000-0x000000006BADC000-memory.dmp

                                                                        Filesize

                                                                        304KB

                                                                      • memory/2828-71-0x0000000007410000-0x00000000074B3000-memory.dmp

                                                                        Filesize

                                                                        652KB

                                                                      • memory/2828-10-0x0000000005460000-0x0000000005482000-memory.dmp

                                                                        Filesize

                                                                        136KB

                                                                      • memory/2952-96-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2952-17-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2952-43-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2952-86-0x0000000007CB0000-0x0000000007CC1000-memory.dmp

                                                                        Filesize

                                                                        68KB

                                                                      • memory/2952-88-0x0000000007CF0000-0x0000000007D04000-memory.dmp

                                                                        Filesize

                                                                        80KB

                                                                      • memory/2952-84-0x0000000007B20000-0x0000000007B2A000-memory.dmp

                                                                        Filesize

                                                                        40KB

                                                                      • memory/2952-90-0x0000000007DD0000-0x0000000007DD8000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                      • memory/2952-87-0x0000000007CE0000-0x0000000007CEE000-memory.dmp

                                                                        Filesize

                                                                        56KB

                                                                      • memory/2952-72-0x000000006BA90000-0x000000006BADC000-memory.dmp

                                                                        Filesize

                                                                        304KB

                                                                      • memory/2952-42-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/2952-89-0x0000000007DF0000-0x0000000007E0A000-memory.dmp

                                                                        Filesize

                                                                        104KB

                                                                      • memory/3200-4013-0x00007FF92B1E0000-0x00007FF92B1F0000-memory.dmp

                                                                        Filesize

                                                                        64KB

                                                                      • memory/3200-4014-0x00007FF92B1E0000-0x00007FF92B1F0000-memory.dmp

                                                                        Filesize

                                                                        64KB

                                                                      • memory/3200-4015-0x00007FF92B230000-0x00007FF92B260000-memory.dmp

                                                                        Filesize

                                                                        192KB

                                                                      • memory/3200-4011-0x00007FF92B0D0000-0x00007FF92B0E0000-memory.dmp

                                                                        Filesize

                                                                        64KB

                                                                      • memory/3200-4012-0x00007FF92B0D0000-0x00007FF92B0E0000-memory.dmp

                                                                        Filesize

                                                                        64KB

                                                                      • memory/3452-101-0x00000000745DE000-0x00000000745DF000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3452-1-0x0000000000DC0000-0x0000000000DEA000-memory.dmp

                                                                        Filesize

                                                                        168KB

                                                                      • memory/3452-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3452-300-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/3452-2-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/3452-102-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/3452-9-0x000000000A420000-0x000000000A428000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                      • memory/3452-14-0x000000000AE80000-0x000000000AE8E000-memory.dmp

                                                                        Filesize

                                                                        56KB

                                                                      • memory/3452-13-0x000000000AEA0000-0x000000000AED8000-memory.dmp

                                                                        Filesize

                                                                        224KB

                                                                      • memory/3508-287-0x00000000009C0000-0x0000000000CF2000-memory.dmp

                                                                        Filesize

                                                                        3.2MB

                                                                      • memory/4276-4-0x0000000004D70000-0x0000000005398000-memory.dmp

                                                                        Filesize

                                                                        6.2MB

                                                                      • memory/4276-47-0x0000000005C80000-0x0000000005C9E000-memory.dmp

                                                                        Filesize

                                                                        120KB

                                                                      • memory/4276-6-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/4276-50-0x000000006BA90000-0x000000006BADC000-memory.dmp

                                                                        Filesize

                                                                        304KB

                                                                      • memory/4276-100-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/4276-66-0x0000000006240000-0x000000000625E000-memory.dmp

                                                                        Filesize

                                                                        120KB

                                                                      • memory/4276-8-0x00000000745D0000-0x0000000074D80000-memory.dmp

                                                                        Filesize

                                                                        7.7MB

                                                                      • memory/4276-82-0x0000000007600000-0x0000000007C7A000-memory.dmp

                                                                        Filesize

                                                                        6.5MB

                                                                      • memory/4276-83-0x0000000006FC0000-0x0000000006FDA000-memory.dmp

                                                                        Filesize

                                                                        104KB

                                                                      • memory/4276-49-0x0000000006C30000-0x0000000006C62000-memory.dmp

                                                                        Filesize

                                                                        200KB

                                                                      • memory/4384-305-0x0000015AE1CF0000-0x0000015AE1D12000-memory.dmp

                                                                        Filesize

                                                                        136KB

                                                                      • memory/4384-303-0x0000015ADFEE0000-0x0000015ADFFAE000-memory.dmp

                                                                        Filesize

                                                                        824KB

                                                                      • memory/4400-4006-0x00000000008A0000-0x00000000008D5000-memory.dmp

                                                                        Filesize

                                                                        212KB

                                                                      • memory/4400-3919-0x0000000072F40000-0x0000000073150000-memory.dmp

                                                                        Filesize

                                                                        2.1MB

                                                                      • memory/4400-3948-0x0000000072F40000-0x0000000073150000-memory.dmp

                                                                        Filesize

                                                                        2.1MB

                                                                      • memory/4400-3918-0x00000000008A0000-0x00000000008D5000-memory.dmp

                                                                        Filesize

                                                                        212KB

                                                                      • memory/4400-3926-0x0000000072F40000-0x0000000073150000-memory.dmp

                                                                        Filesize

                                                                        2.1MB

                                                                      • memory/4420-289-0x0000000000930000-0x0000000000A02000-memory.dmp

                                                                        Filesize

                                                                        840KB

                                                                      • memory/4420-127-0x0000000000930000-0x0000000000A02000-memory.dmp

                                                                        Filesize

                                                                        840KB