8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Resubmissions

23-11-2024 07:55

241123-jsfz8axpck 7

23-11-2024 07:41

241123-jjkl2sxnej 8

Analysis

max time kernel
343s
max time network
345s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperV1.23.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	BootstrapperV1.23.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 19 IoCs

pid	Process
2848	Solara.exe
4884	RobloxPlayerInstaller.exe
860	MicrosoftEdgeWebview2Setup.exe
180	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4688	MicrosoftEdgeUpdate.exe
4400	MicrosoftEdgeUpdateComRegisterShell64.exe
4824	MicrosoftEdgeUpdateComRegisterShell64.exe
1920	MicrosoftEdgeUpdateComRegisterShell64.exe
2592	MicrosoftEdgeUpdate.exe
1424	MicrosoftEdgeUpdate.exe
4652	MicrosoftEdgeUpdate.exe
5072	MicrosoftEdgeUpdate.exe
3156	RobloxPlayerInstaller.exe
2776	MicrosoftEdge_X64_131.0.2903.63.exe
4160	setup.exe
4476	setup.exe
2404	MicrosoftEdgeUpdate.exe
4572	RobloxPlayerBeta.exe

Loads dropped DLL 28 IoCs

pid	Process
4284	MsiExec.exe
4284	MsiExec.exe
1012	MsiExec.exe
1012	MsiExec.exe
1012	MsiExec.exe
1012	MsiExec.exe
1012	MsiExec.exe
4548	MsiExec.exe
4548	MsiExec.exe
4548	MsiExec.exe
4284	MsiExec.exe
180	MicrosoftEdgeUpdate.exe
4544	MicrosoftEdgeUpdate.exe
4688	MicrosoftEdgeUpdate.exe
4400	MicrosoftEdgeUpdateComRegisterShell64.exe
4688	MicrosoftEdgeUpdate.exe
4824	MicrosoftEdgeUpdateComRegisterShell64.exe
4688	MicrosoftEdgeUpdate.exe
1920	MicrosoftEdgeUpdateComRegisterShell64.exe
4688	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdgeUpdate.exe
1424	MicrosoftEdgeUpdate.exe
4652	MicrosoftEdgeUpdate.exe
4652	MicrosoftEdgeUpdate.exe
1424	MicrosoftEdgeUpdate.exe
5072	MicrosoftEdgeUpdate.exe
2404	MicrosoftEdgeUpdate.exe
4572	RobloxPlayerBeta.exe

Unexpected DNS network traffic destination 52 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
37	5016	msiexec.exe
39	5016	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
149	pastebin.com
150	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
416	api.ipify.org
418	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4572	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe
4572	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\mip_protection_sdk.dll	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\src\cell.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\content\read.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs.realpath\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-cache.html	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\TerrainTools\icon_shape_cube.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\nl.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\index.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioSharedUI\folder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChatV2\actions_checkbox.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\api-ms-win-crt-math-l1-1-0.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\es-419.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\override-resolves.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\TopBar\chatOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\graphic\gr-bloom-circle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\passthrough.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnimationEditor\FaceCaptureUI\StopRecordButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\hi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\readdir-scoped.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\dist\abort-controller.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\cache.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\TerrainTools\mtrl_crackedlava.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Emotes\Small\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\InspectMenu\ico_isnt-wearing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\SpeakerDark\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\buffer\AUTHORS.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\test.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\ours\util.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\RoundedRect8px.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\icons\ic-leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\fonts\Montserrat-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\fetch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\eclipse.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\client\rekor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\gbk-added.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\R15Migrator\Icon_Checkmark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Trust Protection Lists\Mu\Analytics	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\README	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\stream.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\pack.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\clean-url.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\internal.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-login.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-explain.1	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI103B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI482B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4337.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI107B.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fb86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fb86.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF32.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI459A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fb8a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI189A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI428A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2592	MicrosoftEdgeUpdate.exe
5072	MicrosoftEdgeUpdate.exe
2404	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3876	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768213528663013"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2176	BootstrapperV1.23.exe
2176	BootstrapperV1.23.exe
1624	chrome.exe
1624	chrome.exe
5016	msiexec.exe
5016	msiexec.exe
2848	Solara.exe
2848	Solara.exe
4884	RobloxPlayerInstaller.exe
4884	RobloxPlayerInstaller.exe
180	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
1920	chrome.exe
180	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
4572	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2468	WMIC.exe
Token: SeSecurityPrivilege	2468	WMIC.exe
Token: SeTakeOwnershipPrivilege	2468	WMIC.exe
Token: SeLoadDriverPrivilege	2468	WMIC.exe
Token: SeSystemProfilePrivilege	2468	WMIC.exe
Token: SeSystemtimePrivilege	2468	WMIC.exe
Token: SeProfSingleProcessPrivilege	2468	WMIC.exe
Token: SeIncBasePriorityPrivilege	2468	WMIC.exe
Token: SeCreatePagefilePrivilege	2468	WMIC.exe
Token: SeBackupPrivilege	2468	WMIC.exe
Token: SeRestorePrivilege	2468	WMIC.exe
Token: SeShutdownPrivilege	2468	WMIC.exe
Token: SeDebugPrivilege	2468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2468	WMIC.exe
Token: SeRemoteShutdownPrivilege	2468	WMIC.exe
Token: SeUndockPrivilege	2468	WMIC.exe
Token: SeManageVolumePrivilege	2468	WMIC.exe
Token: 33	2468	WMIC.exe
Token: 34	2468	WMIC.exe
Token: 35	2468	WMIC.exe
Token: 36	2468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2468	WMIC.exe
Token: SeSecurityPrivilege	2468	WMIC.exe
Token: SeTakeOwnershipPrivilege	2468	WMIC.exe
Token: SeLoadDriverPrivilege	2468	WMIC.exe
Token: SeSystemProfilePrivilege	2468	WMIC.exe
Token: SeSystemtimePrivilege	2468	WMIC.exe
Token: SeProfSingleProcessPrivilege	2468	WMIC.exe
Token: SeIncBasePriorityPrivilege	2468	WMIC.exe
Token: SeCreatePagefilePrivilege	2468	WMIC.exe
Token: SeBackupPrivilege	2468	WMIC.exe
Token: SeRestorePrivilege	2468	WMIC.exe
Token: SeShutdownPrivilege	2468	WMIC.exe
Token: SeDebugPrivilege	2468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2468	WMIC.exe
Token: SeRemoteShutdownPrivilege	2468	WMIC.exe
Token: SeUndockPrivilege	2468	WMIC.exe
Token: SeManageVolumePrivilege	2468	WMIC.exe
Token: 33	2468	WMIC.exe
Token: 34	2468	WMIC.exe
Token: 35	2468	WMIC.exe
Token: 36	2468	WMIC.exe
Token: SeDebugPrivilege	2176	BootstrapperV1.23.exe
Token: SeShutdownPrivilege	952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	952	msiexec.exe
Token: SeLockMemoryPrivilege	952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	952	msiexec.exe
Token: SeMachineAccountPrivilege	952	msiexec.exe
Token: SeTcbPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeLoadDriverPrivilege	952	msiexec.exe
Token: SeSystemProfilePrivilege	952	msiexec.exe
Token: SeSystemtimePrivilege	952	msiexec.exe
Token: SeProfSingleProcessPrivilege	952	msiexec.exe
Token: SeIncBasePriorityPrivilege	952	msiexec.exe
Token: SeCreatePagefilePrivilege	952	msiexec.exe
Token: SeCreatePermanentPrivilege	952	msiexec.exe
Token: SeBackupPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeShutdownPrivilege	952	msiexec.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4572	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 5088	2176	BootstrapperV1.23.exe	83
PID 2176 wrote to memory of 5088	2176	BootstrapperV1.23.exe	83
PID 5088 wrote to memory of 3876	5088	cmd.exe	85
PID 5088 wrote to memory of 3876	5088	cmd.exe	85
PID 2176 wrote to memory of 4328	2176	BootstrapperV1.23.exe	92
PID 2176 wrote to memory of 4328	2176	BootstrapperV1.23.exe	92
PID 4328 wrote to memory of 2468	4328	cmd.exe	94
PID 4328 wrote to memory of 2468	4328	cmd.exe	94
PID 2176 wrote to memory of 952	2176	BootstrapperV1.23.exe	97
PID 2176 wrote to memory of 952	2176	BootstrapperV1.23.exe	97
PID 5016 wrote to memory of 4284	5016	msiexec.exe	100
PID 5016 wrote to memory of 4284	5016	msiexec.exe	100
PID 5016 wrote to memory of 1012	5016	msiexec.exe	101
PID 5016 wrote to memory of 1012	5016	msiexec.exe	101
PID 5016 wrote to memory of 1012	5016	msiexec.exe	101
PID 1624 wrote to memory of 3188	1624	chrome.exe	103
PID 1624 wrote to memory of 3188	1624	chrome.exe	103
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 2424	1624	chrome.exe	104
PID 1624 wrote to memory of 3648	1624	chrome.exe	105
PID 1624 wrote to memory of 3648	1624	chrome.exe	105
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106
PID 1624 wrote to memory of 4840	1624	chrome.exe	106

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0F51146285F30D49123F67D504D0392D
  2⤵
  - Loads dropped DLL
  PID:4284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E681AE2424A3256F688356898630B79F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC9C6B875E13515B0D05251CA1C79001 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4548
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:528
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd30facc40,0x7ffd30facc4c,0x7ffd30facc58
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1728,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4492,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3852,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4880,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5272,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4608,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5180,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=860 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5648,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5636,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5556,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:2924
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:860
  - - C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:180
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4688
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4400
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4824
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1920
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzNGRkJDQzAtRTkyRi00RDc1LThCQjUtQzhGNEUyREMzQURFfSIgdXNlcmlkPSJ7MUEwNjQ5OEEtMjY3RC00NDlBLUFERjItNUUzNzRFN0VBRjZGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QTY5RjVFQi02MDJBLTRFREItQjNBQS01MkU1OUNBMjlGQ0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTQxNjA1NTc0IiBpbnN0YWxsX3RpbWVfbXM9IjUyOCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2592
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{73FFBCC0-E92F-4D75-8BB5-C8F4E2DC3ADE}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1424
- - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4884
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3452,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5548,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5920,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=860,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1128,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5164,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5952,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5532,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4592,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6004,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6092,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3280,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5352,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6508,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6236,i,9945593828695677116,6649923805795796498,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4956

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4652
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzNGRkJDQzAtRTkyRi00RDc1LThCQjUtQzhGNEUyREMzQURFfSIgdXNlcmlkPSJ7MUEwNjQ5OEEtMjY3RC00NDlBLUFERjItNUUzNzRFN0VBRjZGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszMTE2NTlFNy0xRjA2LTRFNDAtODMxMC03NTExMkY2MDE2MjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNDc3NDUzODIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\MicrosoftEdge_X64_131.0.2903.63.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\MicrosoftEdge_X64_131.0.2903.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\EDGEMITMP_25E10.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\EDGEMITMP_25E10.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\MicrosoftEdge_X64_131.0.2903.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4160
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\EDGEMITMP_25E10.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\EDGEMITMP_25E10.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E5D90E66-C3AD-4BFA-A436-A1366D81C920}\EDGEMITMP_25E10.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.63 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7e4f62918,0x7ff7e4f62924,0x7ff7e4f62930
      4⤵
      Executes dropped EXE
      PID:4476
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzNGRkJDQzAtRTkyRi00RDc1LThCQjUtQzhGNEUyREMzQURFfSIgdXNlcmlkPSJ7MUEwNjQ5OEEtMjY3RC00NDlBLUFERjItNUUzNzRFN0VBRjZGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswMzA0MkFDQS0xMEQyLTRDNzktOTVEMS04QUNFRUY0QkUxMUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy42MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE2Mzg5MDA5NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNjQwNDU0NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDQzMDE1NDM3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9jYjIzYTlhMS04OGU3LTQxYWUtOTUxMC1kYjkzODg0M2JlNzM_UDE9MTczMjk1MjY2MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1IOW8zend6WDdhQ0VyRWJoMlZ0ZlByaFpjSTllTWJtTWMlMmIxT1JHUmFveDdLJTJmJTJid1Mzd0VoOTVZSDdaZUEwMWcyS1YlMmZDb2QxRVlzM0R1b3JlT0dOZzJRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NTc4MTQ0IiB0b3RhbD0iMTc2NTc4MTQ0IiBkb3dubG9hZF90aW1lX21zPSIyMTM2NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NDMxNDUzODEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDU4Mzc1NTU1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MDgwMTI1NTAxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTEzOSIgZG93bmxvYWRfdGltZV9tcz0iMjc5MDAiIGRvd25sb2FkZWQ9IjE3NjU3ODE0NCIgdG90YWw9IjE3NjU3ODE0NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjIxNjMiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1560

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fb89.rbs

Filesize
1.0MB

MD5
7fbd477ba15ea2dc451642bd809f7cda

SHA1
ee80db57591c53178e7f308ec33f4f076d0b86df

SHA256
44227bc04af628eae485feb9c628959c301644d46cc29c4619a22fe513fb8ada

SHA512
94e22e612efe99618c5a250ed391e2103c64d64ddd679101d2a5f18f75a576f5019504fd7bf8b4f158d4805d57c31e6acc55e02ab87b3ae9624b3f585a4880f8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Installer\setup.exe

Filesize
6.6MB

MD5
ce03c15ce3be6b0cb6f6300e3e49aebe

SHA1
cc0710461ca0b8c67edbaec47676af8d729ccec1

SHA256
ceaabd1ad8ac7bab2fb440acc35857134cf6176e74159710b0e8c2c8b376cf52

SHA512
4f125ff16c2fe7a4e6c7b1cb9e1be15162091bdea54d4c6ef554047400a9fa61340564218af8255a8aece0dd93c00fed7c40690f58622ce9034307acaba5f4f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUAC63.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.8MB

MD5
ee40308e2ffbc9001db2324ff6420492

SHA1
47cabfe872311f65534cbd4b87d707ccdef559d1

SHA256
38cd32dedb5c8c2af8ecd56827af5b4477a4b9ca3e518199d389a261baa999a5

SHA512
5f5fd0db005d49d63eaa81b288d2d6d40ce9c84cafd1c75d33723e47f23341d5ff254c2ed6274790242ad53f5360467d121cf1196ec7a073d4506166248041c3

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
e05a98d2042f73b3f5de09e493bf17bd

SHA1
ded6ea589aefac701eb47efd7fea5196cc81df0f

SHA256
0c8aea13a693c9997af592be6bdf061d761ae64fc089bb0822d73693246754db

SHA512
dbe2ac7a9a4058d60a7c28f340f62d799c05840ae3740ec190c93ef83d2a2fbb493f4c2b8d07ef8ef379af5854b490b46990ca9f05b93f5c3ffd937b0f5f0cb0

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
91KB

MD5
61baf5a12dd64155feb14c77e8740e1e

SHA1
37d683747e69409112a169979663dd36da7712a8

SHA256
2696a02fe373e44fe65f2ed091a7451ab3addfba3c8fa956b45268af1b4788cb

SHA512
5058d252d123f4a427daecc4098dda3ec53bb83921c0488857fa6355776ddc999c224da54d06c5887b5ebed3b9f0580668e121fd2bb5fa35036766268913b2df

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\197a9f25-1324-47e5-91f6-aa7ee1f2fee5.tmp

Filesize
9KB

MD5
7a809924ec887dd5cd5950bf5208e77d

SHA1
69c679199f79512a429a31ffa1e1474e880cc32f

SHA256
ae4f67957f070365566ee25796067584f0514f96dceca887e942b46bbf30ccfa

SHA512
9272f2961719bd16dc2f5d0999b4e863aac5213c11a8ae6884736e4f6eb71b720fad11c11f60953f2a3d220fbf8b94db530f96c6517bdd887da7f560108444c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ef6e5f56bcb9eb0cb9d6cfdc600aa5d3

SHA1
a723402d993cd81117116c5590609443fb957694

SHA256
744e99787d1c86e0b45311018dbdce61976e751da24ecc12e3e444cf3d36c6c3

SHA512
f7a345051b1df125496730ac10cde260bdd836df8b7aaa79530b5ff6c6aeb9b69f89f1522aac856bdd2d671b6cedbd90843a8036e4f18b4b796d6997e2f4602b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c6

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dc

Filesize
860KB

MD5
f46408e0572c51d4e189bd50af536db3

SHA1
235743eba8fe51da83aef5197e482e6f9381b2b3

SHA256
4dfa913e55425496c9b8eefe772318c78e2a1b54769fcab01d722d7cadc3c038

SHA512
b535237e1f19afdb2e0e45c4b0d074bd11d016f88ae9466dbeb194d779e5e1d2976b109bbdee9be40c7ca5bbec2c3878187996b1db825ee082e65cf72eb5eb9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dd

Filesize
24KB

MD5
2c92288016ce3a327c2230ee1dc04ba2

SHA1
8cd9f721e5a0f19059854030773f76bbafa0036c

SHA256
3b7b2d0aac6717a3735156eee99212f28528d0dd86d7ba3f6e527535d1f6d398

SHA512
e60e33852a8af310cc8be770afc64a10c63b1711292770d4c7024842e534953de358567da3264e20c393199b1df43e1a98723a1f8bd657dea9a55a6cacb2f0ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000df

Filesize
16KB

MD5
61e4576e6aa91cd435fe92f085fb0a3c

SHA1
fa21a6bad3a461c8f0e27b75913c8f1cbe0b2b62

SHA256
78d8aca4e50e6ba58890b68f8c3d6e562ff0b16516a0c3df56be18b69dca6aa9

SHA512
b250c2940f7ca24b763bfcd4d39d0022d6441bad54c415b9848ef949f8871f219289f044301de03313bf8cfa53bb2797c5590acc1b32889b0641f7a13b710bfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e3

Filesize
52KB

MD5
6d33e31031afd897cebfa4d86868c281

SHA1
37b93dc4e20da51e42224ef62129a51337cae10d

SHA256
4616db2c27a3958c7518831e2c6ccfac383d90808e8f8327de44e737179017ab

SHA512
e8b6496a27dc91155dc6292d79baf746858e8790e3bb59a1116aed2418280b22ce303887e32615adbf66ec0d5f072a18d323c959184766534e69deb6c33fd266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e4

Filesize
36KB

MD5
4e8bfd732a4575d2ea03a28f5b3d8924

SHA1
016d7c55abde2c688e8a531d65ac7be27fbc1e83

SHA256
c34efcef3bea091285970ef6974aeae79f191f07581c1065c39a4af25b35f0a9

SHA512
1ae047f7cfde48836b2bcddd6d85076d6d6b0c37c07e2d735477825ab804dded562235176233b684ae564d14afc917279ed02e3ecc9246db3cab99d8a5ce8435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e5

Filesize
77KB

MD5
2e9dbafcaf5a07454923305e1bf04b74

SHA1
0882752f86c810b74a15970eaa877d13f4632a14

SHA256
4a2eeaf0627cf5004719d01ee37535072c1aa9fd551c7c4479550e44aca70f86

SHA512
bb8be2658e896e9863c1c011418ed0ab1ae6a0e74036add7530fbe86432744867495123890c35742fe982139480c802800fb4ee1c301b8f6d2542c648da373f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e9

Filesize
104KB

MD5
5a821e300dde890b40c670185db96d55

SHA1
cce60545558c8f5b5aa47ad90f04e57efcc56838

SHA256
aa869d403596924868fad574b7b67809ffa1f08fbcb30c7c5303d1334ad95cb4

SHA512
ae1dc4f6177cf513e3aaab4852af689d1a6c547aa2de2ca46abc0b78ffedc30f8c775c20920eb698166352b2f840169b667bb9c05b6b67333ee97033dc3ce615

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ea

Filesize
39KB

MD5
b7f65437aba9d4074b6265a29185fd46

SHA1
e250c9de636322d339a4d9beb2ea982abdb53271

SHA256
3fdb6bb134fb6c9c19e93b2a8b7b19c94ad2cf60b9ab47d27266daf122918983

SHA512
c7fadf909d859181b9b3e23c99230fe569babbf1dc8a515e93a1021f8082c1ddca2754d59af2abcda8890e645d16a015fa926a5f49a76c322aa59c8f7514bebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000eb

Filesize
144KB

MD5
b2a1268cd6b5b4ae8afd6bdf6a7b0a8c

SHA1
887706b220ea11b3a07776a93dba21fc80d7edcb

SHA256
b65d6053a12b8e7c5b741c46d5a3e6fea452ddfa19cc3aeda3715d5450bdc67a

SHA512
4ee3ad78e9a184474f241a2ae5b31158574b356cfb6f862375497b0cd717bc81942aaa0f28fd45db9e161ad3f6a166cc61a9c1f51c95fbd52b5ef2167f36a389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ec

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ed

Filesize
20KB

MD5
01544cec8ea1384b58d63e4c1955b9ea

SHA1
bda9a87449eee2fd053b56a7844e00b1460eea52

SHA256
f4d9c14f01e2caa05f3aee0e1c6b4bd282584365271ae8d484bb9c074e6b039a

SHA512
f45d85a0230e51b1942ffc2e133512b622ce0b07e4687e1227a3fb4feff3d269a75d7253add58b158eb03b88972117a38ed38db5bd225d2dab39255e004c713b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000103

Filesize
29KB

MD5
d9e7fec1daaed28de513e1b9b9d420c4

SHA1
2b3b731502ea58fd59d6b303f7cd457bcc1ea6bd

SHA256
c78d258c43609fd6d550370f434f11c33705fb8729c0a36d0b844adbf8b904fa

SHA512
120e6966fe8baffb816052a2d32eb0f25df0ae18c4f3997ee87ae8c54e74a6fcb71202fef803fddb393794e8cd28c8515932b86ec1edd6e9fa90058008d92ab6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
da8d10dffb7b3089038165516655ea85

SHA1
72dd2a580ef26eeece1bd9a9bac62630e43a058c

SHA256
e4e8f9a8d56f608cf7171d37331c248ef7e4c9e0481df45a035b930f22b38241

SHA512
fd6563ed1ace51aceb0978921c84189e9aff23d6edff12b561580a0fdff6b86917e221af70673ef13ec1ff17e26ef2cc0b0a9b54971a2771e1339dbfd5622db3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
17741256ac80005e596fbf4ed7eb0bc9

SHA1
4d10cafc19e397a9befdb6785149a43873a75d89

SHA256
309ba1ed5197a7c5d0c0d6e8be62be4de538a47e07f11197d064dffa21a63634

SHA512
3a3e1ab19ee407453afe62ae9e30a6a41c1edf4ae7aa553b48e12961ce88ca99a0b831b36ac5997a52933b6cfa4e8f24f4924a85024f19603ef0b9dd272bd864

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
abc21531a0146dbeac7e67c7683fe6f7

SHA1
0a2d58dd778b59951d536be4dcbf95efd4f411ff

SHA256
09b759e19b69e35159275fb3b0aff1b54c34dc1a573a6bec608d3d0ed24840fa

SHA512
08276781cd228fa4c900566ad102136a58f37bc39e8613996d0e325003aa9b067f3949a28dd6b61c06573f0e24bec5716eeb04741fe575209cbaf6960673c768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c8d7634babe4c68ed634b88c729a52d0

SHA1
e823edc458f9843e12d7a35b570d6b28f98160ae

SHA256
87365f0ec169b20da8416a7c78329ad9dd8116a54b164f72b5d135227951fc1b

SHA512
e2efd14cbad62af6909506bf3088d35b9c1e03786e3380a5b6fd9d87734dec29f02bbc5222c86adb82b73b677a76dbde8dd1ee6d76b34c715ff4f0205b9f74f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cd22c5c04fbd98727cc2795794434dd3

SHA1
a465afb4f59e0fa6f8a024c3d32713eac9041a23

SHA256
79d2b9135cb5915ff456ba9bb9c5532367ecd22f6db6ec1006a899451c35fc08

SHA512
a7d202227077c7c2aaba6ba41b466d8f7331d34f0e14d7c3de75b925f5b738feaa3a96647554f0e481b7bd0db76f5385c2badf00376bd7cfd47addceb383b588

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
79b983243e827b069e030a4417c111e1

SHA1
b51ac175243c9af512e32e88e174a74f07b2fce7

SHA256
73285706b4d392b7d59e5f62d299c054da3ec6dbf436a48248946b7993b670ca

SHA512
7d7806f3740bf80bef27c50c8507c2f933e7a013111e48e4e2b44a6380909f5da2ea5f718c6ab7d22daf53ed99d382a37b997145e77419f3f50530b28c798114

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
390B

MD5
4a2a3b77a6a28c4d15063674d20e97f2

SHA1
f639d03e286ddb35adf5d3a76b4254e460d49885

SHA256
a6939525a176f242a4849f0c8a9f923cb526a4157e637212d77a72012627d19e

SHA512
f0bd4045013692d119103dd45c07431f9ee3ce4f7be63caed9e8e94b484bb3b964ba12f94ab15a1f5927abbc828a0957928a39b63e8d3d2c6a7fd6e50d056d49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58ff89.TMP

Filesize
513B

MD5
7ebbf09530a4423b71eac85d81c8b54a

SHA1
b8d372163818b74f3adeed0bda701018aabd67f0

SHA256
b5189ca07daf42dcece4753c367497b45fabc53ff76d0f9388daa176b80e244b

SHA512
d4c23e4a38185a886cd0d13bb4bef20a5072dcee233f60dd24419c8cf91fd175115787ec58f1544e4a8df2dbc82cb02bfbadcdff2448411cadd45e4787204589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
c077e3184276fbd7512379cbab521c45

SHA1
fb0824e234ce59e6c60d40d5a27b888dd6d2ba82

SHA256
8c2cf1df65b384fb8b399cd9881a8db9c294acf739a88f2d0a5f0bed9fcd3f1c

SHA512
a6c735c2aff4d7ec1a0898d33c5fcabe9ea2a5c21586f5c7d652d26374c42072a85be0ed59ae0de7759b38030328f3cf254e603aa54fb877f90a3181bc5ff0fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
e963c407eadf27674dd0852d9783a760

SHA1
d405d830704b76308b9bc3c1719bb2c837435698

SHA256
d30674de3075c64a077045288fbeb0d47fe1d947c59a1b6ecd5245dc0be50bbd

SHA512
65361996798fa3f7ab9d61b13afe8490a482550309b48a64838cdbcbab7013ff281fd15e02a9263357e4013410920dda09fca7b07ff762e38893fe5e697952d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
c269172c608e05fd7a9dd8e265ba2197

SHA1
2170d846031af69c1984c721406fca24fceb0246

SHA256
21f05a5671b5037b0c41993578bb9d96e26e72fbd84816903a0b03f32e649721

SHA512
969020db95a7090ab3cfc2e7e80f6c78fbc4bacf002d844d6d7c6283ef10e02f6fa86cf0d1c9974bafb4e4425ca0ca1dae2b51c69a5ee89f8f11a12dd054754e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
0c64254570c2efe32d294139d004e2c6

SHA1
e3dcb0816328f6b2b36279af0772fa83934ca976

SHA256
c8397f43c1097dd75e02f0d075e85a495b5fc2a691e083c04dbe85dfb746a5a5

SHA512
4e1096e341675ce945492908209d3c288e1d8901a46666718d567c8f79a1f0e63302423bdd0d9f31b7fa3da8e46ad529dba385634a44dcf097c7ba71b54b5bc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2962240c1e377774a217421ad7e171e6

SHA1
2a313a8ac3a49df9e9524ea25e9c8a11a1009393

SHA256
ae2f50a1c3ff5ce463aef28c47a0bdc302f5c7ccd50f595b978ce9f0f73ed059

SHA512
a01efeda15b5d5e48d7f44a3484567e9db80385489a8aba58e610e3ebb058ae41dd0da8b7eb4ba16774817f45fd388997cbc124532ceb615ea1ceb15df50f2b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
69877a36723795214508caf3af988216

SHA1
e7b0612054e8433058a0741d27cf5e1470bb61e3

SHA256
1baea5704abe2980a62d69b67c9fea89c012368fa5e9b27e845059cf8a407452

SHA512
5a156149b30167ab08d4a5111fe750ee801d5c1c11fcc0a6efea6c59eb8bbf9b75d6ea248359076b642ddaa95abb634aafe5fbb317f79eafd9d19d8c99e26c60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a0c151ef3692d565dc39759241283df4

SHA1
e0a1fd1f1e02ff8e33b360ccfd51dd41d6a7147e

SHA256
7cd722a1883a4a081346deb61fffae6f1f00b750b1419ae4aac2c155d39472a2

SHA512
45f726ee398e9a19f7808736fd0a8f429c428cb5ecf1ec2bc3374f47630625d4e4fec70f8f95c6deee7aa14b31a2e8da0323458c4c18342557676bc7a5411c2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
12530f87fc33c0de7a8640e8c531b24c

SHA1
b6c0859ff21bd1c24d038b5cb05aa33cbab240a4

SHA256
aa8fa7a731ad68121aeb350779713844f6a9b329d92e956be79bd555250dbf51

SHA512
baca4717463725e0a610c0e0e869c361c4055b02e318daf1e50c2cfe3882e80de1bbf3349d5fcfce96c20eb70ab2059a8c102d20b39ae7db7ea908b688fb6d67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
553b0055b3386cafe4eb56a425477f44

SHA1
b5e68fa2f8006d3907dddc590e350c003ce98b45

SHA256
3d3be7adc8b4a98cb8290125021768dea6c637df8735e7dfbb13bea5d3013890

SHA512
9af0772ab725cc258c11634f67087bb6fb72c3c5624b22e71319999697248fcfe67181153cc311eb0f1625fcdd4cc213986342e77a531010a6ce5e9f8482804f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
2435c5a074fc480627971042d872251c

SHA1
54b5f92b9b7b55c3489a67734e27db6cc456afe3

SHA256
09db0d28fc6bcafe7d098f8ecdf4af1c92831206fc971b73de575f83616f4728

SHA512
aad4e7595b940f56631510a35d7f1b1414c21189542576fd1f1ffa209de5fa88ba561975529fedf2df023c69b4f4d84a1871b08cd78ba41bda0a7eb01e3ffdbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
2dd588472ea1b80867974c85f640f1a4

SHA1
0f72b692de5a4982552d5f9ea8bfe09d2831bf4c

SHA256
625e4116b703a869bbcc20ffa6e3ad985f4c4967616b3f9be3dabcac1c024d0e

SHA512
fd435f2c2ad72fdb17b311a2ebf58d76472a94b3389a2099a49809c707a8416b32ef97f3bfefd4758254830b9adeb6652bc191fb1ed2b524bcee573d4b50ce9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
abad30b01c823d4c5b136e55cdac1493

SHA1
45443313ad9e16689d0e0471cf14d6d8baa05bc0

SHA256
2fc91b95ffe71193c5ebbc8db177233b9ff9e4838eff963215a64946aa2dd2a4

SHA512
58e7e7f434948bbd1fd3d6129caaa3763ba8f37723170e2db5123b9d1d8f406837c73829008de74869231afd7820469dcbf6c780571af0755cb2f3fa5ace8723

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c3ba775cef38b0428a93d1890f6685e4

SHA1
36933897fd337934779f1a55d83bc12e17b0573c

SHA256
dd59fb3e13f831ccdc0bb26369254074bb0bb5916e7702f2fdb6075f5353a775

SHA512
48bdde847567abb025f23ce3c6c2a6e895bef7bb4a070e6c1e4c23d178365cd1c99cccaa93caa3ffaa2fc1e207615a75c8478b2a6334094d62a58ee316062fea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a6de556692e029589c5393713f318e10

SHA1
0dd6c0cfa1980700df245c59ec634d207489c6b3

SHA256
f0e6b108ca2a24e72089d1e27d1f00cde67fdcf269038d73fd12823fd22988eb

SHA512
a8b4c86878c44968fef841235ca05ba4199d583d3ba27cfeb5040c113a8d059fcf456a90bbdde7d307cbde02abb4cf98ebc13043938ff4b4a7a8ff1e864f7183

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
e24dab33f0e1f29e8f61e6bd1a388f2d

SHA1
d2d95320ef79eeb90eec0952018852f08b2ccccd

SHA256
0efd4620f1c713405eeccaea85e792f420a44b416a7e14cebb1c523969d3f733

SHA512
1b5d5f91aef8dc87a9edbd48259484c5222ccd0e32a01bd8f8f727dac988977d11e44125e219f8034b0fbf4329502e6d0715560a62914f624de1e553cc26e2e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
baa52928d727dd81b094828c184290aa

SHA1
2d1f7d456fd1b7021626546f526d0c18339c4698

SHA256
c5b5c7529adf5bdb7f300b2d45f5680729683070d7d4706702e1b23b35049bce

SHA512
c4dde7b2fb4d80645e1dc49e55fefc81b439b1a9bb19943e3d7f4b811168de61035c03dd01564f7671d73868706c921252b8188c39d90d01a18718a704e7cfe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
67b0050094af97b99087afaad323a30d

SHA1
dd3be611b08b4059e5268966340c64af64133dc6

SHA256
9dbcbaa5ab0070e31b6f8af76caccbca18aeaaa0a53afd8756c836b2b41eda6e

SHA512
91db27ac64fd978975f95ccac22a3f04f6b40a1027f13b8becca4f734884dfaf6faa02db4b9913c6cb91f8a44b6a83feda8e2603d9c6c3e33ffef94aa98dc963

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3ba07236f0e75a1db4df3d49514f8dcc

SHA1
3057046077b539c94be26fb51fd5263e46c19408

SHA256
cb7a606bd409117eaa051a791a1e3cf81f6d3a8e59217595e3d9cfc695cb153e

SHA512
1a9a44370fcc749097477c64f7e0bb8c63c9a59448633ced40261d367aeb9c2d719cef0d5725b3a1b7322d0880f7a471d9991526ced4ee4d70576125ef049941

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3549450a7ae36dc447f52810287e03f3

SHA1
631633a44f881bff14d29ce315b9ce558f38ceb5

SHA256
77573b4d40e7b3a60d571f5b7989a1b63e9da1b5319c81187bd913d91800f628

SHA512
3d4b4ef0421116a88c9cf4d1bc15c880371861e9d788c4b99db83d0e900def47daf3bd5c3feb54889dd377660dec465bdca1c51b54e481e31d439d80138f4a0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
63e741b7e6f4f91e6866517f54bf467e

SHA1
805a353193b4e1734c9f728956d7098556261b94

SHA256
cbbf605c947402c939d9bed3217bb0774e4e8735f30b3a569d6682d8eff2c54f

SHA512
629d8f996b1e0af5838698356ac31199bafe009d77830cdda3f140511ff5082a5d9312ce93b231a45a8725fdac96e24bf4485138b6deb508482cda4ecd99147e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3ef081bf89ec05774c1820ba683d6adc

SHA1
b0e9802fba3cf3c3d009a4f07e35b8a1078f3117

SHA256
cde7f34dd76c833c24612290d0d1c2dd49081fa0b7c4a59a134dffc07a50f721

SHA512
5c4dc61a769652b9273e3c27ec541571ef22f92bc400a4dfaa7c96709005689ec6e9db81641cb5bbdc517a94bcaa7b52fe36b67637c3c8248a1854be613e5dab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
ef3e7a59d4b511a3be5b181ddb53ddac

SHA1
c6136319aad13e77001f464b88add8c99c745870

SHA256
012aac896bbe99489419252ae6f1bbdc853e41f8756101e81576eec16be1ade5

SHA512
567eddbfa4342352437c5a829681103ef139f9ec9bb8a10155ed6b590891869df18ee4e1194876692d578206410e38fde6b73ed7dd616b80b65a2b2c9e1e0df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
14a64296b60cc8c5a1135c7b63a5f2d8

SHA1
678df826a4f90b73f0995f0a7f6f5909f0540b3b

SHA256
b21037a1a5ce18f60eaf180eb851489679da73ba62e2c283f4d3fe635b579f3e

SHA512
762134126b3796b77fb7d48b652867cf87a4c89721e8ea4976e2bb54ecd8c59dfc76899fa43528f7c90894ed7d8994543762bdd53a29b6f6e7f487f5ec4ad8b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
046b59665e19870d76b6cb5f205a6204

SHA1
6d4ef73aa57375a05e440f845db61d9e0c1d74c5

SHA256
7cb8e524c60de615cd8abc728ca8695d24b404024ca26db6cf9244624c6efe48

SHA512
ba09c686e0e00f7bd53dcd74d89df45863ca57dab61cb30820c42dbdf6a119d9c51beffe32ea82984d82076b639b407472a3759d5b7fc74295cc9725747a13dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0b66a979b50b1d0ce72ed41d80bf0e3c

SHA1
45eaf21f759d59d1ac2d949d635b0d98b97b63c7

SHA256
04f1ac70d18c9fe24d727a6ea3cf4563c1301f88fb471a4e32508f7dabfef5df

SHA512
5cb89365950aedc99d5d5a5f96ec563bc6e819812a1afc1885bdc8eaafcd632e3d458b88f9af4a1c360c2cc314a7468f727803b40f179c8d9ef573d911e8a5e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
160cd40a1036691ea174be4b4d7eaac2

SHA1
267124695ef9ea17b45b3daa03743195ae27704f

SHA256
d1df8e81fa819df22866fd1b482e660f5327fd751627935f74cae4b1b3f6e572

SHA512
80152b55ad1c71253086c09b1ae355e5e7afc26c418e98bf1952635b229fa607846bc1ceaa455fd78fe78676c3a14f1bfe0748399dc1a4989a98c1a93f5a5709

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c17c9d36cd80d46ef1e1717e3a3dce0d

SHA1
2115c9cdc74810da3baca90bcf461a938e67e434

SHA256
54705826cb88be26458de64f5e74dc688d0e627cb6665514248de4a11d381dfe

SHA512
6fab0cc13ddc801700c99688ff878547b2f5440b9d319e0a04760fc8a7f21a1119ae49ebeb7ad8a53758dd4a44622082eaaff01feb587ccd3dccf6c328d4db02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
408b14a536ea8c903bffb6dc847ba63d

SHA1
fe70f35455d8752aa46d1fd1d9e474dfe99aea93

SHA256
2fd587cb0f418fdd7915d3d3c2a7b411bf9169c52efb93a4982d4733ec301e20

SHA512
0d656de4eaa78ce58fa2a36bb769cb89ea2c89ee122195cd97ff75a5487a1eba226892b33fd2e7035968805ea796913a846169086751577b5ad343cc9c91a227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
d0ce44da7d5591b01e6885e2a0d513b5

SHA1
df76f9b776099f9a8e604561ec4e6b014a643425

SHA256
4806c1f3405fc494171a3017dceaf977564cdbdf273d3e5b930b1a695920570e

SHA512
51d08283c78679181524d0f2b1c9499f447e8aa1a0aa1f1cca313e6ae94a057bcd68c5a90d7758385dbb29e84682d97139b77052292192fcc2f52d8d9939921f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
9b2bc921857745605e78dfc0aeaffc5a

SHA1
fc2813473a70d7029d08134a278394cfc50ac08b

SHA256
857bf0e5a16372ba2abce4ab5470ed7e4d9c6226969371488b14e2bf0d8d46cc

SHA512
11b483efaec86cb7e2f0ab7f048f7c3d9a0dd3f19861bdd4959aaf74215e1413910661a96c1fa3c10ced98ff06cf2d18c5ef32c5d7edcbea066fe8fbdcf1256a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
881318ecda462db6e638cde31ec5fee1

SHA1
f7f8888cbd3e87ff13014d02397f91674017dffb

SHA256
45892c8e11022c3157e5bfd3311068fbf5b60be7df391d901c25e19c6507ec30

SHA512
e1e42b62b8249cd321bcfeb4b8dcfccb172fda10aaaf8ad5e27fe063051df0a4d7b4f46653e7e183cd4f9ceb6eec73715e528b6c07bdac5186913cc208b2fc63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
69fb046ebe9dd5652815f05e0c4b3e30

SHA1
b93013661e17b1e8ad4d7e39bd8ac5ee757ce179

SHA256
2cce348b367acafc10b7ac044b8713095ffe9dd8139abb88c139f4aaa496b5ae

SHA512
9e467f5a930771b7616461b3577fbe7a22047becc57de485aded20c1696412cb2ea8c8943462554031c189caff99310afaa66f3f5814ffe41dd853a0bef59961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
84c8040213adce8232b807f5e5219da6

SHA1
b105d41721bf1dc8dc7580ac21504158bdb22480

SHA256
d53276a8edd1f2a0f9f257558e6cff8d4635fccaf5bd95bb2f6a9ec3de9ceb46

SHA512
960be1c87f6861c8bf365f76704f65337e0b85b27a9e1dee8d6c94a8ef32218bb2377966368d5e517078ec458f51d76091835103ce93d70a99d26bec24960974

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d20e7cddc7f3ce5eb2ffb2a0c6cbbb25

SHA1
8c9ee6c734ef3b4c8e4c471d97ea8eae92c6a65f

SHA256
bb48e8703f3bf32af6afa9f19842d5114e4f74b09d842fe6ac2bd65a284d3dbf

SHA512
22e99492f2e576ff30f73e01a97124dc9c78e004c30f795fe1afeaea71934bb47bdde64c775d863e05530cde89ed6843232df690e5c9a40e13403b5c4bcf420c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bdc59338987706dc772bb01587a27b23

SHA1
d6a8561f3524c17b54c3fdb6df35cd816e80653f

SHA256
366f7b927f1742de58181ecf25a636575b0254a4642343722fc7433d3c1054ca

SHA512
ff91df0464c2896fadffec6977aaf25e552975db6ea3407e938f0f2e8bf416ac26ea7a0dcbe7c2de8609a44a7d759736e80717bb5fad39f19911cafed7979b19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4de9a05aa80547584ac1df48a88e9533

SHA1
eb89cff5fd83bd266db065b4e931bf6b2fc94141

SHA256
54b0055e08d1262129cae796c706b75f7a4c0b726f0ad2cfc73736e5ed568f96

SHA512
2db891eb04b31221cc54b0310978821817665470f19b56dc4aab5761334fe8c84dc9bb37e4f963ddef9bea82bb1b8c15acffe64baa61f25aafe10469d7e65ee1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dfba857b9e15e0509d8c0914150a13bc

SHA1
c1a5ba5105139cabe867284e695d37f06cc930d0

SHA256
b67df9943b2c0ca10cfac0f3ec8919fabfb61ba2aee4ea9630d200a3d8fccc81

SHA512
84917454b4ad374feb80ea2186e769c547ad790d1287d90fec7ee8bbeaef8f46aea5ec0aa5842a13c424df99bbe45da378e3902aa363e9c0786d80076e8050ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
364927be2c5887a19766e3aca042d398

SHA1
880a07517384e97b550b322bdb32963e7a201427

SHA256
8adb4ab1f5ebd528557598a452a43f58fb6ec5da706bad0be41a6190261d9247

SHA512
96fa557210ff730f8cd1947d20ee6154b44093e4767c83bf6d9a0e37616bffb7e298a3e8e7899e3c03c9f096df713671b6380f60345a58e7b70d4eed791a1c5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
77a589288893f3e6f967c4e374bd0a5b

SHA1
b28ec283a5c98bae3cc99feb918469d0efa04c16

SHA256
fb1c27239d209901fb7a0bcde3784932fbadcaa8365b6edf65fa8485f3419ea2

SHA512
f8429f54ffe0462748183d45268d9feb6a89d6a645f799190a7abf976015c20d9294d794a35c7d30eb0dfd64c8fa0977d56c6b735161521a912c867eaef02f40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
01866a887a4a6c349dcc08fa6b9464ac

SHA1
b4a45194c0ab5c0626d0ee26a6e6e04318fbc308

SHA256
c81ec4b37131a28ce792e5720b0a0d074efca5e0237d9bbcfb7cb6e50ba29f0f

SHA512
6564f9c7a0aaf5f2c77a9ffb6c609d44a20143cf36bd6e6488d3300bfedd3487237ad5b13cfd1faabb8529dff3917336cb3ea880bfc9b0c41da5f08c9f43a7b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2a21c811d0cd105ad5215ca7d2c73f2f

SHA1
5c8b9eaf958431392c5e29bd963b4e618bdcbab4

SHA256
c3a9cc507c4a0e7a8ea2ab08f18d92bf9b1952c79af96f85000344c5ea44186d

SHA512
7d57e2f2471e35e9d6af40a8a197e087aca4ea33508905c8a2ad79a197a93cbf3d22d3411f1fc629021ca71f1b4808307b69b4756570cd44ac90a24510c69b9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ef3960a81fce7ea1c5235da0a47cf655

SHA1
da94f5da62c7fc47b42bec5aed02e7f5088174f8

SHA256
f953a52505bb42cf9db66337e2eb99b555f0acc3c56d79771a89c668e5193f9b

SHA512
594d4f65d025a49fe57e02041d38ea9d2e171a3e824e83198ced7b983c397ce13f7566efb7191ea4e5ddd2d86b68e1f633bbf76a3b6d281b6f3e40b477c52f7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
15d054576c4688d9b0b5989cbae67030

SHA1
d193f768d64843c9d45ab2cb22bc26bbdfe639ff

SHA256
4c8013de65145ae892ac35d66438344ea7a52404534ce3aedb0b7435b0bca336

SHA512
b28ad06f2b74662e6e79c4d040a41755fa158f9c2f556b4a6c9f52a29bfe706904798e73f46fbb2ca388d84eb7369efa57fade9b5d0fcdfa326a2ea86be656d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c70bdc59c9a20c3cdca0f4d46e38c8e0

SHA1
935850c2a160f51f08859b90513b3b4f1c04c91b

SHA256
8220fbb9156fc18f1a57eaeab2477e72e45c80af45b3f421cd52c323bbb2ea7f

SHA512
87a6c5e28b584c7b549b9f8308905edc60ba9f0a98cbf1314b50fd2989f2a97b5c0f70bf6969b201f5ff1ad221456d4f572f4eabc47271526ff67c14ea91ebed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
954376c833a74845a62a89d61ce7cbce

SHA1
2c95a5da918efbcf2ff21cb1b8e25b3d1e8fc65a

SHA256
6c42866bb59cb176ca061d0829310cc054c13d878b7936497a034dc709b9e643

SHA512
8e1ccd119a1c0b9eaa969e8512606d3c4342ecfd04c65debe978f6f77c249df779a5deebd64702c3f3373f001f35e6b061ca8626e7227c2ab6ea21c930197233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
eea01b677e6cae317dff41bc7e0f689a

SHA1
c05efd8a2d1c6ffc53051692c9c1a22013e6ada8

SHA256
7498427c5657bcd05f8c496549d582baba240b07624dcd78232364d195ceab87

SHA512
ef014a60642c65f868f79629b25f801a1c104c62eb303ec00ffbd7d47129a722cccd0f7fa41a8ba13c8eaa34a50af4c914f7eb6b28ade227cd876d169b021cd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
72c8269f86bcb7422679795b0c006a8f

SHA1
fe4e5249449f9e3d000a9d2a985bd645c1b43991

SHA256
5ee94787479a995f41bc8aa4e5d24c5d2843d472adec654d047ae7a982445a1f

SHA512
f3c79226dd6c9c7e65519a0e523fedf2f6ee40bd109444690b94696fe9b93beeb04810ec50b43b8d5c9ac8299138f62802cab8fb250e7d881c6b666e4ab59996

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8065b039415df70d8daf147cf83f1db8

SHA1
acf95091efb0fcf03b872599161bfc51faa4e20b

SHA256
0bc9b49e735754bf56ecc46e3d61a0ef182f109e9d7267c59f8cc6ef74423836

SHA512
9f1d9dd12cb30356fc74b6caca0bb642036e90ba13f53c1b882f928ea906dcd4e94f61410d549c86982ab6616803358afec48143213be9e1b2c888f19610a6ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5aec5553b52359d4607a04cdeac2d882

SHA1
c2926d52690e5a6a8bd3bb43e3bdf298598d20f4

SHA256
7164c951a22e5873221d3a0c06355be5165115289dee480423919ee2d9a97ce3

SHA512
f2c432965db349c5e7b6bd91f5967b11df044bd4cecde73998fc6376fcb91a31d4e1dfd1063bd9ccda4e422120e899453fc8c61624ce82e058a5a5a9b651d106

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6dbccff2f4577fb11da28fc066a60f78

SHA1
d74092ad8258ca61a72574bc4bc4930b4fbcfe63

SHA256
ebabb751b3673346bd026c7b3d8b8b4ab97cbf416d428e0c57f90eacd38ce3c3

SHA512
c0270250e9cff097d86727cf3d6803542bc75d01a9244f1ded73542bd74ba59e46c7d3d7ec6968f609cbb59c26cdf7963fc5c617a9f8db379e64757ea7e0c5e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
9c176dc974aff811f46c05188236a38a

SHA1
1cb3cabbcbd0a74da367eb9e690a91cf85ee637f

SHA256
5b433706f6342adebed6da91a0f9fa4f3af6453b085e0dc200ad8169411b0268

SHA512
73acf5aa712a4611ebc65259eea7f5eb5540368059e455e003270e0a10600878bfdc9d3696e00ad82690d63e5b61180a94cf13e167661e6ee23ebca4f7968f0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9286b8a582f95c693bcedc6b675e9c72

SHA1
7551254205c5713610a9a314e6cc23788a63091a

SHA256
e5006668b34afac762772cd104bac640c621c5eecae15e864c7d13bfabb9d555

SHA512
6012fff8c4eebf1fbdc9dde88cfb2beac9e70fd1d8b2b969e9ec82f99dd8b51f01eb42d25b59337d7bbf7f63124a2ccee584241b30bfbeecfbe41846940749f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
be6297909bf0d98018db77fc87a77999

SHA1
3171662ad91ab1444d5a6ad2688ca2f633916877

SHA256
b50e69c11123a4cd0c2972974fad8f3cf1e24d211a9ca1bbb8cef5a7dc98f2f9

SHA512
c9b1ca8721109a5d69452893017b637d47dda127b228bb76362ead397e70cc734109962d5d2a415867b2228ac4749263ff40353225e99fc34f6391767ad8f39d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
a3aab7c52f228aadce8c67dd61025c36

SHA1
dd9e951b4e24f020315c9500d5941a0085ea61ea

SHA256
cd145c8bd35eda0b9ca89ec0ab884767cc9dbdc7dcb4045d88f0c101a902b256

SHA512
72c996662fa9f842d9832a58a212b86e37ec707633872c1faf6a1b881167b88a0417dfd12651f1845dade62b92c6c61ef1ba5712e1b54a0eecdae2b773c81f12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
c7802064394bf88de0c35b76418410da

SHA1
92b803efb785d63c1315914705b139a208cef7a3

SHA256
d9858a08ab39d68d78b685cd671dca11649a3dcaba5a62631d7d38fc4281a7d1

SHA512
3f40835e7f005bcf4d9077626b65b6fffd018782a186cc37371bb77d2ddd69674d36e4364a9783f3b511ded80eec29bd370c6d8b10d8ff513c9708980fc6e279

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
09ec623bff8913e18a11a73807c63b67

SHA1
3ce2917cca81b1cbb82ad9aebd3ed7b000e9e03a

SHA256
b233dfcddd50dc999e53f615a378c1b38310910cbed2e67075991dfae3aaa335

SHA512
52d38fa05a91a22fc0811a044e25bfb6ec8860d2aa357f789268d185958a199191e061f2a760d1534ff2cdffc1a45224d191176a7b2ba39cac77c09b0a09f166

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
617fb8adb9df387943c75b70d6c246c7

SHA1
cd2d79ea31754a1f74f7508096563b4014c18e29

SHA256
b9c2b28d098f3c42912dc216739e0ec17c8015f3dd3208b0a4717169c24fcb3a

SHA512
da513f1a7a470d78d11eb7bc35c3830a7a2bb84071d94977c883a54035cd898d53c2634cfa84449e9e128a15ca5257bfd0412d0c20cf0ef7065868313b0e0928

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0e4df74cce0423376e6a782e4b3deb64

Filesize
7.0MB

MD5
0e4df74cce0423376e6a782e4b3deb64

SHA1
8db193e73416f1da44ad98f344d3ff207ace44ac

SHA256
8b9263763da2c73054426eb6a8de5c4e7f42ecd11e9c95a426b0c66aedd727ab

SHA512
ca3136acde16e33c80a0f50c5f73a2eda795ebf9a90f7bcd4803b5cf2c51135b2ec2ae40d06015ab6fe4b2b18bfc0a95712bc98dcf5f2cc85192bb715a021642

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.9MB

MD5
1c4187f0b612a9a473010dcc37c37a82

SHA1
34d46733452812d481adeedad5eaea2cf4342540

SHA256
c8d55b0f4f25caf135dabc7f21b9548263022107e9740dfe692b402469cd47bd

SHA512
075678e24a867d5630da324e934837d81a3fa1d848a15feeb2a7be268d38b81ca4210cd44a22e9869173edebecd1947968327ddce16a85b71c03e6307e365def

Download Submit
C:\Windows\Installer\MSI103B.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\Installer\MSIFEF1.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIFF32.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
memory/180-4140-0x0000000073680000-0x0000000073890000-memory.dmp

Filesize
2.1MB

Download
memory/180-4243-0x00000000002F0000-0x0000000000325000-memory.dmp

Filesize
212KB

Download
memory/180-4043-0x0000000073680000-0x0000000073890000-memory.dmp

Filesize
2.1MB

Download
memory/180-4042-0x00000000002F0000-0x0000000000325000-memory.dmp

Filesize
212KB

Download
memory/2176-1-0x000002452FDF0000-0x000002452FEBE000-memory.dmp

Filesize
824KB

Download
memory/2176-0-0x00007FFD37FB3000-0x00007FFD37FB5000-memory.dmp

Filesize
8KB

Download
memory/2176-3056-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/2176-2623-0x000002454A400000-0x000002454A412000-memory.dmp

Filesize
72KB

Download
memory/2176-2621-0x000002454A360000-0x000002454A36A000-memory.dmp

Filesize
40KB

Download
memory/2176-31-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/2176-4-0x000002454A320000-0x000002454A342000-memory.dmp

Filesize
136KB

Download
memory/2176-2-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/2848-3058-0x0000018F2A110000-0x0000018F2A1C2000-memory.dmp

Filesize
712KB

Download
memory/2848-3055-0x0000018F295A0000-0x0000018F2965A000-memory.dmp

Filesize
744KB

Download
memory/2848-3053-0x0000018F2A460000-0x0000018F2A99C000-memory.dmp

Filesize
5.2MB

Download
memory/2848-3051-0x0000018F0EF20000-0x0000018F0EF44000-memory.dmp

Filesize
144KB

Download
memory/4572-4270-0x00007FFD55ED0000-0x00007FFD55EE0000-memory.dmp

Filesize
64KB

Download
memory/4572-4285-0x00007FFD55720000-0x00007FFD55730000-memory.dmp

Filesize
64KB

Download
memory/4572-4279-0x00007FFD53E70000-0x00007FFD53E80000-memory.dmp

Filesize
64KB

Download
memory/4572-4278-0x00007FFD53E70000-0x00007FFD53E80000-memory.dmp

Filesize
64KB

Download
memory/4572-4277-0x00007FFD53D60000-0x00007FFD53D70000-memory.dmp

Filesize
64KB

Download
memory/4572-4259-0x00007FFD56140000-0x00007FFD56150000-memory.dmp

Filesize
64KB

Download
memory/4572-4258-0x00007FFD56030000-0x00007FFD56040000-memory.dmp

Filesize
64KB

Download
memory/4572-4263-0x00007FFD56190000-0x00007FFD561C0000-memory.dmp

Filesize
192KB

Download
memory/4572-4286-0x00007FFD55720000-0x00007FFD55730000-memory.dmp

Filesize
64KB

Download
memory/4572-4287-0x00007FFD557D0000-0x00007FFD557DE000-memory.dmp

Filesize
56KB

Download
memory/4572-4288-0x00007FFD557D0000-0x00007FFD557DE000-memory.dmp

Filesize
56KB

Download
memory/4572-4289-0x00007FFD557D0000-0x00007FFD557DE000-memory.dmp

Filesize
56KB

Download
memory/4572-4290-0x00007FFD557D0000-0x00007FFD557DE000-memory.dmp

Filesize
56KB

Download
memory/4572-4292-0x00007FFD542A0000-0x00007FFD542B0000-memory.dmp

Filesize
64KB

Download
memory/4572-4293-0x00007FFD542A0000-0x00007FFD542B0000-memory.dmp

Filesize
64KB

Download
memory/4572-4294-0x00007FFD542C0000-0x00007FFD542CB000-memory.dmp

Filesize
44KB

Download
memory/4572-4299-0x00007FFD53750000-0x00007FFD53760000-memory.dmp

Filesize
64KB

Download
memory/4572-4301-0x00007FFD53850000-0x00007FFD53860000-memory.dmp

Filesize
64KB

Download
memory/4572-4300-0x00007FFD53750000-0x00007FFD53760000-memory.dmp

Filesize
64KB

Download
memory/4572-4295-0x00007FFD542C0000-0x00007FFD542CB000-memory.dmp

Filesize
44KB

Download
memory/4572-4296-0x00007FFD542C0000-0x00007FFD542CB000-memory.dmp

Filesize
44KB

Download
memory/4572-4297-0x00007FFD542C0000-0x00007FFD542CB000-memory.dmp

Filesize
44KB

Download
memory/4572-4298-0x00007FFD542C0000-0x00007FFD542CB000-memory.dmp

Filesize
44KB

Download
memory/4572-4291-0x00007FFD557D0000-0x00007FFD557DE000-memory.dmp

Filesize
56KB

Download
memory/4572-4280-0x00007FFD53FE0000-0x00007FFD54010000-memory.dmp

Filesize
192KB

Download
memory/4572-4281-0x00007FFD53FE0000-0x00007FFD54010000-memory.dmp

Filesize
192KB

Download
memory/4572-4282-0x00007FFD53FE0000-0x00007FFD54010000-memory.dmp

Filesize
192KB

Download
memory/4572-4283-0x00007FFD53FE0000-0x00007FFD54010000-memory.dmp

Filesize
192KB

Download
memory/4572-4284-0x00007FFD53FE0000-0x00007FFD54010000-memory.dmp

Filesize
192KB

Download
memory/4572-4276-0x00007FFD53D60000-0x00007FFD53D70000-memory.dmp

Filesize
64KB

Download
memory/4572-4260-0x00007FFD56140000-0x00007FFD56150000-memory.dmp

Filesize
64KB

Download
memory/4572-4267-0x00007FFD55E40000-0x00007FFD55E50000-memory.dmp

Filesize
64KB

Download
memory/4572-4268-0x00007FFD55E40000-0x00007FFD55E50000-memory.dmp

Filesize
64KB

Download
memory/4572-4269-0x00007FFD55ED0000-0x00007FFD55EE0000-memory.dmp

Filesize
64KB

Download
memory/4572-4271-0x00007FFD55EF0000-0x00007FFD55F00000-memory.dmp

Filesize
64KB

Download
memory/4572-4272-0x00007FFD55EF0000-0x00007FFD55F00000-memory.dmp

Filesize
64KB

Download
memory/4572-4273-0x00007FFD55EF0000-0x00007FFD55F00000-memory.dmp

Filesize
64KB

Download
memory/4572-4274-0x00007FFD55EF0000-0x00007FFD55F00000-memory.dmp

Filesize
64KB

Download
memory/4572-4275-0x00007FFD55EF0000-0x00007FFD55F00000-memory.dmp

Filesize
64KB

Download
memory/4572-4262-0x00007FFD56190000-0x00007FFD561C0000-memory.dmp

Filesize
192KB

Download
memory/4572-4264-0x00007FFD56190000-0x00007FFD561C0000-memory.dmp

Filesize
192KB

Download
memory/4572-4265-0x00007FFD56190000-0x00007FFD561C0000-memory.dmp

Filesize
192KB

Download
memory/4572-4266-0x00007FFD56220000-0x00007FFD56225000-memory.dmp

Filesize
20KB

Download
memory/4572-4261-0x00007FFD56190000-0x00007FFD561C0000-memory.dmp

Filesize
192KB

Download
memory/4572-4257-0x00007FFD56030000-0x00007FFD56040000-memory.dmp

Filesize
64KB

Download