8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
287s
max time network
290s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-11-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
4824	Solara.exe
536	RobloxPlayerInstaller.exe
3064	MicrosoftEdgeWebview2Setup.exe
3580	MicrosoftEdgeUpdate.exe
560	MicrosoftEdgeUpdate.exe
3428	MicrosoftEdgeUpdate.exe
2356	MicrosoftEdgeUpdateComRegisterShell64.exe
632	MicrosoftEdgeUpdateComRegisterShell64.exe
2540	MicrosoftEdgeUpdateComRegisterShell64.exe
2232	MicrosoftEdgeUpdate.exe
2456	MicrosoftEdgeUpdate.exe
1628	MicrosoftEdgeUpdate.exe
2000	MicrosoftEdgeUpdate.exe
4940	MicrosoftEdge_X64_131.0.2903.70.exe
1948	setup.exe
1152	setup.exe
4704	MicrosoftEdgeUpdate.exe

Loads dropped DLL 27 IoCs

pid	Process
3120	MsiExec.exe
3120	MsiExec.exe
104	MsiExec.exe
104	MsiExec.exe
104	MsiExec.exe
104	MsiExec.exe
104	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
3120	MsiExec.exe
3580	MicrosoftEdgeUpdate.exe
560	MicrosoftEdgeUpdate.exe
3428	MicrosoftEdgeUpdate.exe
2356	MicrosoftEdgeUpdateComRegisterShell64.exe
3428	MicrosoftEdgeUpdate.exe
632	MicrosoftEdgeUpdateComRegisterShell64.exe
3428	MicrosoftEdgeUpdate.exe
2540	MicrosoftEdgeUpdateComRegisterShell64.exe
3428	MicrosoftEdgeUpdate.exe
2232	MicrosoftEdgeUpdate.exe
2456	MicrosoftEdgeUpdate.exe
1628	MicrosoftEdgeUpdate.exe
1628	MicrosoftEdgeUpdate.exe
2456	MicrosoftEdgeUpdate.exe
2000	MicrosoftEdgeUpdate.exe
4704	MicrosoftEdgeUpdate.exe

Unexpected DNS network traffic destination 41 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 3 IoCs

flow	pid	Process
10	1284	msiexec.exe
11	1284	msiexec.exe
12	1284	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
7	pastebin.com

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ViewSelector\top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\LICENSE	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\write-file-atomic\lib\index.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AvatarEditorImages\AvatarEditor_LightTheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\PluginManagement\allowed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\R15Migrator\Icon_Checkmark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\fonts\NotoSansKhmerUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\DeveloperFramework\UIOn_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioSharedUI\arrowSpritesheet.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\dist\src\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\access.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\pack.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnimationEditor\img_dark_scrubberhead.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_verification.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\promise.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-access.1	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Backpack\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\DeveloperFramework\MediaPlayerControls\play_button.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\DesignSystem\ButtonA.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\131.0.2903.70.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_passthrough.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\file.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\fetch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\scroll-middle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\ssri\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\sort.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\vendor\QRCode\QRPolynomial.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\models\LivePackages\.placeholder	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\XboxController\ButtonA.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmfund\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\stream.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\api-ms-win-crt-time-l1-1-0.dll	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\places\Maquettes.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\pipeline.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\newBkg_square.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\Radial\TopRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\category\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-ping.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\parse.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\graveaccent.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ViewSelector\bottom_zh_cn.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\icon_friends_16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\2f4538ce-7a94-480c-b041-badd8d450f19.tmp	setup.exe
File opened for modification	C:\Windows\Installer\e57d34e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\Installer\e57d352.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E0D41630EB98758.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\Installer\MSIE8A2.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD769980FFDBD6DD.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EC.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Installer\MSIDA44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE44A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF7.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\Installer\e57d34e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9C6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F8F8922F8122029.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98A.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\Installer\MSIE872.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB50.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF60335B164890135B.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2232	MicrosoftEdgeUpdate.exe
2000	MicrosoftEdgeUpdate.exe
4704	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3640	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133772726497728961"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1724	Bootstrapper.exe
1724	Bootstrapper.exe
1284	msiexec.exe
1284	msiexec.exe
4824	Solara.exe
2488	chrome.exe
2488	chrome.exe
536	RobloxPlayerInstaller.exe
536	RobloxPlayerInstaller.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3580	MicrosoftEdgeUpdate.exe
3580	MicrosoftEdgeUpdate.exe
3580	MicrosoftEdgeUpdate.exe
3580	MicrosoftEdgeUpdate.exe
3580	MicrosoftEdgeUpdate.exe
3580	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe
Token: SeCreatePagefilePrivilege	3328	WMIC.exe
Token: SeBackupPrivilege	3328	WMIC.exe
Token: SeRestorePrivilege	3328	WMIC.exe
Token: SeShutdownPrivilege	3328	WMIC.exe
Token: SeDebugPrivilege	3328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3328	WMIC.exe
Token: SeRemoteShutdownPrivilege	3328	WMIC.exe
Token: SeUndockPrivilege	3328	WMIC.exe
Token: SeManageVolumePrivilege	3328	WMIC.exe
Token: 33	3328	WMIC.exe
Token: 34	3328	WMIC.exe
Token: 35	3328	WMIC.exe
Token: 36	3328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe
Token: SeCreatePagefilePrivilege	3328	WMIC.exe
Token: SeBackupPrivilege	3328	WMIC.exe
Token: SeRestorePrivilege	3328	WMIC.exe
Token: SeShutdownPrivilege	3328	WMIC.exe
Token: SeDebugPrivilege	3328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3328	WMIC.exe
Token: SeRemoteShutdownPrivilege	3328	WMIC.exe
Token: SeUndockPrivilege	3328	WMIC.exe
Token: SeManageVolumePrivilege	3328	WMIC.exe
Token: 33	3328	WMIC.exe
Token: 34	3328	WMIC.exe
Token: 35	3328	WMIC.exe
Token: 36	3328	WMIC.exe
Token: SeDebugPrivilege	1724	Bootstrapper.exe
Token: SeShutdownPrivilege	2648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2648	msiexec.exe
Token: SeSecurityPrivilege	1284	msiexec.exe
Token: SeCreateTokenPrivilege	2648	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2648	msiexec.exe
Token: SeLockMemoryPrivilege	2648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2648	msiexec.exe
Token: SeMachineAccountPrivilege	2648	msiexec.exe
Token: SeTcbPrivilege	2648	msiexec.exe
Token: SeSecurityPrivilege	2648	msiexec.exe
Token: SeTakeOwnershipPrivilege	2648	msiexec.exe
Token: SeLoadDriverPrivilege	2648	msiexec.exe
Token: SeSystemProfilePrivilege	2648	msiexec.exe
Token: SeSystemtimePrivilege	2648	msiexec.exe
Token: SeProfSingleProcessPrivilege	2648	msiexec.exe
Token: SeIncBasePriorityPrivilege	2648	msiexec.exe
Token: SeCreatePagefilePrivilege	2648	msiexec.exe
Token: SeCreatePermanentPrivilege	2648	msiexec.exe
Token: SeBackupPrivilege	2648	msiexec.exe
Token: SeRestorePrivilege	2648	msiexec.exe
Token: SeShutdownPrivilege	2648	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2380	1724	Bootstrapper.exe	79
PID 1724 wrote to memory of 2380	1724	Bootstrapper.exe	79
PID 2380 wrote to memory of 3640	2380	cmd.exe	81
PID 2380 wrote to memory of 3640	2380	cmd.exe	81
PID 1724 wrote to memory of 2216	1724	Bootstrapper.exe	82
PID 1724 wrote to memory of 2216	1724	Bootstrapper.exe	82
PID 2216 wrote to memory of 3328	2216	cmd.exe	84
PID 2216 wrote to memory of 3328	2216	cmd.exe	84
PID 1724 wrote to memory of 2648	1724	Bootstrapper.exe	86
PID 1724 wrote to memory of 2648	1724	Bootstrapper.exe	86
PID 1284 wrote to memory of 3120	1284	msiexec.exe	90
PID 1284 wrote to memory of 3120	1284	msiexec.exe	90
PID 1284 wrote to memory of 104	1284	msiexec.exe	91
PID 1284 wrote to memory of 104	1284	msiexec.exe	91
PID 1284 wrote to memory of 104	1284	msiexec.exe	91
PID 1284 wrote to memory of 4864	1284	msiexec.exe	92
PID 1284 wrote to memory of 4864	1284	msiexec.exe	92
PID 1284 wrote to memory of 4864	1284	msiexec.exe	92
PID 4864 wrote to memory of 1888	4864	MsiExec.exe	93
PID 4864 wrote to memory of 1888	4864	MsiExec.exe	93
PID 4864 wrote to memory of 1888	4864	MsiExec.exe	93
PID 1888 wrote to memory of 3080	1888	wevtutil.exe	95
PID 1888 wrote to memory of 3080	1888	wevtutil.exe	95
PID 1724 wrote to memory of 4824	1724	Bootstrapper.exe	97
PID 1724 wrote to memory of 4824	1724	Bootstrapper.exe	97
PID 2488 wrote to memory of 3300	2488	chrome.exe	102
PID 2488 wrote to memory of 3300	2488	chrome.exe	102
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3260	2488	chrome.exe	103
PID 2488 wrote to memory of 3092	2488	chrome.exe	104
PID 2488 wrote to memory of 3092	2488	chrome.exe	104
PID 2488 wrote to memory of 4812	2488	chrome.exe	105
PID 2488 wrote to memory of 4812	2488	chrome.exe	105
PID 2488 wrote to memory of 4812	2488	chrome.exe	105
PID 2488 wrote to memory of 4812	2488	chrome.exe	105
PID 2488 wrote to memory of 4812	2488	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3640
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 020BC5B1B39C2DB884816783C7667B07
  2⤵
  - Loads dropped DLL
  PID:3120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68FA942DFEE697F18E73CE3E05A121B9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 792CB7A37DF93FAF2AE7C1B0C888073C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc866fcc40,0x7ffc866fcc4c,0x7ffc866fcc58
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4376,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4712,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4928,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4964,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5056,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5048,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5036,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5204,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3448,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4244,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3244,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5040,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=1132,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5392,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3272
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3064
  - - C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3580
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:560
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3428
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:632
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUI1OTM5QUEtNTRDRS00RkJCLUE2OTAtOUM1RDEwMUQ2MTM0fSIgdXNlcmlkPSJ7MDcxQURERDYtRTRFMC00ODA0LTg0NkQtQ0MzNDU4NDA3RUU4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QkJGQjAwQi02RjUxLTQxNzItOTM2Ri1FNUY4NjREMEI5NjF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3MjY3MTI4MTkiIGluc3RhbGxfdGltZV9tcz0iNzY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2232
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9B5939AA-54CE-4FBB-A690-9C5D101D6134}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5100,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4396,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5248,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4992,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4280,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6536,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6836,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6132,i,9219724647154800507,9392647803226473631,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2540

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3916

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1628
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUI1OTM5QUEtNTRDRS00RkJCLUE2OTAtOUM1RDEwMUQ2MTM0fSIgdXNlcmlkPSJ7MDcxQURERDYtRTRFMC00ODA0LTg0NkQtQ0MzNDU4NDA3RUU4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNTREREEyMC05MEIzLTQwNzEtQTAyNS1EMTZBNjFBQzRFMUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3MzE4NDI5MTUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2000
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\MicrosoftEdge_X64_131.0.2903.70.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\EDGEMITMP_BC17B.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\EDGEMITMP_BC17B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1948
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\EDGEMITMP_BC17B.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\EDGEMITMP_BC17B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05431D0E-36CA-49B2-82F3-5EA96E4A0CBC}\EDGEMITMP_BC17B.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ff7fc612918,0x7ff7fc612924,0x7ff7fc612930
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1152
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUI1OTM5QUEtNTRDRS00RkJCLUE2OTAtOUM1RDEwMUQ2MTM0fSIgdXNlcmlkPSJ7MDcxQURERDYtRTRFMC00ODA0LTg0NkQtQ0MzNDU4NDA3RUU4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGMDYxRkM1RC01RURFLTRCRTktODExRi1BRTMwMTMxNEJBRUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjcwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NzQ3MDgzMzEwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjc0NzEyMjY0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NzE5NjM1NzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Y4MTM2OTAxLWM1ZjAtNDMyNi1iZjMzLTRkNzNiODdhMTk3OT9QMT0xNzMzNDAzOTg3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVNSRjNwSEdUcnIzbjNQYVVkM3RpejNuUFA2MGpVb2d1S1kyJTJmeGR2WGxwZmV0SEYwOFdVNmFLY0JrJTJiQ2ZVRkc5NkYlMmYyaXpJcU8wT0o4SHlheDZ3M3R3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBkb3dubG9hZF90aW1lX21zPSIxNTA3NiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NzIwNzM2ODkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTg4MzAzNTAwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NjUzMTYwNTc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTk3IiBkb3dubG9hZF90aW1lX21zPSIyMjQ4NSIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2NjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C0
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d351.rbs

Filesize
1.0MB

MD5
706102ca46269fc0d1947e9edafe8712

SHA1
95b4fccf49ad4e9cd1d2cb477ebfad5a1073900b

SHA256
4219d81917ffa7507c459763fba5c8f31341687504338b6eb7a9daa6324693eb

SHA512
f6e3ead3552a380cc5b6212c02f20dc391a243448cc32f180189dc653820954e884d22e31c62adb6586af97e645816f95e52d6b9a81b475dcad207d8fb88612a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Installer\setup.exe

Filesize
6.6MB

MD5
8ae106f9f32723071b7d89c0dd260569

SHA1
c66b0f1b5f01b0a6a8eb0dc32842983f05c992c3

SHA256
c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26

SHA512
e96e3f14239b4fd1c2e6defa65e1eb9920efcf870ad98bee872b6248ab13032976d0340f99b490d6b7034f2ac099ff4d5e613d8f46a812483b1996569bc31dd1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8E95.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.8MB

MD5
ee40308e2ffbc9001db2324ff6420492

SHA1
47cabfe872311f65534cbd4b87d707ccdef559d1

SHA256
38cd32dedb5c8c2af8ecd56827af5b4477a4b9ca3e518199d389a261baa999a5

SHA512
5f5fd0db005d49d63eaa81b288d2d6d40ce9c84cafd1c75d33723e47f23341d5ff254c2ed6274790242ad53f5360467d121cf1196ec7a073d4506166248041c3

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
2a6686d512ee9ba8b75e0bce9a794770

SHA1
465e00320c74d4481a5e7e7242aaeb60d02e2fab

SHA256
5afa5bcab0d66f0dc65ccad359650730ace53dff1d891cd33a9f54aa43d34419

SHA512
ff44d6f3e7be06c98077a00854edb0ca122fc5c98c976f86787c7b003d224f62c1079412e7c5cdb36c2a6df0825dd17ccbffe44eb264fa63e3d1e44654af74b2

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
9925cc32732f9af0575b5e7cb2883020

SHA1
47af7bf26cdbd3f83c1c564bd151d26575309d40

SHA256
5a5ba15198779ceaed3121dd794889a2e949335b3e0fa898d5fa354eaceeb259

SHA512
6d8ea261a7d14fd412a825413ebe5430b285aeb44884e1cc249f825e5c577a34b370669f9de7fd979db25ecbe32899f1898473c3588d3b3842dc2eae7ae05040

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\684da1f6-36e7-4a95-aa2e-63c66c8f70f4.tmp

Filesize
234KB

MD5
0518f059a2a6a30cceca236f0cb4f298

SHA1
2077dc81924f06f609ae3e3d7b9692abb0b71d9f

SHA256
ae5e49358e5c53c1d06e2169164153ffe630fd9eff35c7a9743fc0191a0295cc

SHA512
d95cfdf19b270068c2dd2eff13b78be0b41b3b6dce912b0e37c0f66fffe3b005fd03562c00dc1bf5b6ba16adb50446d1dd6e94283f9eb45c0b730c350bedd404

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d3bfabbd7aa1718e3387e31f94061b4a

SHA1
7cdfe3d85f4d83620dad990dbc69d9d732638bce

SHA256
f48cfc60d2077aa1ac4c653a87dc701c2f200117c21cfb5a60f1b7f006ca89f7

SHA512
115df486b35db0e599233a64826e88ba7612bb2c6b9ea5fdbb087085d8fcf8854e289d022a7bac3eb084e6d61c13c2e2130c481da10befaa6b7d5bbb460120ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000fe

Filesize
234KB

MD5
093afc38e605c0adf9d83d626fc28d6f

SHA1
aff014a09a31891adfbafafadb4a20b83c6265a0

SHA256
a2d0d23254f999e7c447126d937e9cc61f917dd866b815faa78c3a1b49c5581d

SHA512
bc3a1673c46e1d25d8b392a73034efb70c69699681b4df40e2bb39b7bcc146a44ae27d26d05eb7e77543fa04a525aca4adce2c87d045ea9f2865e9ef2b24531f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000103

Filesize
49KB

MD5
5b342864b1b7ad05bcb10743edd96dfd

SHA1
6c479e75edcd274ca22e16a7cebd8d9a5ed50970

SHA256
9caa79e893c63b2e33bdf767994e621989fa5244e53ccf12556a011e6498850f

SHA512
564c0e0ea8cb23b2c0b81e2ef6b42d07cb9e56f2613788ee8e5c3c7b579293845b8c2f65b417e8238eaad7f4b03a99ed95da5b1892df39e3b04fbe8e7dc69200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000107

Filesize
33KB

MD5
80bddb22dd2f5e4ae97255db25aaeae6

SHA1
39e1cf126583ec8f7d4251a7f9c7f8d7f2e8592e

SHA256
195b05b1d4d55ea3b02a34c428405c1ae4b051fdb9e1b4954c6216489f28dec7

SHA512
c0d1816c604c1ffd975aa6fe790eb0661923da0bb2dac62af1d9740e42ee55fdf28645eabeeefa41efd669c92585216828892fa98881ae8864f40c919e52fc18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000108

Filesize
33KB

MD5
861d884433b473231b06eafcccffe597

SHA1
ad22a4f4cd14a959171445330605b66028a80fb9

SHA256
4ff8a3471d855fa9b1610b06c0169dbaf4f3207721d16fc4329c5d24a2ae00d1

SHA512
954e3821079c6fbf9d0c16e2190215aaee5c228e6c81cc5322daf666f7d20ff5b10b8380af0ac2925c65bbed42f1d71c57a7eb5c8f609c9e53e634daf15fea4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
88a0cc764eef35875208c6bbda550810

SHA1
542aecb51c5d8e427edd250eed3a62666781a2ac

SHA256
d3418a14024b8230f3ce0456832cad914bc0f3135aed4da55417156a87be876c

SHA512
7ec6b2170582c1f808e72e542011b69a4f5dc0e4d3f7d853d78377e363be6419f3ae0283b5fd1435fd4cd1b1fc3c3deb9b3575a953e3c0eff28f24df769bf4a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
622be27657ba60fc558ba0fd172eb8a4

SHA1
c195afaca9bc0341534f4cfb0b9be9ce2bf8317f

SHA256
ad57a257553bd9668bd051a070d18850579c06eaa76e78732d2194eda4f83389

SHA512
b85b812da8874233e32d67da47eed60248e8dc62c3f72524c487d1bc35c77572f021e1ad1a4f88cdf02df874bd39cdbef4e11015a41f931baeb0e1eca00642fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0910e2c9c9616d5e9b2d1b15dc17f2b4

SHA1
06ef565623c393fb556e8d39d51caafc7b933856

SHA256
d45c8b8aed9eb50224637f7bcee530362b44f447e99f5d4fc12f611013ee997c

SHA512
e7d2a71d5b1ae5efd13260428e2184f19fc2821276f16f848f4b712a00e9eeae26410c4e08b4a240639056186940a25ce10eb4178dbb310d999de43b776c0939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
0cfbaf5b9731aeab45fc7453c06d406a

SHA1
d110e53372897d871ee1304fdacbee9a776f4eb4

SHA256
f47d9e0de72e5b00b2e4401887fdfc3f4aeca6e0af0290c8472cff5796b97d57

SHA512
2f59673e7bf4f5203039ee9da0aaa5e06f5e54aed1b9f9f10b47726e9189989e8815fad7d54cba5221bb4acac43808ac39c5ee59bfcfeed33aae52948f4603e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe59edb2.TMP

Filesize
510B

MD5
1a3a41ede49f6a6acafd8ecb2c4b0b70

SHA1
37758d57d072a26dabfa174937611085b557770a

SHA256
b3ccbd62d0b852fc52f3d0f4f6f63516a543c97a324fb3f1a9a47769e37c5e3c

SHA512
5f5b9f620de4e4ffb0189e1563d0829c7e730105e1b70d0ee5f81134e985cde9dd2603cc9698f2104d66fb1391d577f933f2b022fec5857c38b8657af08d0da8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\02011680-10cb-4422-92c4-d9757f546258.tmp

Filesize
1KB

MD5
efc4c175d689395c21900dd6ff70c672

SHA1
3c077bea33196c9c853a234f2bfb75300e5fe292

SHA256
2681f7047c429a6cf8d2d84ac96a973cb88b46be8ccd62344cbd268253d2f6e3

SHA512
d270f3cc7fdb632fba5c1208813ff69dfa068220ba0e210aec2d7c530e8ff25b8c1c7d575b166dcbcf4e81e452c5eb380835d4854a7e6b69ab87a14cf72b8aff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
07b279620e4bbe35248ef13dfe97b9bf

SHA1
6e409adfc5910ebb94b4e8710c5dd0458cb98ad0

SHA256
969333793ed016941a732583257f966721e7a541a37f8ed8ddcbbe09ae95b48a

SHA512
1c1e3890b1fb7b9dea787b0caec5a2c2e8e68339aec0b5a5407c84f7bc574a2c8be0999e0f3cb58b5bfb98c68e3dd1cbdb854243d8c10def52b8032b32a44927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
d6c9e0a0eb7683bef179e35940d3c486

SHA1
91829a017d07993204bd169de347151aa99e78ae

SHA256
b3c0cc48f43a3989ec3d61097a0066308434d08c3deec37637d79a78aa90c974

SHA512
b462084a03ef990c9c8ae4425edd3d7a7ec85e63cf3a922a22d49c8ba7b063d570bdb65b2eb6e5863e777b428f88d1db11e0cc443be8e987d29aea3e8cce61d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
c58b8c33fc0eeaeafb47b292bf4e7d81

SHA1
8b3cdf33c15569f45d5b55d5d5dd1c8d8cdbc6ef

SHA256
c9f7ba2ef63e046cde6c8863521b6ffd5505d2bcccd79914dbab1b2001d3ae7c

SHA512
7b76c70dfb56ba7af339b7128f6da9e0903a431f3d8d1794c313b1a3c5a9e8d96a1dd9fe26cd9b9b227cc94457c35c0b482d7ab0150fbccc4ef1f780a0f1729a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
ddcef51cf5597405162c64ae431e8357

SHA1
bff30744c133490a57b32ca4d9d5eb1a39d0fa12

SHA256
49ec564cc368314d4c5d91e34ce07652801d571be7549ad23a8cc5d4299684f6

SHA512
56ab9c13fd7b2d5a914a3e73cf69874c774871bff59bdadf4042edc34556cc1237d72ed0514b54a217fe986a4e3be8c61045e9079fadfbf097c08c5541727cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
1153d887d59e0f1f87c4cd26490ceb16

SHA1
1f5ecd02a643362c4ce79a94ccb8426eea203d33

SHA256
af895d9fd0054f929922b1baa03b547aa2196bc68aed9602e02556f59ce137cc

SHA512
e265f3bdfff89be16ad49b9c181db46659c586ea52ca9f9829702321ba9f7582f9dce0700696e5808eebabd0294a25eacfa8867e7d207318d86f36e50960ac37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b994073f7257ca8459645dbcf9dc6530

SHA1
448e81b997b77d44e1eddc1eeb56674560ed2d44

SHA256
a12ba9fa9e6217603949312be8477f72289e004fb69ba3765bb47450666d7aa3

SHA512
4b6973d3afb349e9915e64d24ed60a4a47b72508bf8db0f36c8b2f0b441c687729d8e57f62d223e3b21d6fa38c4498299363feaff550e4ca3a14a7b5d808b401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
57de5e7b1f4b7a7a2e185c38a745c0c0

SHA1
48df34321f6564b8387fe3d5806428d580ed7e3d

SHA256
74034323410fded6cb61554318c5eb8b7c2b6a5ed8484bd677deecea3e8ee247

SHA512
f0a5ee7a96b49b391fb0bc1f87e5ffb3b5705a6eabde23dfe6bde1786c830a064a2db70129a029854c2bb8912700952f400d047a74da4686282457c0e78b08db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
406d1584e05832c74b54e1eadafc2a28

SHA1
a2f02955afc339712c00c66a9eff523d47314464

SHA256
0f3f1e24109f50006f20f3661bbbfd064f9c56e19f02dc704864d37f6bf052a4

SHA512
0bf2b8927762f50b79bfc7f93e924dc6e97ee1eb25dcfff985856eefd857a660eb7ebeecfae176f5f2e9d7c2ee16c9a9240aa7461d1641457d3aeb181032d40b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cc47ab51869a59c692a3c35592fb3298

SHA1
fa7ed695b2d7162152643abcd09e38e7b5611cdc

SHA256
291953f2dfbf1cb14f1c948c30a666d955979be7eb31f4d7ee07a220710251b0

SHA512
1399b6a51e005ff4db5234cbf2734e44e6bf459160cf499fa64e2a13576f8b55e1a686aa970b8b4eac7c05c7c78f9a98b77b2682d0b362be92f02961983f6857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
8ee84e77486bdd3120ee30fc49bec5c5

SHA1
7853c19348c301b8381d9b470535bc39a2ed43f3

SHA256
5b1c79dc4873f332d339b2c6633b7d654769c2e63b74620ee589cdf72b11802f

SHA512
6e8809fa9bc0cf9c71563f303c4651b41a60627f2ba54d498f8bd2425122b8a5f772a28d7ebd0cc0fdc3293738db938cef03886eb458b061c3e244b447e1bded

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c3f21724163eb41f3b513cbc3e1ba971

SHA1
c3fac3a15f9ebdac087e9d1968f208763cdaeac3

SHA256
2ac27ccc162ea3b8834f42f202ef1933949e59fc209cd95a0ae1d699144a6fd7

SHA512
7a4b4e36e1a7bb7d889edab4e90c57be2c1e36172f6529da71c7e3946b526848654a443dd777650154587d90f4ab754517c131458bf52a872da833026b33151f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4440a253ed6423c4c86a3bd2baea44e8

SHA1
ac7e1b0a639d532671e8df32cda2ae2983ff0fe2

SHA256
e70fd1e7578ea0a0e0a5c7d9e2f80ab6919ef477d5c35614af39a6e2b047815e

SHA512
657ba069957fabddfbf24a43fe93087f8698728556b063702b0609f2c2a18b0e46b8fcaeea68c9c0bef78b5bb217ebeb79280c6b0b88aed672b7ca3f6dbdb704

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
78aa36c00bd8b912d0c144bb6557eb60

SHA1
f0136d35346b2dc9028432662d7de58af8984fd2

SHA256
bb14fb797d0361c7ddeb498aeb8b205f3383be6a496d1b62b0432ade9ad3b2f9

SHA512
4a69d921527d4c9f053d4d4f30fbab177cecb4d2816781e70258ea2a2ad5fa8178b1a18b9644b8a5ac28c4326f51b0030bb55b5e2acc4c0d5d9a72fe1cc11479

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
767bb028c4d8be119911918cd324e2e4

SHA1
1b0bddeafd987221d99df312d16b13a1be7aed8b

SHA256
278b078dff9fd636c5ee20cf1d1bdf0dd5fbe4a9acc54b76ee4b384e6ff4ff98

SHA512
57d2ad50aa00ff4552d182159fb682727e8102f1a76beda895fc99340256d9d96eef3faacb180fb661db2169985d17e737be6a029fa5e598c695e5665f9a68ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
89627913aaaf49dd3d3b5a255f4de51f

SHA1
5670378c63a271f098622a5e5171b945b737965c

SHA256
13d0e7e7728b8209c7b478c13bedcb2965a148f696fcafa5a3a42477b1cd21cd

SHA512
e6841c9cd72b74b3dce93b6ac9f3220da6e93556c886547e94cf4d514a3f7eed57666899e7a11450b262c570ae7bfb627e308ba72798866457e2aa6b9da05b8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
2b12b12f65e492cd97a81bd5d72a38e8

SHA1
3b417f2654f1a7fdbd1fe3fde9dfa6e6d42697ed

SHA256
6b1d3ceb0fa4be7720d2eacbad9f5564eb400a04efdda1420aca7800e468374d

SHA512
feb11126db4e85b932b36fcad4dbb92fd971f5f7e5bb78e94c38784a38dfeffe270047c7001d59479b14497c21bf927374a21cdd704960bd8d88d5a330e9010c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
3a1eaeb4d554ae590d5125918aae6e03

SHA1
29310c0afee56378d68cd9978205732a9516dc3a

SHA256
b328483d9543eee9fe680e00a5040cb33d840ff1bf5ccea0a1012385507b7ed8

SHA512
83abd71eebce0b6fbc8f170eb1c1bed32232161c97179fe887692b5cd9ad8905784db1c29693590baa57aed33186a49a04c2d126f74db87dfa728717b1072632

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
335103c31dbae72bca897bb1fc58f409

SHA1
5e33cc0e4541aaa8a6cd4c953c0ac44de83dd8a6

SHA256
242fd8987eed7c13be734b1df91d1d818ac4f203ba48b91e5a0bb0b40e5d01d2

SHA512
aa54d6fe824c171cae40537013774d2ee90fd7e6a16a457a64b82335ed1c68ac9f59c7447a78b1055c79c2d57b70eada7555f982e7bca2404dcf559a68957014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
633fa9ea2522913e172f5566d28dfb7d

SHA1
7d37faf7d24fdd0b19b6fb51bc358e1704209542

SHA256
3ebcaaa8bc6d216c791a3b3eefb2805aa60c969933e6dd7a57ebfd97029ea7d5

SHA512
ccd9ad7b89b7e4378bbdb2de63f9d73709037af652ffd672a0417a5cd96c6b864b3cc886462c88580b71b34904c7cfd0b5ec9d4f5565e2f2daebd10b33dce1ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
9d7c21925baaad76897e134a5f91ea85

SHA1
df0d2d1ac1a01d70f375eec9dfc4adf6e38ffad2

SHA256
e6e7cd1a585698017c06472d415a44153fa02b6f42c095f99372c8c7a56873a6

SHA512
75ba5d43e021263f7882c9086bf5ea60bdd3befd95d14905296155505ef5db20042e5ca417eb04cb72e9052f31d6f577d5a832f197e25c0be49a97c8e7b348a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
7577d0d8fad193665fa8cb0a40e9fe26

SHA1
790d4aa536284b5f441beed422fcd6820032e182

SHA256
6dabc89a3a4ed8f490179cc4be53cffb1c1091dbd6e4b46b6e59ee5a5c4186b1

SHA512
bec27fb66eb5d1bca8e1b8034c5716b55680e6e68621e2de8071207b0cfdb7f266012460782ff80e250765d52b1d0d55f114d216ad48bf364d599316bdafc56d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a1362533772d730b42c079606dcfbfd7

SHA1
33760067bab9a1d16f054c36b37dd188815939df

SHA256
acb6f539db57f387fbb5042b6a9735e5e3701e560671e1904dd692ac87e40c8e

SHA512
8156446b05f5fb7f2332f2efa6006d71ccb624b1decbc0e33258d5dc0a38af524124e044d9ebef1400a3b5385a5a6027e102ac80ac2ca441ddd23fc9908f6d62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
57d0490b286eb384e4d6a2546e8b7454

SHA1
9e9d647fdd953f1ee79acac59ed731c7fc06b1b0

SHA256
6c263f7e83368d5d8a8bd99a69e8923543b2e549c5c48965f20811b2e8e5e656

SHA512
4b9f1317b840ae69735ab186fc6da9916a06b161f0502e6b089e3f57d6a051977d2cdd12a0398a5187c196b0c089ae9f63555714d87305e257d4db83e289f7dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
74a8047a439aee1c10a8c75f52647627

SHA1
1243c6fc6c55b4de3a7281815363ac902db3b28d

SHA256
e450fe927e69ec0d029b1e3cc38f44e06077ca8167ec768869b2f23163b041ef

SHA512
0286d1d99c57dbee3689f1f8b4116a81eae4d1efae432e41cad98f3c8c87b6d5bb794ddd65b928999c63cdbffca2ff27e6a725e23e250ca7478c516dae436832

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
011652206004b3382ca108acdb46ac37

SHA1
bdd3dbec87da5e4ae41e445768283e24a4cb392b

SHA256
b7850a70f224db155274eabb0172e6ea552cc8c3191f649799653f017fea72ef

SHA512
7fd8826ef25ee7e285e79af83453018908c6873fd1580c4e5422504bc3f0532c42063562fefb15fddbf5baea7c014f7042e368506af9032fe8ede67faa7e3fa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9422fda82f79698ebaa12aeeb4723fc5

SHA1
329b92be274d2ab4e31eb7b8481a441f064fe282

SHA256
82f62f62cd2f6111d159fdd865ba78ff3ccfb54d350ea37a8f9ff4a87b65c1e2

SHA512
81a3d2acdc1804d31a08f6b36fea0aa63cc51452420b7f6377602234941b898c7c37fdcffd62d5853df62d80e069f83eaf60651eeca4599f5581dfb564e5985b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fac8cae2442faa7e6ac6391f1648d879

SHA1
a1b04d86a1bd1175cdca317f0b1ffd10e969ab9e

SHA256
5e7f8c78ba268d774e41a6836d0c32213bdb8d3c237d0195bd398c5d3c48ea03

SHA512
3ba6a0067882ea5d9a000e76e5853a0b5c42ffbd7db28578d45746a4c57446556ababf32023ccfc5e3f06fa099322185f1904c3a6541a71e98a2c312575c05f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
90a85d3f64c9d16e7b6c01bdb1c5b82f

SHA1
e124fe413e00b6e046da77e67dd7d355c2fe39b8

SHA256
30cf1ecb79ec14f7ee6ca45fb1bbfe5b1298193a6310261cec0249d659726365

SHA512
82d5fe7abb4badef7d4019e73baa5bf88d9850b26f5817efeaf3b1a978c29398de47406b4b0c8f2679dcbe9220965e508e102c3e09cb9fad9d50b495850413dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
276353c22bd178fb5a32c0ba48fbb852

SHA1
d1b3be8d72e58dfd8abb529213ad16fe172f7bd3

SHA256
13d2c14527c9fbed75fa45b1acf313e9c40fce621fafbd00a4019da182511550

SHA512
c0c57b45254b7a63f81266af7bf294d77d888f90477eae34c082e75e61d7c9a11a82a07ba7fbd9503a8864c9ce4f925c39a33c72b60e37520ddb2b6225a5f2f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
3bec5efb3fc75b040dc29952b22537d6

SHA1
0e120789c38697792e3c1d52b1714b1e3361cad1

SHA256
89621650366463de4cadc4847485befe2c68bda7ded0d34d00d591a4ed11aa3d

SHA512
6e1211e08989810a58b5de9d731495d7b93f63b035d44c8e6be3b16c8080b4bd7ba47f6496c5d0fcc6529b99ed497d572322731c4b4ba25a6a44a5acf18f3c7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
abb0b34a1a3e999052c46c1cb94505d0

SHA1
104b7fb17066e2fb2accc88ed980c0952e4e50df

SHA256
a4da26b9ddf188fef28e61fd7d3a546d51a335e4845495308efe66b4432fb35c

SHA512
14de19726ca31c68c74eb3dadebf7f3c2e29ed300caf6eff0ec0613b0ec62f05b819e2595435840c1fe0f81dc23ecf98f08909fbbea15d4d13f8f9236ad0fdef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
00dcfad9d60c0f1778b3b121baa31f15

SHA1
1956e61e71287805ac0b7fb4b9434db17a20f10e

SHA256
2b91ba8c8883e6140e0d241c3d5811c101d09624455bfa59647431000a69dffd

SHA512
0767d8c4491b69631b5d276eef449f0ffa02fae0d2b6208fd2bce2104d51c0e5c63ec9e171d4919e2e1c70cdae2dc03c8ce2cd264f27cc578cdfaff55fca5580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1a737ecd0f31159e5572b4e14faa237f

SHA1
6afd971036cfa2e3faa1c897aae118c9e6ceed82

SHA256
a75798698f9156e148d0624641c410d11c9c3cba350f94b7a6d0dadf93664d17

SHA512
205e7d0a39cbab62a7b8a2832879fe21cc45ed0a1ba29c409cc1a4d2d5f8d1ad6db43d9e8a1a53ff155248d3d02070ff8f07ba7f1505c73a4d8d27c67b176399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
366025d16047aabe4ef9ca242659777f

SHA1
38b10088948bbd10c3e7408acd3ec4797d95c963

SHA256
f0e9840e2f93fa836bf8ba7c6288bae6a812cdb56c5cc25a6cff42168a6977f6

SHA512
2cd8d396f8c962c236951470c167bf7a37838490971aea734400e9652ffae5fa07cbeab5239a2135d8846c0c19a590e27c9e6e1830cfde0b7051ad9da39ea4bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3045b4f93b8a0134ad2aad354311f75

SHA1
0ce359439b1c83d81c3c665bf493189559e30646

SHA256
3d615b1929029369e7ae2b1a087b93db8191fcb041899e7af3ce26e7070c6838

SHA512
152a2d52d45b38b196ad636b62da5559a7af466b94fa5a5c25653fdb17f965ff2482cdb6d785e0665b4de0893acd183d40d290751db3a6a9ee7025e436c0f1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
50be9c7d3740f9f36cb7059ab60ed258

SHA1
66c3eb8206b00dc11ef7179f7e6e2c6d53fd82ab

SHA256
db6ca31f191c5d38f76818d884e7a1166ea932945a3aeeafde164f4d02823bd2

SHA512
6301eff85772c046ba07a7c8b8de1b074f3fe7abebf4242175375f8cde1ce2f134377199a20aed01ab75cf2b29615910d842374b759bbeb9e6a814bc1fd2e302

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6d228bb6e7cb8982368607ce65223321

SHA1
a0730c584ae46416fb9f80b95023f522cf66b73c

SHA256
96be5e9233b32711a8c93f95827e8f871793ced3a044d412861e54b01e193f6b

SHA512
083fabf263f68227dada07648781fc632baa9f873c11ccf0f1950f754ebd3bd39fcd11a77d560aa364f06d617d8abaf44cef5bfd3185584548a1a6b6f38f9b07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
ff2ec0dd06a47796a88d8d30c1e57aca

SHA1
cb5057c8b8cbe54c24ecbe6405fd53c977e3d8a4

SHA256
1de29c7dd64b5ab94e67460243bc294fbda3ca660f8dd189b32fa2e36bda08bc

SHA512
451c588f844eb4afc9c7918406381af4fa7acf869facf0f9c1d569ae0102d08b108b8eb18c0c5ae3d8ecc593d4aaebd8203d1dade08ca4a0124d604c5780cba3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82b7448a-ba6c-4066-a619-013d532f2776\index-dir\the-real-index

Filesize
2KB

MD5
5aec8c81dcb29e3aed8b70e453f179e6

SHA1
62bc5562a6601ddef35ee7102e4776a751e84774

SHA256
1f77d9f6958369311c0b245534a86a020e2efe60f754eff22d0b4807886c89c6

SHA512
7b47e7388cf56a3ac0105f6c0c361b3fcb15cce11527a3cd74c8a61c51825c291bfe670e088f2098461b08bfeb4d1cb90384a22412f2f032224083d2b51cb64d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82b7448a-ba6c-4066-a619-013d532f2776\index-dir\the-real-index

Filesize
2KB

MD5
3dbcd5f37381910eea802541464aa7de

SHA1
c3db6dce085f8588a1bd8fcc97cdcf6d2417561f

SHA256
8bdc7ace97f0cd5879541727dedab04d13b863c3788dd73f28a494bfd0522fd6

SHA512
f54d2d4544321279e54e061b8815dfb0803031b32c3b5eba40f0ff5dfdf246687b320accd58deacfa94f896d8bb7a2ee8fa9c126301669c91a21256deb92394e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82b7448a-ba6c-4066-a619-013d532f2776\index-dir\the-real-index~RFe5b4850.TMP

Filesize
48B

MD5
9a48502be4288494704dd0215379b309

SHA1
cfa67020026d152226611fa816ee8b1c27877f3c

SHA256
78c5be00b52a5847bcce3fa515b1973c0837ac06d51721579e0d79c1f4e0fecd

SHA512
099020f49fc533369d94005896d75ae9b828bfac03476c39c95e9e9bbb3e3a787fb260f4cb25f0b0b867dcda2964092f1d9addb4ee72b531dae113ee73ca486e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ba573522-e796-486b-9cd6-e2e7449a9907\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ba573522-e796-486b-9cd6-e2e7449a9907\index-dir\the-real-index

Filesize
624B

MD5
2531f991515a1541fd548c1c6391a555

SHA1
57135ef376eaa6dfa48920f42772c67d6572ec20

SHA256
6fe3c9d56dd7ea5f7c38c133cd5d08198c095518ba34216b0598a9cc11c91e91

SHA512
b9ac1434009fa2315a2202b746599516193f22d9b488b0d7d308b027da4944f4d435e599d446e9f415bfc3fb689458ae3a7280f96c5769375b993a50a2863055

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ba573522-e796-486b-9cd6-e2e7449a9907\index-dir\the-real-index~RFe5bc62b.TMP

Filesize
48B

MD5
f26642b578f156489e0b70686e4b8108

SHA1
924a75e45788f310e817197b879f0ed60280ef50

SHA256
1068351b4b19e08a5b764d6a50b81de12010035ccb7bd3910a9bf34ce266639c

SHA512
f5f10f3c90096b067af2c647cdcf340ecc83037e682adcbbee158765091b4cf5c6d5eefce65cbd8979458b0e239bfae6517e6e7ec80a85f27079dd74b049159e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
178B

MD5
bbabb46d30e5e926539e001fbd88f1bf

SHA1
05013bb99eac6b1684823f1302afc87c9f85b186

SHA256
c2486a884353f60e11acf14ba3359ffe196f729376d5611ed8d616648d470017

SHA512
2faf6bc30c22ec1f84bd5e5ecff98d8b1e6bc1bd3271a7a9a5a60ed9ac4511c32342f9eaa22b6b299105fecd6eca07abb70e5ad27609d31ea8c1f818a0346379

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
187B

MD5
b88489352cfca18a1b93bc244ce2f2c4

SHA1
2d10af2f6dadfb8f5c99916410a7d5f9d0204aea

SHA256
aae42b68560501ed2ff123f6a592429f5009442effb0bf156af2a66d0c05d2e9

SHA512
3a12f2cd143ade6a5509b39b064cdf1759cd64c06f9d7c211c784df0c2391f215f3c65780771abc487d3510665ceca7f0637884930e3ece092c75ba2f09c5ef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
183B

MD5
66483eea5874b7ef79303370416c4191

SHA1
34eb7af92df3b2c5cf5801d5098d6dd63501836c

SHA256
deefb5411ce8ad2100b5c52d437f9c3c0b823dcc5ad93d69bf75d0eb6ca4b5a2

SHA512
84fad850ed51b1f63664aa70e97292c95ba9d3c3f8a2ddcea773dae06b5a23488b79e1cc11823454f9a0f06382bdfb73890947147b24783b67f87cba92bdb0ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
114B

MD5
89ba707559770ba87583a2d4a5412839

SHA1
4b79cfe73d07d7bdf2c8980aeae67d5ed06d89a6

SHA256
1a3dca857b9d548db1e7cddd0159d92ec736e256facca73526c6062b8952cdca

SHA512
e9366b88eaba28449f9986dfa3be8b7b1b475e3e258781143c5067d22847021f97687164565b3130fe636240744be147d78a2470c4e5af1fba24a71740a50046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
e81a3c329f5dc113345aedd2d51c6a44

SHA1
477eeab8c67717272f8cce441042c6f218ffa936

SHA256
4a1f4a5b734a2769e4f9bdf9a45ad9b1b2892cc5689c609edcb1a89e11117f25

SHA512
a6e235002707d56891cea3c3b1914187fdf947554878da623052b402510774a5cba062837c7f8656cd86026e2fb86e1a8ee035459cc73e487c126fb21adb4453

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
304149f5f1d3264bc74216961f28b2fc

SHA1
86129ebe07f026a4ca51dc0d22e4e4c4d65aff37

SHA256
464dbde3310ceac839bc05c9d6aae9c5432f4eeba64cc163b04cfe79f85dc3d7

SHA512
50f2229cc66e24889d05d77ddc22d8ea9c2ac05e1f7909929621e68857bb26b880e9500e92aebde2423ab0d8cb577a926f4f0fc6d13eeb23d17afa76a8122ec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5b1440.TMP

Filesize
119B

MD5
a232af13a8dd3cb47cbb0ffc34f9c26d

SHA1
0dcdba669db6796c4103778dbae3515c4938a4dc

SHA256
aa7cb4feed7742aafeb81fe1092c8aa783bde3a4516fc52c783afcbb6ea539ee

SHA512
76ba36cd5b80919f97e927a540c5e616788c99a96d7b7cdd8b8ea56fa2248688bb58f28e9a0b2b2aaacea2273c11561f299b43bd590ffc5617d18c8901688253

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9badc41aab0d417a93e0c0c47441c625

SHA1
07bb7e9fd414f0036be2edf3e507e463f55ccb92

SHA256
086663a4d4176db5f096fec57b608665adade5cb13ebd349d6e853de156f4a5a

SHA512
d39a4aeebfc67bb0819ed43585d852a8ce7c929521551658f7c76d65981b7cfeadb143858daa1eead15cfa1056a5038c13d9739f532d70ec14b1fe201e989d43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
cc6d71f9c7707e4030967811950ca364

SHA1
6187bc4deca6e9af85c08d3f1877e6396536223d

SHA256
28df50881d3a7dd383ee42dde5295a8cc432bf0c638e5ede0d9f517183433154

SHA512
2fa2229fce9e0f6df8f8e98f88747b2d646ce05219abc29a5dc8f1ce18afa0236dd0a1d993d2638f665a1b8327b18ff42140855debb2449d2a3114a296403fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2488_189298864\Shortcuts Menu Icons\Monochrome\0\512.png

Filesize
2KB

MD5
206fd9669027c437a36fbf7d73657db7

SHA1
8dee68de4deac72e86bbb28b8e5a915df3b5f3a5

SHA256
0d17a989f42bc129aca8e755871a7025acb6292ce06ca2437e95bedbc328fa18

SHA512
2c89878ec8466edf1f214d918aefc6a9b3de46d06ffacff4fdb85566560e94068601b1e4377d9d2eabefdc1c7f09eb46b00cf4545e377cc84a69edf8e57e48b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2488_189298864\Shortcuts Menu Icons\Monochrome\1\512.png

Filesize
10KB

MD5
529a0ad2f85dff6370e98e206ecb6ef9

SHA1
7a4ff97f02962afeca94f1815168f41ba54b0691

SHA256
31db550eb9c0d9afd316dc85cdfd832510e2c48e7d37d4a610c175667a4599c6

SHA512
d00e2d741a0a6321c92a4aab632f8f3bafd33c0e2875f37868e195ed5e7200a647b4c83358edcef5fc7acbc5c57f70410903f39eac76e23e88a342ac5c9c21cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
4b56601440d5a2e4dad461199d7c36d2

SHA1
7dfd262ca2433796f140a03d110e8ea3d50fe12c

SHA256
082dac932797a58bb65f20a04c843ba96432ada6bbed99df3c4fd05ede43ce36

SHA512
f9fe14e0abd5479c25b92b1c2186f073882c72c5a76dc0c026f67212264f4ed03a530b47e5e02fb9b5243906b668cf9d24cd1d6da9c230baffc65d1591e0c536

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
d32d7016326e755afe5004a2224ea05d

SHA1
e86a9571af0deb27b96bb99e48d3f778268a4ab5

SHA256
f141892036c0682e06abad04883d5a0174dfad0fe6247d7fdeef2fd7d9b89e91

SHA512
13735d9b77c8656cc682fbe19541ab4d7532b0b7e9463ae7af0b14f6f3caf2911f252dbaded3acd7344ccfd908289b4dee7c8c8b03afe2d6ffc174fd0fc96736

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
112ad82f86ccd11f0940d6517e15724b

SHA1
005e1728a45e97af265645d35f5555a674524542

SHA256
5e01cbd89dba2b81e32ab7c763ccb248ee8caedc2ec3a94736b046c02f2f96dd

SHA512
114ba620f171cfa0e72f2f08e83b6392a140842dfccdf4cf1d98496fb00a1b6790673ba4980366ad2d27ff8ff5c37ebb0797f09b53a36754161a5a8a076ce341

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0e4df74cce0423376e6a782e4b3deb64

Filesize
7.0MB

MD5
0e4df74cce0423376e6a782e4b3deb64

SHA1
8db193e73416f1da44ad98f344d3ff207ace44ac

SHA256
8b9263763da2c73054426eb6a8de5c4e7f42ecd11e9c95a426b0c66aedd727ab

SHA512
ca3136acde16e33c80a0f50c5f73a2eda795ebf9a90f7bcd4803b5cf2c51135b2ec2ae40d06015ab6fe4b2b18bfc0a95712bc98dcf5f2cc85192bb715a021642

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_338857134\4d299cd6-aa5a-462b-b925-12493fb7ccf7.tmp

Filesize
135KB

MD5
3f6f93c3dccd4a91c4eb25c7f6feb1c1

SHA1
9b73f46adfa1f4464929b408407e73d4535c6827

SHA256
19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

SHA512
d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_338857134\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.9MB

MD5
1c4187f0b612a9a473010dcc37c37a82

SHA1
34d46733452812d481adeedad5eaea2cf4342540

SHA256
c8d55b0f4f25caf135dabc7f21b9548263022107e9740dfe692b402469cd47bd

SHA512
075678e24a867d5630da324e934837d81a3fa1d848a15feeb2a7be268d38b81ca4210cd44a22e9869173edebecd1947968327ddce16a85b71c03e6307e365def

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Installer\MSID9C6.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIDA74.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIE3FB.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
35a094e1e73e849d2e309d7352fbe44f

SHA1
615aa30fd331df239233279f40fe06212c44c0f2

SHA256
2d7ea0bf2fcab7177ad4312cb257adf378d4529dd8eb68d1de8ee2bb87dde36d

SHA512
eac304bba74db71eba09c0eb26a249ff57068eb385afd43aa8c6d480c73d050aa0581043eca952552397db98e7e9e6b67535bfe87e65acf27b1b4a6d129c5bee

Download Submit
memory/1724-5-0x00007FFC74E13000-0x00007FFC74E15000-memory.dmp

Filesize
8KB

Download
memory/1724-0-0x00007FFC74E13000-0x00007FFC74E15000-memory.dmp

Filesize
8KB

Download
memory/1724-1-0x0000026B775B0000-0x0000026B7767E000-memory.dmp

Filesize
824KB

Download
memory/1724-2387-0x0000026B79D80000-0x0000026B79D92000-memory.dmp

Filesize
72KB

Download
memory/1724-2385-0x0000026B7BE80000-0x0000026B7BE8A000-memory.dmp

Filesize
40KB

Download
memory/1724-2-0x00007FFC74E10000-0x00007FFC758D2000-memory.dmp

Filesize
10.8MB

Download
memory/1724-2807-0x00007FFC74E10000-0x00007FFC758D2000-memory.dmp

Filesize
10.8MB

Download
memory/1724-4-0x0000026B7BCF0000-0x0000026B7BD12000-memory.dmp

Filesize
136KB

Download
memory/1724-30-0x00007FFC74E10000-0x00007FFC758D2000-memory.dmp

Filesize
10.8MB

Download
memory/3580-4603-0x0000000073510000-0x0000000073720000-memory.dmp

Filesize
2.1MB

Download
memory/3580-4602-0x0000000000C40000-0x0000000000C75000-memory.dmp

Filesize
212KB

Download
memory/3580-4944-0x0000000073510000-0x0000000073720000-memory.dmp

Filesize
2.1MB

Download
memory/3580-5555-0x0000000000C40000-0x0000000000C75000-memory.dmp

Filesize
212KB

Download
memory/4824-2810-0x00000259690A0000-0x0000025969152000-memory.dmp

Filesize
712KB

Download
memory/4824-2808-0x0000025968FE0000-0x000002596909A000-memory.dmp

Filesize
744KB

Download
memory/4824-2806-0x0000025969370000-0x00000259698AC000-memory.dmp

Filesize
5.2MB

Download
memory/4824-2803-0x000002594E800000-0x000002594E824000-memory.dmp

Filesize
144KB

Download