8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Resubmissions

30-11-2024 23:36

241130-3lzzastmbm 8

30-11-2024 23:28

241130-3f9xbaynex 9

Analysis

max time kernel
447s
max time network
441s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 18 IoCs

pid	Process
4324	Solara.exe
1960	RobloxPlayerInstaller.exe
3724	MicrosoftEdgeWebview2Setup.exe
1600	MicrosoftEdgeUpdate.exe
4712	MicrosoftEdgeUpdate.exe
1236	MicrosoftEdgeUpdate.exe
2620	MicrosoftEdgeUpdateComRegisterShell64.exe
1632	MicrosoftEdgeUpdateComRegisterShell64.exe
4512	MicrosoftEdgeUpdateComRegisterShell64.exe
4764	MicrosoftEdgeUpdate.exe
3460	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
2992	MicrosoftEdgeUpdate.exe
4144	MicrosoftEdge_X64_131.0.2903.70.exe
3796	setup.exe
1112	setup.exe
3156	MicrosoftEdgeUpdate.exe
380	RobloxPlayerBeta.exe

Loads dropped DLL 28 IoCs

pid	Process
2396	MsiExec.exe
2396	MsiExec.exe
5000	MsiExec.exe
5000	MsiExec.exe
5000	MsiExec.exe
5000	MsiExec.exe
5000	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
2396	MsiExec.exe
1600	MicrosoftEdgeUpdate.exe
4712	MicrosoftEdgeUpdate.exe
1236	MicrosoftEdgeUpdate.exe
2620	MicrosoftEdgeUpdateComRegisterShell64.exe
1236	MicrosoftEdgeUpdate.exe
1632	MicrosoftEdgeUpdateComRegisterShell64.exe
1236	MicrosoftEdgeUpdate.exe
4512	MicrosoftEdgeUpdateComRegisterShell64.exe
1236	MicrosoftEdgeUpdate.exe
4764	MicrosoftEdgeUpdate.exe
3460	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
3460	MicrosoftEdgeUpdate.exe
2992	MicrosoftEdgeUpdate.exe
3156	MicrosoftEdgeUpdate.exe
380	RobloxPlayerBeta.exe

Unexpected DNS network traffic destination 32 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
31	60	msiexec.exe
33	60	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	pastebin.com
68	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
374	api.ipify.org
376	api.ipify.org
370	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
380	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe
380	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\is-clean.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\th.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-bugs.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-regex\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\plumbing.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\localizationTargetEnglish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\R15Migrator\start-page-anim.mp4	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\dpadUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\destroy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\is-windows.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\ic-more-settings.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-completion.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\process-release.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\index.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnimationEditor\btn_addEvent_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AssetImport\btn_light_showworkspace_28x28.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\readyforsale.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ls.md	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VerifiedBadgeNameIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\SelfView\SelfView_icon_indicator_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\9-slice\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\key.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnchorCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnimationEditor\btn_edit.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\GameSettings\CheckedBoxDark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\New\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\bs.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\package-envs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\archy\examples\multi_line.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\header.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\patch\create.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lte.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\MaterialManager\Favorite-Filled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\inflight\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\gridview.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VirtualCursor\cursorArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\category\ic-top [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\api-ms-win-crt-string-l1-1-0.dll	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\read.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\NoBackgroundIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioSharedUI\default_user.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB77B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC1F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE615.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB71B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB74B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE73.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC48E.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE18E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e57b342.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b342.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE365.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b346.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4764	MicrosoftEdgeUpdate.exe
2992	MicrosoftEdgeUpdate.exe
3156	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3724	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133774834742501697"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1488	Bootstrapper.exe
1488	Bootstrapper.exe
60	msiexec.exe
60	msiexec.exe
4092	chrome.exe
4092	chrome.exe
4324	Solara.exe
4324	Solara.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
1960	RobloxPlayerInstaller.exe
1960	RobloxPlayerInstaller.exe
1600	MicrosoftEdgeUpdate.exe
1600	MicrosoftEdgeUpdate.exe
1600	MicrosoftEdgeUpdate.exe
1600	MicrosoftEdgeUpdate.exe
1600	MicrosoftEdgeUpdate.exe
1600	MicrosoftEdgeUpdate.exe
380	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe
Token: SeDebugPrivilege	1488	Bootstrapper.exe
Token: SeShutdownPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeSecurityPrivilege	60	msiexec.exe
Token: SeCreateTokenPrivilege	1936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1936	msiexec.exe
Token: SeLockMemoryPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeMachineAccountPrivilege	1936	msiexec.exe
Token: SeTcbPrivilege	1936	msiexec.exe
Token: SeSecurityPrivilege	1936	msiexec.exe
Token: SeTakeOwnershipPrivilege	1936	msiexec.exe
Token: SeLoadDriverPrivilege	1936	msiexec.exe
Token: SeSystemProfilePrivilege	1936	msiexec.exe
Token: SeSystemtimePrivilege	1936	msiexec.exe
Token: SeProfSingleProcessPrivilege	1936	msiexec.exe
Token: SeIncBasePriorityPrivilege	1936	msiexec.exe
Token: SeCreatePagefilePrivilege	1936	msiexec.exe
Token: SeCreatePermanentPrivilege	1936	msiexec.exe
Token: SeBackupPrivilege	1936	msiexec.exe
Token: SeRestorePrivilege	1936	msiexec.exe
Token: SeShutdownPrivilege	1936	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
380	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3212	1488	Bootstrapper.exe	84
PID 1488 wrote to memory of 3212	1488	Bootstrapper.exe	84
PID 3212 wrote to memory of 3724	3212	cmd.exe	86
PID 3212 wrote to memory of 3724	3212	cmd.exe	86
PID 1488 wrote to memory of 1540	1488	Bootstrapper.exe	89
PID 1488 wrote to memory of 1540	1488	Bootstrapper.exe	89
PID 1540 wrote to memory of 3152	1540	cmd.exe	91
PID 1540 wrote to memory of 3152	1540	cmd.exe	91
PID 1488 wrote to memory of 1936	1488	Bootstrapper.exe	94
PID 1488 wrote to memory of 1936	1488	Bootstrapper.exe	94
PID 60 wrote to memory of 2396	60	msiexec.exe	100
PID 60 wrote to memory of 2396	60	msiexec.exe	100
PID 60 wrote to memory of 5000	60	msiexec.exe	101
PID 60 wrote to memory of 5000	60	msiexec.exe	101
PID 60 wrote to memory of 5000	60	msiexec.exe	101
PID 60 wrote to memory of 5108	60	msiexec.exe	112
PID 60 wrote to memory of 5108	60	msiexec.exe	112
PID 60 wrote to memory of 5108	60	msiexec.exe	112
PID 5108 wrote to memory of 3756	5108	MsiExec.exe	113
PID 5108 wrote to memory of 3756	5108	MsiExec.exe	113
PID 5108 wrote to memory of 3756	5108	MsiExec.exe	113
PID 3756 wrote to memory of 3696	3756	wevtutil.exe	115
PID 3756 wrote to memory of 3696	3756	wevtutil.exe	115
PID 4092 wrote to memory of 3660	4092	chrome.exe	119
PID 4092 wrote to memory of 3660	4092	chrome.exe	119
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 1460	4092	chrome.exe	120
PID 4092 wrote to memory of 220	4092	chrome.exe	121
PID 4092 wrote to memory of 220	4092	chrome.exe	121
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122
PID 4092 wrote to memory of 3656	4092	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6677149AE138674E825ECCBE04296C97
  2⤵
  - Loads dropped DLL
  PID:2396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0E131D4647E05854FA5ECAA7FDB380D5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBBBF5EAC2CDF851ECD0C5BA7C82907D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:3696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa08b7cc40,0x7ffa08b7cc4c,0x7ffa08b7cc58
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2008,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5056,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1104
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6516a4698,0x7ff6516a46a4,0x7ff6516a46b0
    3⤵
    PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4412,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3412,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5264,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4552,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5252,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5232,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5752,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5656,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5800,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:8
  2⤵
  PID:3412
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3724
  - - C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1600
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4712
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1236
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2620
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1632
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4512
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0FCNDVBQUMtMUYwOS00M0Y1LThBOTEtMkVCMDNBMTk2RUU3fSIgdXNlcmlkPSJ7NDFEMjVDNjAtQUI5MS00ODMwLTg3NEUtOEI2OTIzQkNBOTNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxQzJFQzA0Qi1CRjUyLTRCM0MtOTU0QS0yRjU3MDQwMDU2RDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTU2NDE5NTI3IiBpbnN0YWxsX3RpbWVfbXM9IjczMiIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{7AB45AAC-1F09-43F5-8A91-2EB03A196EE7}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3460
- - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1960
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5652,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6064,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6232,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4896,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6380,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5684,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3208,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6720,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6860,i,15723082501220687433,2925975424203236653,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4896

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1880
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0FCNDVBQUMtMUYwOS00M0Y1LThBOTEtMkVCMDNBMTk2RUU3fSIgdXNlcmlkPSJ7NDFEMjVDNjAtQUI5MS00ODMwLTg3NEUtOEI2OTIzQkNBOTNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1OTcxRTU4Ri05QjAwLTRFREUtQUYzRC1FRDNBODg2ODg1OTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NjE5NTk1NjQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2992
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\MicrosoftEdge_X64_131.0.2903.70.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\EDGEMITMP_04619.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\EDGEMITMP_04619.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3796
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\EDGEMITMP_04619.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\EDGEMITMP_04619.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9165E7A9-A73A-41F0-8D6F-8759D7E09327}\EDGEMITMP_04619.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff664d92918,0x7ff664d92924,0x7ff664d92930
      4⤵
      Executes dropped EXE
      PID:1112
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0FCNDVBQUMtMUYwOS00M0Y1LThBOTEtMkVCMDNBMTk2RUU3fSIgdXNlcmlkPSJ7NDFEMjVDNjAtQUI5MS00ODMwLTg3NEUtOEI2OTIzQkNBOTNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NEJGNUJDMS03QjgzLTRCMUQtOTQ1RC00NEM2QzkyRUE0MjF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy43MCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjk3NzI5OTY2NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5Nzc1NDk1NDAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MjIwMjY5MzYyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mODEzNjkwMS1jNWYwLTQzMjYtYmYzMy00ZDczYjg3YTE5Nzk_UDE9MTczMzYxNDg3MiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1XZjdjMzBUN3JzR1JxS1MyZEMyeGxjaiUyYlFjMW1WY1l6WFlhMmxQRmtpMU1ET2tWc1MlMmZacE10V0tCcDRQN05LZG9Sb3pINTFZVXEybFE3dEQlMmZtJTJmem9nJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBkb3dubG9hZF90aW1lX21zPSIxNzIzMiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcyMjAzNTk0NjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MjM0NDk5NTkxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODQ2Njk5NDg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTM3IiBkb3dubG9hZF90aW1lX21zPSIyNDI2NyIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTIxNyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b345.rbs

Filesize
1.0MB

MD5
c03ba8258a03ffad468efc4a64f6ce4f

SHA1
924d3afc69e5a0f97bd6c2c267a3e8a6fc68fa43

SHA256
eca2a3b1acaf3c6574aa182e6e9ebf6e60df4826fdd0d66f287a50fc506495d1

SHA512
5d9cc1ee54fea3462e11b19a757d96a7dbc986ac54b70c8f33209f94474db5567b365cb070c9751f6a03104c344fa60ab6f03e7f865c5be0a5563a8c69e2a2f8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Installer\setup.exe

Filesize
6.6MB

MD5
8ae106f9f32723071b7d89c0dd260569

SHA1
c66b0f1b5f01b0a6a8eb0dc32842983f05c992c3

SHA256
c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26

SHA512
e96e3f14239b4fd1c2e6defa65e1eb9920efcf870ad98bee872b6248ab13032976d0340f99b490d6b7034f2ac099ff4d5e613d8f46a812483b1996569bc31dd1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE996.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.8MB

MD5
ee40308e2ffbc9001db2324ff6420492

SHA1
47cabfe872311f65534cbd4b87d707ccdef559d1

SHA256
38cd32dedb5c8c2af8ecd56827af5b4477a4b9ca3e518199d389a261baa999a5

SHA512
5f5fd0db005d49d63eaa81b288d2d6d40ce9c84cafd1c75d33723e47f23341d5ff254c2ed6274790242ad53f5360467d121cf1196ec7a073d4506166248041c3

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
87c38a8e7b30413040a03ed1968c8b6e

SHA1
7226ab8bf273d8ba4ea6d38021691b83cad154ec

SHA256
c2d406dc28e97dc78a8b62b27d86d907c29c51d1c2f63f7675a4141d0040b5c3

SHA512
1f48d2d2434f6c5c5f121223d6ce0898a104955c6140572066e5e1e33051c2362df01b838c6338d36869cf5ec22e76b43dfd6f1ba80700c9b63baf08130b155c

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
80KB

MD5
b13a8acf3a17f5a154432a2094f690be

SHA1
0fe7b8ea8de29d3492ac79514f38a4b2c7246118

SHA256
2d021a1ab5245b356fe028445e389859f1fb8fc94a68cdaec50b24ca6f1697e4

SHA512
653bdf532ac24ca69237e56aa72d77c7e5583b8e2ee8a0cf929420c897d5ce6e871b180013c4b63bb1e60617a9786ac6e8506233515398e7a0a8e7add8ecce3d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
50432e4cc6425c02f76a5c1f278e0fd3

SHA1
1fe2121b95c90d80a7baf89e34d0aee0c3b769e7

SHA256
ff165b454a60530d5166acaf09e72018500a9b09290f896f58a97b88b7cd2979

SHA512
6369d5d74f87c48148614c8e8da9de58cc431ce1310677317a026b222228ef244f43f1fe414e114aaeef9232ee53c9556436b479904a4948d7407491bf9ee6ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

Filesize
92KB

MD5
8d90806f43872941b53aafae7b6257ba

SHA1
b96d82a48808a027b07ebeeed7d8b1b1541bc7fd

SHA256
2d4901efd03b3da3cf7205a2205576d12e4d75e73d951babe1210b9bc8ae3e16

SHA512
a07c8789733f2fd109962649255854e53f7b62466adbaeb1499e0c00848572f35763f3c68f27dac5b7d27de25ef82a77f2ad7d5a177b11b8d5c352931c8db83d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
47a888e9d3fe0b3b76b5b324c0183ddb

SHA1
9b1f53b3e113b369eb6485198e28527866ac0025

SHA256
412be398c960d14c09808a9d128c8e6ea043c30d0f0623f9a165a54b6834cb10

SHA512
3e93ea6a0f4145b3c7bbbf3dd3871aca4db83d82273b0ab0263ed5c6bbdc7c6628e0b9ffa79f57a1476cfd1aec95328672c24cd77bfab4ef9a157358fbdc1a1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
14c261f57281e875a0207a47a5a68f51

SHA1
20bc8d96582fcaef315bf43a8840add0531f0311

SHA256
ce219c9a7341a5dd681198e05667c38c87e978c2f66f348f3414a60a0d41d7ac

SHA512
c902a1663c106db77969086228fe207815532f1b5f8029b8de7addc5249ab237bf2808600ba14d0a7a1f903d471e20e99e696fad1f41407b6f6281f55334dfe1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
09520e7451bb4f1dd4a1467310ad1759

SHA1
f041e320da3f2c870ee012861d5bfe11e8db1350

SHA256
8611f99db27f66e701c5237b37167790b6b1c42f0e2d55230af8688489b9e6a8

SHA512
c873242d1fdff0526357cbf92a2884682d119f44ad248a986182737734d7f61f0a71249b53e1f5941389678a6d4f913bf667a458bb51cc7becc762204f987233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
23c2acf880e63e1bde09e8e1f4f66161

SHA1
2b4b775d97feda647cfc6ebb189e27e3962f7657

SHA256
bd71f26297503d56fec2b44fd0b7d72b6bb153f457492397965dd1824345c251

SHA512
ec5034ed3cf0e14751458cc2ba10d4f1b8e410bd73db12bd9eada79c98743bf02e37ff65c1e28c637a375b97b670e2912a7be8ba29ed1821e28d616239320e6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0b56bef28a72dd4b3b81676b61c3f50e

SHA1
c856d69cc50cf14f5a05f2233cecb6e6e9e84934

SHA256
30185a68aa470437ca2c2a37d441738cb827c4d1f4521c9b62378638beaa83c3

SHA512
8e30c7cefe12b03b5dd25fa6234b01bf713295ac7e69707800d1f75d36587970339562398fe3ad45fd579ce9c5619951a0861c68e2c999b27f2818d5e739d3ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
a7f70b0e94b94475db634b561acedbb8

SHA1
abb1b0595c0f6e2ebfbd7b0c2d7144dfeb5bf2dd

SHA256
f4c6b3e523c1dc95d38f101be2d71de2701414c6cb1d41f57e9e8fa756f5f5d7

SHA512
92f88855f8527d46d839244ded9f00d7c52755c69eac7cc9fa7b6e52f9dc2bf8eec562489a3225d333166b91cf9a9ad6cebb68e52078395f0090d7ea97c29663

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a34dc.TMP

Filesize
513B

MD5
4265e1d1ec839e89ef488521c588df84

SHA1
9b53cd9e658fd7d1a2fd7a7e1ead29f6a7ca54ef

SHA256
bd36bec77f972c16662e201b35bf04ed5a63dcffc8f614c817b35d64ec495a6e

SHA512
98853c1476cdbc7dc184c82d9e0a33b6001b3e8515baa788b2c547c6831af9708a68d79edc48b0ede334c08774425272d03fdadcbf91cc0e211fb36600e26ff9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\61e9eb43-b8b9-4061-a9f4-06d9936515a6.tmp

Filesize
5KB

MD5
21133dcbc0ae4bc3f25c9e3e051d54bf

SHA1
dcd716c0b5bc694b23979f3b87aa7d2ef9793db8

SHA256
98759964a7c7a2b645427e9cd4c3cf76a0fb381e4aa2994c97e6ea060ecc16d5

SHA512
c3319ae0e53e6a35fd48311e6a521b2b28219134ef15305802f6f8460023903dc29008a61ee0540b8e14031c04790412d28178346204106c7b21f301b9507f4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
76d2fbbdd80d5993320bcb29b96fd89b

SHA1
7915e8d895fba5f17e4e999783dc2e0c2d158c9e

SHA256
247dbcd6edf4213e4cc5d2798ea9cdf6a3f07030f548a25d8ae363c859e63e11

SHA512
f315d390a3cce55d83ebc514ac6d485dba4f004d5100c7b737d9e53ef7a5fb93088c78a52f20233587361bd2a00486d2c4caddfc9abfcf73d326ed3c3a6b646e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
272bb9d682553369b75a308cbfa96225

SHA1
384c0df4058e1ef5b11c61571e0c7b32177f7075

SHA256
e5518003339895aee67e61141967ea297b8fedf262fd98b1682c649fa954ce29

SHA512
be3e8459e66ef2583a08cf3782c9c2ebc8d76065c587ddcbc3c6ae3c169f8e8a9c990ad464e069df777aad3ecba2e030b4174241543d643718f0b4b4bff6ee08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
8247d168434638890b95b634cda630d7

SHA1
6822ec4c3d3e5a8a349691440ca88a6787f77ad4

SHA256
66c559e1d7a82eebfd3c551e14db54499db0d8c406cc15d619dcbdc8e8dcf77d

SHA512
f6e92c5c201f7841cacf8d8e40f750548b1af71f6338575a8a470ad998c2bc8d607738de96ea4cea8ea251cbe80fe6537bf3afbcdfc48b3396acb14ea0150131

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
4755eb70b89d66b6337d81128c5e60b9

SHA1
7db9c1cadcc12ea46abffad9815a1ea325a2e582

SHA256
cb27eff0a928d5242d70e9e57613a71cad47f986f556cdecbc3a0ecb34aa85f8

SHA512
15098d9fedc43a70a603d1bc9cf469d238efcaade3b5fbe33beef1f5d56298d4305cf936c73caa351e6341fce45541ff3b5ce664f2bf85a84438af4642a0527b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7a52b11f7a9d9bec159c21a03ad63a48

SHA1
7e9e4ff147eaf9991e97713f88d3ca1a9e067842

SHA256
b5da11c143ac27a21bbb9bf9d002226d4bc6857ec2cb5c3a7e674da4d1a2d945

SHA512
8830f36e513e8511c1aa5b653459de5b2048e40989b34c048cd14c14e09c4b1f5aa6de2138635cb90aa3bda25bbd90545513c7715fc334e09c44a1966878cd15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
228e310c816c854450b522a7ffc876d2

SHA1
04d96f923721274ff19e9a3e8149e4cacd7c0779

SHA256
97178ed2863684523ad28dbc9fdcc5bd975ecc07f41da15db96c984edfe05f16

SHA512
a77e9ad9b9785f051a78ee29b787e038eeff20e5581b640d93fa858f14fc6db427b520663f5dd42730ebadb8f03076f5a191f896164c63fda5d2e307dbccba03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ed73f52b03c09a4a6e741a39721c87bc

SHA1
3a49e89b8b4d9ffe4836c984cf07190c53016142

SHA256
d797b813e22135ca19cab4e52281ad0b0fc8d3e610d322f6b8ccc0d4d301143c

SHA512
c9fd503bd0b77e0d55d42a273b879afa83376de0d969dc1091f8eea64be30e74c1e4e1a3ee18e0d681c1a639a46badaf212c8e1c55f9c2771d777d53ee41974c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b49a8bbf4453b5089fc39337d7ece9aa

SHA1
27158b278338255b2df50caf56aa47d2f408a438

SHA256
ba1cb9cb52da9eb7d5b7eb37b2e76be6d796bbe0b31d299e660953c925336e55

SHA512
a5f44a9051b36cba23bec8e538b9d447ae083410d4c80cd170b4e652a3271430ff316ff4c8574afae98c6f3d2d8643972861635411efed51be08c669a5aa6f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
91a3abd53a6f4b07630a10ec5fc504b3

SHA1
d19e246d4f3a6aa06f75fd07c7416b33bf0ac133

SHA256
60db0ef7c0708d0bc14e42ad595fe0de2c22781b54d6eff49ba127a5d4cbad90

SHA512
5b03d47955469bc821cfd18e2c68f05319a90d5fdc22a4a1aa2422af8feaa7744b1636de04ec4a708ad4aa7e10651e44526cd2b5ce3fb66a24f4082b41569841

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4abc1262b15f2a72a1b863a8d80f8b61

SHA1
e6f1874a0749722874ed2c23915b4e889129cfc8

SHA256
ecd4ec885707a7ccae25462822426edd3e166fae540fe4967d55b651dabf7ab4

SHA512
2cc635fff9b02b396a9833d3cb4296ad7828e160e69d8c1e018921d55980c0fdc43ff50dc7437c9f08e9cc649fda38bcd2157a93033cb8f5f368274aa3161d93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a5303424f2ca7d588f3d5df0d4e62add

SHA1
ba266b64cd3368a5f1b99f01d665945e24089123

SHA256
c02ef10ae42842f658f89c228789939e5f2f2e050bf6163a32746518d2c44bd2

SHA512
c2a652a9ccf3d8ae0ff6caac887f98d3c2e4345aca43174e76f9ceb1de2e8471607b6db0c33fe67633431f4b4a98122d2b66243db6b757ad6bfe68aac33250cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
d7469962d009dd81550f393bad97a815

SHA1
674990e0b8466c1850c760a092c935a7ad2264be

SHA256
a4e99a455bbb031ee9cf4e30aaca872d43a832e6c87bb78f38105f651d55cd06

SHA512
c23513199a4dce00192a9dbbafee31bb2855db16f990fb737dad02dcd9b298f04770547721953a6ddbda153a399cfa7c9b962778923cae738e55e4f43c877021

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
fbe65573bb9534b9d5dd4afed9630c28

SHA1
acb5a5257a3d80ce787868a5106c7f1c85d537f7

SHA256
d5df63569a567b096c45da392473cea31fd3e42cc67051d14681919dcf73ab5f

SHA512
9a9028ecdcdd59ca98d245329cc570a09e6e50e09aee26418b5710a2b97fda74da6ac06dce58d88faa430b19fe5acec5115afaba7e68bec60d58408be7219a1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0c9e17fa7a3f1ab6adfb63bb86514fcd

SHA1
7ded6a918848e806e39574efc06e1e4c0264b607

SHA256
fbc34910e40e5a9ba28195167511477f6fd1f2ed2ae39b2f444652230b7586b2

SHA512
eb6aacec5789aed132e26d2f4432bb2b9ff7773854856e3bee3a6e59d4abbdccda9219bc13b09acc3012bccb27d87bdcc5be8190d64e6f0ce0193c0706972c82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1e681c53369af518e7c3daa813e8a6fe

SHA1
f0c5c37d0a0a2c63548c0c38622ac8fab13a1df6

SHA256
21e038258f692c956bbf35f9484389528fd1a528f9dda1dc906ebd4d51d5b763

SHA512
f70cab0441ac9daea695f8d1c506bc6b02d6819904fec428021c73c76eeb7c84bdb1c5e6d45b2c8cb4698f260788ca3d4e77e46804cbd4de5e5e9306b211e02e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
96fdd2a2dbc5ec0deed562da0a43f3bf

SHA1
2faf3d8622b6f854742f688ffe67b759af0642c4

SHA256
8d6387d1f3dac680fb24dec43126920e6b04702f2c54932d0217721a812291fa

SHA512
6c57fe9fbd51bef53e8a7f01aed1ba2509ca8b9c55e26d971b513a118ba6f653d733a3ead3c2e933e4c3714c167ffd038dadc8ca9d68700e361c64a1ebdc59f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
b06d8f178df73be005dae8fec2c5e072

SHA1
5c44a0580197b8584d9b30d3c608dfa62d2c5f88

SHA256
b937c2ac26c6f6b81604a04e79c33b0f6d517b02d8f96a9386090e36ce212e14

SHA512
5dc888f7d66635aae7718643d17af15d47b82d17eec9897c149f2ef2e0ac21b6ec1345528606e7299cdd14dfc1a8b6a81a5cb582b23142522d5666dd3159d2e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0dbdcc6ad1a894cf7393e21bbab81120

SHA1
a4b25afaf30cfb2fc1dc270c77d7e8bb528137b9

SHA256
056d9082d3164191a3a1a5e6328888d00f449d01793fa9a3a558764344a6105e

SHA512
33891e2cc44ce5ed08121c7abba89d8a305dce28c1e51fcd71bded51ce3caf70a203f763d754c6d04fee34a4cc14917136b0800119223cbebcf9c391d5a3cf2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
c3b8d8b31d3fda4416324d0b141c2a69

SHA1
1e50c7dbebb83f918468c2383556cae88f8a9bd9

SHA256
818ae4ba29f013b508939434300131a994d40d562d6ea761547798018a1690f6

SHA512
42d6280608e96337a41e718c1e1796cc910badc4b408c39a456e37b21c3d8b2080f3a0e3b133316526eed7217c2bb8d1652b8631f48e12d0779741d8141791ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
f917457a1ded1fdb0a0c570df01a4ade

SHA1
f899af0631cab314bc24c4bae0a76797f7bfb550

SHA256
a919a8d18a1cccb45b7553aa383666e97ce1cd293bd8ba31ef4d379c7f4e6b59

SHA512
0810026cf652a609f2e54b2325445ff7935eed19cb9b4e0cd54e87ff05af0316e44e2e29d5beb2b283e9f7c7859339bb0d6884238f406f9a05c7ab7c12467036

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
cc0c87b36a07b29de102717ec6acbb96

SHA1
bdad833c82834e254b53636e5a0b9e65a4beb36c

SHA256
5e598b9013ba2b4ebf1d367013b9ff266f17173c17ea6b383dd4ef16ac900ebd

SHA512
7b88d1ce44832dd733d48a0bd6faf85af3a2bd03bff895d4b8255c28e56295e77c5d2d533b7bdc00e81595c4cb287c9782072dce3c0fd31444cbd1aa1d49ee3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
06a11ffd84693bb4479df852eb5b2c8b

SHA1
2900c87286ef026d94271461e34a73b8f26665f6

SHA256
c2e39c2ebe9bbceb7ff17b9abe2064b8f55901f270643a87a55d45e40b4b022e

SHA512
907accdc2c18cc1ddcf39695265ebf5329cbf3a60a36940817ee368d37648ab89aadbe8239d5de39c3c42a5d92e10d45606503e4e597812a1382b542a5e5c171

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
345c4c04a2aca6b145863b406d6527ec

SHA1
d85fca0aa55075434292ea12a8edb0765a029f65

SHA256
3bf7455edce4aa63cb392af0127c2fcb333bcd2844e4bd706bbedd659bfadb4f

SHA512
712e3add53f78ea7d189a93ca44279962c9acd6a9bc05db6cbd8f4736c450389c240d2995b1380322cdc68332feead8bfd4861344cec2ff5ae7963eb4e4826db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
fdc113f2abe9712ff049fc2101c9b10d

SHA1
927f176b1800630a63c41efa1249fa8bb0bd0a0c

SHA256
39cf1e0c1ae0e0eca022d2e37759bd32a4ca7dfdb15a20a0e90fa447bdd1f2d9

SHA512
915011a46e1b6d0a2c3e4209da3168910b2b0cf08fe6e87fccdf7a12bad0973be3f71891f18ae4c33783d55d8eece4e5fe85b316bd2ede90dc7f7e4ce21c1b49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
d200e15412ef85e6638a22b619b4f787

SHA1
1019657b8efa1129fb83e0240b79a549ef358514

SHA256
63ccfaec426b6f7b7a5aaa2e0ef86bc8dd1078aca833d6a293c65b754cccd174

SHA512
99c42cf2ca5f31a2fa2a845326c6f81c5a1d95b9aa75b02f30d9bb8a40cf166251526b715a27c8e1ce2e6cc3ebcba8f0db524cf5b0ab3b02283157cb4c3b0a58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
10e71d85a0d64e5aab88fadbecf4c645

SHA1
ce5924265bc71af953c0ce946c1a057ddfc067fc

SHA256
6dd9d49b8e6b6bc08b3e582c2c756bc6a77c04a84f7c173e51499349ffc1926e

SHA512
107138e8dc453f0e378fc676b44d1d78072ab116d826fd438cdba92900ae166fb81834f86157f8f2108861c7f7185a3fd063837efc131366d8a6eba1e3c860b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fa1fdcc76c4ffc2ebedad427f3699942

SHA1
fc678b484614e03fd23c6a755d2e2e26feacf239

SHA256
cbb3ed686e53ea398732410beb32dba8383711e4bab84cb31e14cf78f642534d

SHA512
70782bd8c8945c23716d49da98a18fe478d0c7ed1e6cb57ecdf40bb99281d9847c537da382cb5a34959706425cd7dcfbdfbcda75c6e47db6abdd384b753b056d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ef8feafb74fe1b3a5afefa4c105bd8db

SHA1
8b5a0bf496e1dca8fe2ad48465bb18abe6b24e42

SHA256
4ee90cbdf6d99cb6a092c2215b46e104b0680352836f600f8022f293f3af6cdc

SHA512
b781a722b5f9005c2eec6741dfcbfdeb6e2b41763fb0c32d97b4807a65a6fc224c65e84ef19bf5a9f1dcbfe4b17e6fce9518ecac22ba1539d176480ab0f9a7d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
418c9d98a33ca26155821923e19828a4

SHA1
ef96176842a072a6f9f309db3ceb3ce55df65ea2

SHA256
faadc1cf3df3e4cbb9106c08a05fe3f82507f491c6f7be15aa69b79e8093429d

SHA512
3e7ee57558a6592a938e596e170185194a983dc292754218b3baa0317260f7eb11eefc1e06971990767bcdc802aee4b7c3793941b9e468cdd00498f8e3d3ded2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
44cf3275c2bd8072052ab74f4d7783ab

SHA1
a52e5dec67516ef6a83ee7e4a4a1dd54eb1561c8

SHA256
2d19e9557f9f9a55aabe94b1e23008070e47660fdebb2823cab3fa95cfe66dbb

SHA512
43504bcf70f58b622c453fc64f09dbf945caf015fb5fb9da9f08a733c536bbf2a1f194727b10d386f23a8f83f930499958325899ce022d58aaa46987ebb854f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f04e6cf9f2acc698001286c1266687ff

SHA1
ebf6031949ffc8fd87a573afdb34865c616ae979

SHA256
f02a16fd206bee5d96aa7e99132cf3e66219b57a504740fcbc9dc8f4be961e9a

SHA512
1faa7d7f495edd446217a061ae6019913a0c3454dd2e023f0ef0e7060cfbf325cf3bd171a6408f68e3b2d16462ce3e65f357b3498ccd4948e3d5bb4316dd3675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a7290ba7fa1e7a1c42087830a6835ab0

SHA1
9516508a42be3063b43b90d269ff7934a51e9379

SHA256
9709c686f3e5c07cfd3ff865c99629f0e68278610cacf3bd22cdea6b41637fd8

SHA512
8972e9c31563b7668715f3c39ad7ed9e98ff182d675c72716bf6223a26aa839600422f4ae94f120311e2158172bccba9f6f679d040dd4672d64ace39e8e0f0f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f06b3633f959ebae008edb97adb21a92

SHA1
b621e994522a985776ce723e7c4e59607c6b1a4c

SHA256
ac0f3628739f4fe22e9a76d79eaed540f910da979d52601ae4e89006f0a6377b

SHA512
28faa8d3f3291a18ca0ca08307de9a793618fc127e91e6999ccdfda77f8918b5912c124324484f3acf27506fdad06f5baefb9f4648500cb6a5633b431cea994a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
21a8c8eaff42258630174bcf82f7fc5e

SHA1
6c8811a5e828ac6ae9350d61c15343cc9c24ee85

SHA256
0d03df88718bae867748145ea11d25c66d5bc7944987631a497c4ce542b4a307

SHA512
a7b5cfd84211388f462d44fbab516f9207b6c9e948acafc1853e0d05cacf830f970b29b84fc9ab2170fde1528fb2ecbe0eafce2cbd66d5a194f1f5d936506440

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5f38798233a40e57e421eb0f18a44ce5

SHA1
93348cc32574b02333c6b0f2892ea141a98e5a4f

SHA256
13ec68c42d9a7e172e576c18a62c459fe5b455fab76f6e0e81b8c612f5ef5c61

SHA512
904dd19b94eb3e3f2a012f95214beffdb9b3388328272caf273add2c21b6a6db5511cdece100b5213db649f9354f4bd23489fe6b6ca3ea1cd3874cd7186cd7fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
71a4a609ea29aaac611f1e52091b3eeb

SHA1
adf51a6bceea1c1c624fa4d8f00339e1c5f5a40a

SHA256
ce106edf1a7162bc3e4d613048aa46108c8e3993428401cdac5f0af01c57e001

SHA512
df6a5aaf02beff0b5bcb7a3c674cecc832f93f02fcc1311a98f4b574622d7402aa7756a5049d79fdf3e2a334633377772ed151ba5ad052a9c20ec1f87e3393e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
dd2cb3e6d6f67f3b0b5efc1a56c52ab8

SHA1
ac771b6ecd22886c9cfead0db0d3d38985d565e7

SHA256
1361add4a89512fa74d34666ca7560f26b32dd90819ff01ba5b77250774dc068

SHA512
3e3ce6169a5a9b6b437842537180f8a2c4570d7d74857943058459857d614b922d0ad4e197d11a72b3708470bdea789ed275315584ef78f8379374b09eeeb3cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ab16a49aa108cb83504c69da091e6ad2

SHA1
8d9423aa156b38df21ae3a4c207e0f008b2f3773

SHA256
3b531949a83abe2a13f7a9c6e4b807cab7d7ce91f3b875243114e9a8e42ffa22

SHA512
118c666adef639b91dca027dba59525200417b1faa342eebc01b9f819f52c7f97968c67fd75b65f05cde511420932bf66a3d9b71c5285482827473f7e437ae4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fb1d2e2a0710cd392de0bcea0f2266f3

SHA1
7abccac3fc53c91675d9b9d1a6e71b331a462968

SHA256
4c12a7b334632cb96edaaa616da709f80cc54c205b310fb5f3f037ee15dfc982

SHA512
857b05539bc8b1582f3599fa94224fbf4c741b18d8587d8813eac2c45c5f8fab4b10867e3eabe955f225907bf0d236bd6d8f831faeab1e503b2e2690c2ce7831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9be8d5b5be3eddb8824f96c954424e2e

SHA1
dfb284bd9bd3aa681303c276892b937963e979b2

SHA256
be5112ca02011d970662b30c6847dcd65997c4b3d1aff37b65d2f87aae4d809e

SHA512
2cc53e806c3240d835ba82628975db3fde46a369eab2702281c4de16535b153ebc168ac62500b48a4935c5777997661872a52e0bb177bc34f8ed338fbd4023bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
abfee56ff484d52d2b39a9030ed8825b

SHA1
20d22bbe664f5a43b57b08faee98e7e8d20ae353

SHA256
1524d4f81962aedcfa9023b73ee8c434db5f89344108144cb254e8a09bc88183

SHA512
a13ba1891343ed311a2af284bde201164892359236e536c9a3a41f3231e61560b77b1622a04e403f6dabcb89f67478d47671c0f95fa4c6027cda76cbab868629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e2591339ea3b5700189265fd71755cc9

SHA1
75a5c1d95d7489efc151fc54f36073a8a342b852

SHA256
f838c6f331e0d36f941f0a98ff68f32e3f948464ef3c9225611720e1702294a8

SHA512
809d3c6afe66743a0de51e3d1404cbf0ffca4a3636ba22e8da9607026c36dcad598cac1da74184bf4432145739a01c1f708dbaf5b5e4b1a095bace9820668561

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4194416945b2ff0186cf05d6e33c904d

SHA1
edd7865b7a3ef0105679ed2c1dd3c0c25e3de465

SHA256
73ac90b9f517f6dc089301eab7fd235430653ad2ef3750e84e4f72720063e116

SHA512
eab24f0cdebaa413b1d713590a62a835996ec3466643a718a9cabde4884fdc5cd33c5c09fd6fb473a153e1dfb1544ae52c84e1ffa4c5986a37e59ff87039cab8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8712cc535da03d5d23616a9aa057118b

SHA1
81ebb58cea473520e43220d2c651ec09805462f2

SHA256
cd069ffabe461bc04deafc94ffc3056b67328c9fff380758e139b2471fed016d

SHA512
acefadb915d9622a8b55013294e7803a8c46250026b5c3f56a7353f29bc6b19ecebf80a6d3cf7b9820cfbb65f4b9bc60f4f930c32cb8b0ae5da99955a57a730f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba23f44b71d2cbadd823fa325094284a

SHA1
56ddfc39d16d27d9bc4b5067739a6035f4715f67

SHA256
32e6700afaf7c7ce75704b0472419276365b485c009668d577f0a02788f90957

SHA512
1c87cd0d0c7fdc4450379d8d33be76e6768d5e0d7a91dec48b46126d08ad84d5b7b24d4e0ccff69ec7b5eb7c4101c81403c8b65a0d772825680ee0ade82e0835

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9bd0740514c997cb6a2e636b7ecfe75b

SHA1
4d5dd0ae651f54dc8a254e21aaccfc657a7f398a

SHA256
1abcc14655a07be2e1ebd4ce1d16b257edb8b4dc4e01d26a46a079edf59d8a1d

SHA512
f3794097654f20c9d2c9298574bb3f2c8f873044aa213444cfdde5f5cff3d397fc8b4a1d7a79f93435d4fb43fceb022a2c9f0067a5dca55d48490374aa25fb01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2ab067e9758057258801d668ac1ae776

SHA1
906af8787578fa2101ce865bbea4161c5f21c85d

SHA256
ac8bfcf7c4ebc3c4de1353a37c8c863232451fce6059188f2ebff116289d0775

SHA512
de1c45790eddff9f7b40f1b7feda8c0026710d7a6a8edbc8f35b3c733b623c4486b7248f55a9191cfbb84a0b1d3665bb9b84802859f8e15b5405bf17482b911c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
efe0a6c87ce1244699ce31135892fbd8

SHA1
ea5aa423696b1df79fd6e66d019a0a9f68a18356

SHA256
2a3052fc0c41222b5427cb331657985ead91dbbe5961ab5544c13c45fdcd0fc8

SHA512
909ae2e4f76fecccc0b800a45045f0f23910cd45055bb43c2e788aad92041aaa42fbe90a187a1ea0b0d0c659212f2af8e8fd4aebb80895d15caaabf3ef14e824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e75287c4dc9e64cf1862805ab6eb90d4

SHA1
331135d21dfa08c124c1e01f5c9e25881a8c8f0d

SHA256
06d2f0e27b3eb56f17d4cdb8e041df37691192d248dd61ded61d58c0077950cd

SHA512
49cda1010b5077e0955d7a688bcb14c3e478fe70d64f2e931b0ef57aed353adbe399b54a7c726914fdd01fb5057f33004eb0c3efdf89f14a50e9bbbf1f85471c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ac791f6a4f848254f119a647bd49d74c

SHA1
dd6b13acf47dc82522f9c6ae64cf90ab5b04c493

SHA256
92fb38928fd4ba3c9ec9de49150ed52459658b964e656e7695ca0523f344a058

SHA512
6cd29188b482e26ae08bf5ee80351b66a753da7e292ed9a6385c3c1434aae72ad771bfda93274565bf3f07315c898e34074c188f4c4cd4eab5ddc3a331995168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8ba7ce540e18e52642ce990a9e53efbd

SHA1
37caf5b5679491688bbe364fbdc6aeb1ff559981

SHA256
1a31a68289eda1bbaf31fea22e2c9f337abbcbfdb90b6300b70a93a3071a0aa7

SHA512
457d211efdb8bf0c5d6993bbe05f0ab73590d3ebee18751b3216143e6f6f9dc5c47ddf1f8452d2905f1ec87b981c3ea7656b68cae7f361432938b57b55537dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5dc53225ea489b760bb34d84bc59a6f4

SHA1
0621d9181d1ac10ad72940fc28a99c0a41a4bb7d

SHA256
7c8bb4a1a692d775c1fc74c02d12c5d3180bc98d5f15ad29bb5a91392110b52f

SHA512
c0e85714505d0c6e60bac75494330230b8a1f9e6336fcb28ac0a0b49146e64336dfa649444f6975d49b95939a907e558d0ac8ad66e069263891c9019775f6bad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f7e6d1b20bd4a18f0355fe88f36d0908

SHA1
c321b88a6525025bfd8f2292fcb861cee0826f19

SHA256
0acf57c3516b2dc5496f737532b12cd01f3f638141c7b3fedef2f86f6e7c1d61

SHA512
9b44ef6fd89de0eec986afa32fd7534697eeddb88ee657a60a37627d88b414cce2f880f51d152dac6b595ff36d2bdb99902ccbf972433a234bc9d68ce2cb3660

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b6788401-508c-4690-93c8-9131bd64fe9a.tmp

Filesize
11KB

MD5
45ab72533c269de6fc8728e94aff943b

SHA1
02e61d47812df1042d756040700b0df844fbe094

SHA256
0fb407a3b8a18b48e55abad7e300f7ad588c290cade2169b0869cee304b32ea9

SHA512
673418a6cc330bb71dcb93a9c056544b60fa38fc22ed7a8607bdb84cf9a1dbdf9432c0c77267192873d7633013a77b8c22f9ad21b9950c6f5cb907fa30e70ea2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bdb61475-b017-4ec3-96e9-9d82400b8825.tmp

Filesize
9KB

MD5
ea43ca7adb219a6682e5b5d4b538129d

SHA1
8da8b46aac5280b4bd81d9e95274d4f856cfdfd6

SHA256
d69e75aa7685a844eda0aa2c183c792cc7834cc785d93dde93e4f6b44f368ff9

SHA512
67acff6af37cda8a1b78e588259c8818fe662be8487d8cf0c703dcc4aa80f0fd5bcfae9af799a613fd15a1c7e1ec062939ab859ed52d499cd0e9e30481453161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
4ed6a7094fa687dde3b0675e5c911197

SHA1
bc071df241685037e36130355a0ae2ed8e85efc7

SHA256
ae2297489de40c33eac3053bc75c6817c75fd165218ec283b45fab9b03a3da0f

SHA512
1611db32cfba59c79e0e350b5c6ed2cf88aef9c778c1609a272a08be81583bdbb43d77df56d0a0cdafe00ce2f5dc19d58e57ceae07d4e1f92d837ad7855115f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
661629b89034e0004c230ae15b341f8a

SHA1
e10a404e6bb62a7d54a2454c2d62a484f0e4977b

SHA256
76f4cc1c58860a1d519bf8d4ab54dc43b58549a37bdc6876d9cc6e712930eba8

SHA512
a512082ef0192e5600c3ba0ec01d4ad220688ef35d73778f6f59dcbdbad79c64c6931c59d509a8c3b750168904690d789d626d017b0c6bdebcb23f147ba36a57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
c35f3d4437188591d8cedde0ab6b3212

SHA1
88bcff244da0325d57764a8720bc3ee86dd1dd6d

SHA256
816aa183f5f405b3bf0afada40b824a9689ae49b5ba4488318f875a9f3952c60

SHA512
9be56435e0fb9c4a757bcfc3d237ff635caa2ab4dc86cb37d5cab8b7a6527129435806035de1e4f6fdeef623bdd44f90b29ceb21602ad302700f0f2f3dbf5691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
cd88557f158f6bb2f64437ea5daf8cdd

SHA1
8d88dbf9c584cf7f82ebfe4ffc1fa76336968896

SHA256
86bed61078b467d6b2d2601e14200b00826ec63bc51cf062fe5fd99932cd8d46

SHA512
285e495b5bd42b9ea57a070cf4af0ba60ed49b7fecee843f9c1104cf5c4b7d6e22f07949d7f6c12044a15af740de8a5cd0779ed54a1d7da10509b35230d86015

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0e4df74cce0423376e6a782e4b3deb64

Filesize
7.0MB

MD5
0e4df74cce0423376e6a782e4b3deb64

SHA1
8db193e73416f1da44ad98f344d3ff207ace44ac

SHA256
8b9263763da2c73054426eb6a8de5c4e7f42ecd11e9c95a426b0c66aedd727ab

SHA512
ca3136acde16e33c80a0f50c5f73a2eda795ebf9a90f7bcd4803b5cf2c51135b2ec2ae40d06015ab6fe4b2b18bfc0a95712bc98dcf5f2cc85192bb715a021642

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.9MB

MD5
1c4187f0b612a9a473010dcc37c37a82

SHA1
34d46733452812d481adeedad5eaea2cf4342540

SHA256
c8d55b0f4f25caf135dabc7f21b9548263022107e9740dfe692b402469cd47bd

SHA512
075678e24a867d5630da324e934837d81a3fa1d848a15feeb2a7be268d38b81ca4210cd44a22e9869173edebecd1947968327ddce16a85b71c03e6307e365def

Download Submit
C:\Windows\Installer\MSIB71B.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIB77B.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIBE43.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/380-4660-0x00007FFA2CE10000-0x00007FFA2CE20000-memory.dmp

Filesize
64KB

Download
memory/380-4664-0x00007FFA2CEC0000-0x00007FFA2CECE000-memory.dmp

Filesize
56KB

Download
memory/380-4636-0x00007FFA2E9D0000-0x00007FFA2EA00000-memory.dmp

Filesize
192KB

Download
memory/380-4640-0x00007FFA2EA60000-0x00007FFA2EA65000-memory.dmp

Filesize
20KB

Download
memory/380-4639-0x00007FFA2E9D0000-0x00007FFA2EA00000-memory.dmp

Filesize
192KB

Download
memory/380-4638-0x00007FFA2E9D0000-0x00007FFA2EA00000-memory.dmp

Filesize
192KB

Download
memory/380-4635-0x00007FFA2E9D0000-0x00007FFA2EA00000-memory.dmp

Filesize
192KB

Download
memory/380-4634-0x00007FFA2E980000-0x00007FFA2E990000-memory.dmp

Filesize
64KB

Download
memory/380-4633-0x00007FFA2E980000-0x00007FFA2E990000-memory.dmp

Filesize
64KB

Download
memory/380-4632-0x00007FFA2E870000-0x00007FFA2E880000-memory.dmp

Filesize
64KB

Download
memory/380-4637-0x00007FFA2E9D0000-0x00007FFA2EA00000-memory.dmp

Filesize
192KB

Download
memory/380-4648-0x00007FFA2D260000-0x00007FFA2D270000-memory.dmp

Filesize
64KB

Download
memory/380-4649-0x00007FFA2D260000-0x00007FFA2D270000-memory.dmp

Filesize
64KB

Download
memory/380-4646-0x00007FFA2D260000-0x00007FFA2D270000-memory.dmp

Filesize
64KB

Download
memory/380-4645-0x00007FFA2D260000-0x00007FFA2D270000-memory.dmp

Filesize
64KB

Download
memory/380-4644-0x00007FFA2D240000-0x00007FFA2D250000-memory.dmp

Filesize
64KB

Download
memory/380-4643-0x00007FFA2D240000-0x00007FFA2D250000-memory.dmp

Filesize
64KB

Download
memory/380-4642-0x00007FFA2D1B0000-0x00007FFA2D1C0000-memory.dmp

Filesize
64KB

Download
memory/380-4647-0x00007FFA2D260000-0x00007FFA2D270000-memory.dmp

Filesize
64KB

Download
memory/380-4641-0x00007FFA2D1B0000-0x00007FFA2D1C0000-memory.dmp

Filesize
64KB

Download
memory/380-4650-0x00007FFA2BFC0000-0x00007FFA2BFD0000-memory.dmp

Filesize
64KB

Download
memory/380-4657-0x00007FFA2C240000-0x00007FFA2C270000-memory.dmp

Filesize
192KB

Download
memory/380-4658-0x00007FFA2C240000-0x00007FFA2C270000-memory.dmp

Filesize
192KB

Download
memory/380-4656-0x00007FFA2C240000-0x00007FFA2C270000-memory.dmp

Filesize
192KB

Download
memory/380-4655-0x00007FFA2C240000-0x00007FFA2C270000-memory.dmp

Filesize
192KB

Download
memory/380-4654-0x00007FFA2C240000-0x00007FFA2C270000-memory.dmp

Filesize
192KB

Download
memory/380-4653-0x00007FFA2C0D0000-0x00007FFA2C0E0000-memory.dmp

Filesize
64KB

Download
memory/380-4652-0x00007FFA2C0D0000-0x00007FFA2C0E0000-memory.dmp

Filesize
64KB

Download
memory/380-4651-0x00007FFA2BFC0000-0x00007FFA2BFD0000-memory.dmp

Filesize
64KB

Download
memory/380-4661-0x00007FFA2CEC0000-0x00007FFA2CECE000-memory.dmp

Filesize
56KB

Download
memory/380-4665-0x00007FFA2CEC0000-0x00007FFA2CECE000-memory.dmp

Filesize
56KB

Download
memory/380-4631-0x00007FFA2E870000-0x00007FFA2E880000-memory.dmp

Filesize
64KB

Download
memory/380-4663-0x00007FFA2CEC0000-0x00007FFA2CECE000-memory.dmp

Filesize
56KB

Download
memory/380-4662-0x00007FFA2CEC0000-0x00007FFA2CECE000-memory.dmp

Filesize
56KB

Download
memory/380-4672-0x00007FFA2D080000-0x00007FFA2D08B000-memory.dmp

Filesize
44KB

Download
memory/380-4671-0x00007FFA2D080000-0x00007FFA2D08B000-memory.dmp

Filesize
44KB

Download
memory/380-4670-0x00007FFA2D080000-0x00007FFA2D08B000-memory.dmp

Filesize
44KB

Download
memory/380-4669-0x00007FFA2D080000-0x00007FFA2D08B000-memory.dmp

Filesize
44KB

Download
memory/380-4668-0x00007FFA2D080000-0x00007FFA2D08B000-memory.dmp

Filesize
44KB

Download
memory/380-4667-0x00007FFA2D060000-0x00007FFA2D070000-memory.dmp

Filesize
64KB

Download
memory/380-4666-0x00007FFA2D060000-0x00007FFA2D070000-memory.dmp

Filesize
64KB

Download
memory/380-4674-0x00007FFA2C310000-0x00007FFA2C320000-memory.dmp

Filesize
64KB

Download
memory/380-4659-0x00007FFA2CE10000-0x00007FFA2CE20000-memory.dmp

Filesize
64KB

Download
memory/380-4673-0x00007FFA2C310000-0x00007FFA2C320000-memory.dmp

Filesize
64KB

Download
memory/380-4677-0x00007FFA2C440000-0x00007FFA2C466000-memory.dmp

Filesize
152KB

Download
memory/380-4676-0x00007FFA2C410000-0x00007FFA2C420000-memory.dmp

Filesize
64KB

Download
memory/380-4675-0x00007FFA2C410000-0x00007FFA2C420000-memory.dmp

Filesize
64KB

Download
memory/1488-5-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp

Filesize
8KB

Download
memory/1488-30-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1488-2385-0x0000022BE22E0000-0x0000022BE22EA000-memory.dmp

Filesize
40KB

Download
memory/1488-2409-0x0000022BE2360000-0x0000022BE2372000-memory.dmp

Filesize
72KB

Download
memory/1488-2829-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1488-2-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1488-1-0x0000022BC5C70000-0x0000022BC5D3E000-memory.dmp

Filesize
824KB

Download
memory/1488-4-0x0000022BE0550000-0x0000022BE0572000-memory.dmp

Filesize
136KB

Download
memory/1488-0-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp

Filesize
8KB

Download
memory/1600-4626-0x0000000000890000-0x00000000008C5000-memory.dmp

Filesize
212KB

Download
memory/1600-4548-0x0000000073850000-0x0000000073A60000-memory.dmp

Filesize
2.1MB

Download
memory/1600-4434-0x0000000000890000-0x00000000008C5000-memory.dmp

Filesize
212KB

Download
memory/1600-4435-0x0000000073850000-0x0000000073A60000-memory.dmp

Filesize
2.1MB

Download
memory/4324-2825-0x0000021C33BD0000-0x0000021C33BF4000-memory.dmp

Filesize
144KB

Download
memory/4324-2832-0x0000021C4ECB0000-0x0000021C4ED62000-memory.dmp

Filesize
712KB

Download
memory/4324-2830-0x0000021C4EBF0000-0x0000021C4ECAA000-memory.dmp

Filesize
744KB

Download
memory/4324-2827-0x0000021C4F070000-0x0000021C4F5AC000-memory.dmp

Filesize
5.2MB

Download